Netstat is a command-line tool used to view and analyze network connections and statistics. The tool provides detailed information about various network parameters such as network interfaces, routing tables, open ports, and active network connections.
The netstat utility is essential for Linux network administrators and system administrators to monitor and solve network-related issues and determine network traffic performance.
{getToc} $title={Table of Contents}In this tutorial, I'm going to show an example of how we can use netstat in our daily operations to troubleshoot network-reported issues.
To view all active connections and listening ports, run the following command:
[root@TechArticles ~]# netstat -a |less Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 TechArticles:domain 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:sunrpc 0.0.0.0:* LISTEN tcp 0 0 TechArticles:ssh 192.168.111.16:64056 ESTABLISHED tcp 0 36 TechArticles:ssh 192.168.111.16:63019 ESTABLISHED tcp 0 0 TechArticles:ssh 192.168.111.16:57586 ESTABLISHED tcp6 0 0 [::]:ssh [::]:* LISTEN tcp6 0 0 localhost:ipp [::]:* LISTEN tcp6 0 0 [::]:sunrpc [::]:* LISTEN udp 0 0 0.0.0.0:47894 0.0.0.0:* udp 0 0 0.0.0.0:mdns 0.0.0.0:* udp 0 0 TechArticles:domain 0.0.0.0:* udp 0 0 0.0.0.0:bootps 0.0.0.0:*
To view all TCP connections, run the following command:
[root@TechArticles ~]# netstat -at Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 TechArticles:domain 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:sunrpc 0.0.0.0:* LISTEN tcp 0 0 TechArticles:ssh 192.168.111.16:64056 ESTABLISHED tcp 0 52 TechArticles:ssh 192.168.111.16:63019 ESTABLISHED tcp 0 0 TechArticles:ssh 192.168.111.16:57586 ESTABLISHED tcp6 0 0 [::]:ssh [::]:* LISTEN tcp6 0 0 localhost:ipp [::]:* LISTEN tcp6 0 0 [::]:sunrpc [::]:* LISTEN [root@TechArticles ~]#
To view all UDP connections, run the following command:
[root@TechArticles ~]# netstat -au Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State udp 0 0 0.0.0.0:47894 0.0.0.0:* udp 0 0 0.0.0.0:mdns 0.0.0.0:* udp 0 0 TechArticles:domain 0.0.0.0:* udp 0 0 0.0.0.0:bootps 0.0.0.0:* udp 0 0 TechArticles:bootpc _gateway:bootps ESTABLISHED udp 0 0 0.0.0.0:sunrpc 0.0.0.0:* udp6 0 0 [::]:35947 [::]:* udp6 0 0 [::]:mdns [::]:* udp6 0 0 [::]:sunrpc [::]:* udp6 0 0 localhost:323 [::]:* [root@TechArticles ~]#
To view all listening ports and their associated processes, run the following command:
[root@TechArticles ~]# netstat -tulpn Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 192.168.122.1:53 0.0.0.0:* LISTEN 1614/dnsmasq tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 937/sshd tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 939/cupsd tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1/systemd tcp6 0 0 :::22 :::* LISTEN 937/sshd tcp6 0 0 ::1:631 :::* LISTEN 939/cupsd tcp6 0 0 :::111 :::* LISTEN 1/systemd udp 0 0 0.0.0.0:47894 0.0.0.0:* 808/avahi-daemon: r udp 0 0 0.0.0.0:5353 0.0.0.0:* 808/avahi-daemon: r udp 0 0 192.168.122.1:53 0.0.0.0:* 1614/dnsmasq udp 0 0 0.0.0.0:67 0.0.0.0:* 1614/dnsmasq udp 0 0 0.0.0.0:111 0.0.0.0:* 1/systemd udp 0 0 127.0.0.1:323 0.0.0.0:* 815/chronyd udp6 0 0 :::35947 :::* 808/avahi-daemon: r udp6 0 0 :::5353 :::* 808/avahi-daemon: r udp6 0 0 :::111 :::* 1/systemd udp6 0 0 ::1:323 :::* 815/chronyd
