The 'netstat' command is used to display network connections, routing tables, interface statistics, masquerade connections, and multicast memberships. In the context of a suspected unauthorized device, this command can be instrumental in identifying unexpected connections and listening ports that may indicate the presence of the device causing a broadcast storm or any other type of network issue. Other commands mentioned are useful in different contexts; 'arp' displays and modifies the address resolution protocol cache, which would not directly show active connections. 'ping' is used to send ICMP echo requests to network hosts, which would not show active connections. Lastly, 'route' displays and modifies the IP routing table, which also does not display active network connections or listening ports.