diff --git a/cmk/base/legacy_checks/netstat.py b/cmk/base/legacy_checks/netstat.py
index 9c277fa980b..5a942537564 100644
--- a/cmk/base/legacy_checks/netstat.py
+++ b/cmk/base/legacy_checks/netstat.py
@@ -6,7 +6,8 @@
 
 from cmk.base.check_legacy_includes.netstat import check_netstat_generic
 
-from cmk.agent_based.legacy.v0_unstable import LegacyCheckDefinition
+from cmk.agent_based.legacy.v0_unstable import LegacyCheckDefinition, LegacyDiscoveryResult
+from cmk.agent_based.v2 import StringTable
 
 check_info = {}
 
@@ -41,8 +42,11 @@
 # tcp4  0   0   127.0.0.1.1234  127.0.0.1.5678  ESTABLISHED
 
 
-def parse_netstat(string_table):
-    def split_ip_address(ip_address):
+Section = list[tuple[str, list[str], list[str], str]]
+
+
+def parse_netstat(string_table: StringTable) -> Section:
+    def split_ip_address(ip_address: str) -> list[str]:
         if ":" in ip_address:
             return ip_address.rsplit(":", 1)
         return ip_address.rsplit(".", 1)
@@ -68,10 +72,15 @@ def split_ip_address(ip_address):
     return connections
 
 
+def discover_netstat_never(section: Section) -> LegacyDiscoveryResult:
+    yield from ()  # can only be enforced
+
+
 check_info["netstat"] = LegacyCheckDefinition(
     name="netstat",
     parse_function=parse_netstat,
     service_name="TCP Connection %s",
+    discovery_function=discover_netstat_never,
     check_function=check_netstat_generic,
     check_ruleset_name="tcp_connections",
 )
diff --git a/tests/unit/cmk/gui/plugins/wato/check_parameters/test_plugin_vs_wato.py b/tests/unit/cmk/gui/plugins/wato/check_parameters/test_plugin_vs_wato.py
index c7b3447737c..f55e2692c25 100644
--- a/tests/unit/cmk/gui/plugins/wato/check_parameters/test_plugin_vs_wato.py
+++ b/tests/unit/cmk/gui/plugins/wato/check_parameters/test_plugin_vs_wato.py
@@ -274,9 +274,9 @@ class ErrorReporter:
         # If the plugins are discovered by default, it is likely to be unintentional.
         # type # instance # wato
         ("check", "3ware_units", "raid"),  # has no params, but can be enforced.
-        ("check", "lsi_array", "raid"),
-        ("check", "md", "raid"),
-        ("check", "netstat", "tcp_connections"),
+        ("check", "lsi_array", "raid"),  # has no params, but can be enforced.
+        ("check", "md", "raid"),  # has no params, but can be enforced.
+        ("check", "netstat", "tcp_connections"),  # can only be enforced, never discovered.
         ("check", "nvidia_errors", "hw_errors"),
         ("check", "vbox_guest", "vm_state"),
         ("check", "win_netstat", "tcp_connections"),