To view the routing table, run the following command:
[root@TechArticles ~]# netstat -r Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface default _gateway 0.0.0.0 UG 0 0 0 enp0s3 192.168.111.0 0.0.0.0 255.255.255.0 U 0 0 0 enp0s3 192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr0 [root@TechArticles ~]#
To view statistics for network interfaces, run the following command:
[root@TechArticles ~]# netstat -i Kernel Interface table Iface MTU RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg enp0s3 1500 52483 0 0 0 17343 0 0 0 BMRU enp0s8 1500 68 0 0 0 295 0 0 0 BMRU enp0s9 1500 245 0 0 0 64 0 0 0 BMRU lo 65536 71 0 0 0 71 0 0 0 LRU virbr0 1500 0 0 0 0 0 0 0 0 BMU
To view allListing and active listening ports connections
[root@TechArticles ~]# netstat -l Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 TechArticles:domain 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:sunrpc 0.0.0.0:* LISTEN tcp6 0 0 [::]:ssh [::]:* LISTEN tcp6 0 0 localhost:ipp [::]:* LISTEN tcp6 0 0 [::]:sunrpc [::]:* LISTEN udp 0 0 0.0.0.0:47894 0.0.0.0:* udp 0 0 0.0.0.0:mdns 0.0.0.0:* Active UNIX domain sockets (only servers) Proto RefCnt Flags Type State I-Node Path unix 2 [ ACC ] STREAM LISTENING 83970 @/tmp/.ICE-unix/6855 unix 2 [ ACC ] STREAM LISTENING 81900 /tmp/.esd-1000/socket unix 2 [ ACC ] STREAM LISTENING 22919 @irqbalance803.sock unix 2 [ ACC ] STREAM LISTENING 83599 @/tmp/dbus-tmbDv8Vfuw unix 2 [ ACC ] STREAM LISTENING 82711 /run/user/42/systemd/private unix 2 [ ACC ] STREAM LISTENING 83484 /run/user/42/wayland-0 unix 2 [ ACC ] STREAM LISTENING 82719 /run/user/42/bus unix 2 [ ACC ] STREAM LISTENING 82333 @/tmp/dbus-yOwiMtyc unix 2 [ ACC ] STREAM LISTENING 82725 /run/user/42/pulse/native
To View all the listning TCP ports
[root@TechArticles ~]# netstat -lt Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 TechArticles:domain 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:sunrpc 0.0.0.0:* LISTEN tcp6 0 0 [::]:ssh [::]:* LISTEN tcp6 0 0 localhost:ipp [::]:* LISTEN tcp6 0 0 [::]:sunrpc [::]:* LISTEN
To view all the Listning UDP ports
[root@TechArticles ~]# netstat -lu Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State udp 0 0 0.0.0.0:47894 0.0.0.0:* udp 0 0 0.0.0.0:mdns 0.0.0.0:* udp 0 0 TechArticles:domain 0.0.0.0:* udp 0 0 0.0.0.0:bootps 0.0.0.0:* udp 0 0 0.0.0.0:sunrpc 0.0.0.0:* udp6 0 0 [::]:35947 [::]:* udp6 0 0 [::]:mdns [::]:* udp6 0 0 [::]:sunrpc [::]:* udp6 0 0 localhost:323 [::]:*
To view the all the UNIX listning ports
[root@TechArticles ~]# netstat -lx | less Active UNIX domain sockets (only servers) Proto RefCnt Flags Type State I-Node Path unix 2 [ ACC ] STREAM LISTENING 83970 @/tmp/.ICE-unix/6855 unix 2 [ ACC ] STREAM LISTENING 81900 /tmp/.esd-1000/socket unix 2 [ ACC ] STREAM LISTENING 22919 @irqbalance803.sock unix 2 [ ACC ] STREAM LISTENING 83599 @/tmp/dbus-tmbDv8Vfuw unix 2 [ ACC ] STREAM LISTENING 82711 /run/user/42/systemd/private unix 2 [ ACC ] STREAM LISTENING 83484 /run/user/42/wayland-0 unix 2 [ ACC ] STREAM LISTENING 82719 /run/user/42/bus
To Print Netstat Information Continuously
