Explain how `netstat -ano` can help an administrator investigate a network connection, and state one limit of the information it provides.

### Why this is right The options in `netstat -ano` combine three different views: all connections and listening ports, numeric addresses, and the identifier of the owning process. That makes the output useful for investigating what is listening or communicating and which process identifier is associated with it. The result is observational evidence, not a verdict about whether a process is safe. ### The concept A connection is an active communication relationship between network endpoints. A listening port is an endpoint waiting for incoming connections. Numeric output avoids delays or ambiguity caused by resolving addresses into names, and a process identifier can help an administrator connect a network entry to a running process. The output describes the state at the time the command runs; connections can change afterward. Administrators should use authorized access and corroborate unexpected entries before taking action. A process identifier identifies a process, but does not itself explain whether that process is legitimate or malicious. ### What a good answer covers - The roles of `-a`, `-n`, and `-o`. - How ports, connections, and process identifiers support investigation. - A limit: the output is a snapshot and does not establish intent or maliciousness. ### Terms - **PID**: Process Identifier. A number used by the operating system to identify a running process. - **Port**: A numbered endpoint used by network software to distinguish services or connections. - **Listening port**: A port on which a program waits for incoming network connections. - **Snapshot**: A view of system state at a particular time. ### Remember `netstat -ano` shows connection details and process identifiers, but interpretation requires more evidence.