[root@TechArticles ~]# netstat -c Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 TechArticles:ssh 192.168.111.16:64056 ESTABLISHED tcp 0 36 TechArticles:ssh 192.168.111.16:63019 ESTABLISHED tcp 0 0 TechArticles:ssh 192.168.111.16:57586 ESTABLISHED Active UNIX domain sockets (w/o servers) Proto RefCnt Flags Type State I-Node Path unix 2 [ ] DGRAM 82707 /run/user/42/systemd/notify unix 3 [ ] DGRAM 1424 /run/systemd/notify unix 2 [ ] DGRAM 1426 /run/systemd/cgroups-agent unix 2 [ ] DGRAM 24506 /run/chrony/chronyd.sock
Top view Listening Programs
[root@TechArticles ~]# netstat -ap | grep http tcp 0 0 TechArticles:55530 192.168.111.16:https ESTABLISHED 6881/gnome-shell
To view the TCP active Listning port numbers and IP addresses in numerical format service and process name
[root@TechArticles ~]# netstat -tnlp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 192.168.122.1:53 0.0.0.0:* LISTEN 1614/dnsmasq tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 937/sshd tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 939/cupsd tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1/systemd tcp6 0 0 :::22 :::* LISTEN 937/sshd tcp6 0 0 ::1:631 :::* LISTEN 939/cupsd tcp6 0 0 :::111 :::* LISTEN 1/systemd
-t
: This switch displays information about all active TCP connections on the system.-n
: This switch displays the port numbers and IP addresses in numerical format instead of resolving them to host names and services.-l
: This switch displays all listening ports on the system.-p
: This switch displays the process name and process ID (PID) associated with each connection or listening port.
To view the UDP active Listning port numbers and IP addresses in numerical format service and process name
[root@TechArticles ~]# netstat -nulp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name udp 0 0 0.0.0.0:47894 0.0.0.0:* 808/avahi-daemon: r udp 0 0 0.0.0.0:5353 0.0.0.0:* 808/avahi-daemon: r udp 0 0 192.168.122.1:53 0.0.0.0:* 1614/dnsmasq udp 0 0 0.0.0.0:67 0.0.0.0:* 1614/dnsmasq udp 0 0 0.0.0.0:111 0.0.0.0:* 1/systemd udp 0 0 127.0.0.1:323 0.0.0.0:* 815/chronyd udp6 0 0 :::35947 :::* 808/avahi-daemon: r udp6 0 0 :::5353 :::* 808/avahi-daemon: r udp6 0 0 :::111 :::* 1/systemd udp6 0 0 ::1:323 :::* 815/chronyd
To view the TCP and UDP both active Listning port numbers and IP addresses in numerical format service and process name
[root@TechArticles ~]# netstat -tnulp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 937/sshd tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1/systemd tcp6 0 0 :::22 :::* LISTEN 937/sshd tcp6 0 0 :::111 :::* LISTEN 1/systemd udp 0 0 0.0.0.0:47894 0.0.0.0:* 808/avahi-daemon: r udp 0 0 0.0.0.0:5353 0.0.0.0:* 808/avahi-daemon: r udp 0 0 0.0.0.0:111 0.0.0.0:* 1/systemd udp 0 0 127.0.0.1:323 0.0.0.0:* 815/chronyd udp6 0 0 :::35947 :::* 808/avahi-daemon: r udp6 0 0 :::5353 :::* 808/avahi-daemon: r udp6 0 0 :::111 :::* 1/systemd udp6 0 0 ::1:323 :::* 815/chronyd
Was this article of use to you? Post your insightful thoughts or recommendations in the comments section if you don't find this article to be helpful or if you see any outdated information, a problem, or a typo to help this article better.