Top 10 examples of Netstat commands on Linux

This article will share with you the top 10 examples of Netstat commands on Linux.

1.all

$ netstat -all

The sample output will look like this:

Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 localhost:mysql *:* LISTEN tcp 0 0 linux-Inspiron-3:domain *:* LISTEN tcp 0 0 linux-Inspiron-35:46930 ec2-54-236-207-15:https ESTABLISHED tcp 0 0 linux-Inspiron-35:59820 maa03s22-in-f14.1:https ESTABLISHED tcp 0 0 linux-Inspiron-35:46662 sc-in-f188.1e100.n:5228 ESTABLISHED tcp 0 0 linux-Inspiron-35:41914 bom05s08-in-f4.1e:https ESTABLISHED tcp 0 0 linux-Inspiron-35:59760 maa03s22-in-f14.1:https ESTABLISHED tcp 0 0 linux-Inspiron-35:33172 ec2-54-221-62-191:https ESTABLISHED tcp 0 0 linux-Inspiron-35:43466 ec2-34-192-133-18:https ESTABLISHED tcp 0 0 linux-Inspiron-35:43480 a104-81-21-73.depl:http TIME_WAIT tcp 0 0 linux-Inspiron-35:36270 maa03s20-in-f14.1:https ESTABLISHED tcp 0 0 linux-Inspiron-35:53360 maa03s20-in-f3.1e1:http ESTABLISHED ...............

2. PID and name of the program

To display the PID and name of the program that each socket belongs, use the following command:

$ netstat --program

The sample output will look like this:

Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 linux-Inspiron-35:46930 ec2-54-236-207-15:https ESTABLISHED 23074/chrome tcp 0 0 linux-Inspiron-35:59820 maa03s22-in-f14.1:https ESTABLISHED 23235/chromium-brow tcp 0 0 linux-Inspiron-35:46662 sc-in-f188.1e100.n:5228 ESTABLISHED 23074/chrome tcp 0 0 linux-Inspiron-35:41914 bom05s08-in-f4.1e:https ESTABLISHED 23074/chrome tcp 1 0 linux-Inspiron-35:60770 117.18.237.42:http CLOSE_WAIT 23074/chrome tcp 0 0 linux-Inspiron-35:43466 ec2-34-192-133-18:https ESTABLISHED 23074/chrome ................

3. TCP port information

To get information about TCP ports, use the following command:

$ netstat --tcp

The sample output will look like this:

Active Internet connections (w/o servers) Proto Recv-Q Send-Q L ocal Address Foreign Address State tcp 0 0 linux-Inspiron-35:36310 maa03s20-in-f14.1:https ESTABLISHED tcp 0 0 linux-Inspiron-35:46930 ec2-54-236-207-15:https ESTABLISHED tcp 0 0 linux-Inspiron-35:46662 sc-in-f188.1e100.n:5228 ESTABLISHED tcp 0 0 linux-Inspiron-35:36320 maa03s20-in-f14.1:https ESTABLISHED tcp 0 0 linux-Inspiron-35:33216 ec2-54-221-62-191:https ESTABLISHED tcp 0 0 linux-Inspiron-35:46478 arn02s05-in-f3.1e:https ESTABLISHED tcp 0 0 linux-Inspiron-35:43466 ec2-34-192-133-18:https ESTABLISHED tcp 0 0 linux-Inspiron-35:60794 117.18.237.42:http ESTABLISHED tcp 0 0 linux-Inspiron-35:48080 104.244.42.136:https ESTABLISHED tcp 0 0 linux-Inspiron-35:58048 ip-166-62-112-150.:http ESTABLISHED tcp 0 0 linux-Inspiron-35:33272 bom05s08-in-f163.:https ESTABLISHED

4. UDP port information

To get UDP port information, use the following command:

$ netstat --udp

The sample output will look like this:

Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State udp 0 0 linux-Inspiron-35:46539 maa03s20-in-f5.1e:https ESTABLISHED udp 768 0 localhost:46996 linux-Inspiron-3:domain ESTABLISHED

5. List of Linux ports

To get a list of Linux ports, use the following command:

$ netstat -lx

The sample output will look like this:

Active UNIX domain sockets (only servers) Proto RefCnt Flags Type State I-Node Path unix 2 [ ACC ] STREAM LISTENING 27810 @/tmp/.ICE-unix/2345 unix 2 [ ACC ] STREAM LISTENING 26776 @/tmp/ibus/dbus-RkYlcXlm unix 2 [ ACC ] STREAM LISTENING 20175 /var/run/mysqld/mysqld.sock unix 2 [ ACC ] STREAM LISTENING 25423 /run/user/1000/systemd/private unix 2 [ ACC ] STREAM LISTENING 24848 /run/user/126/systemd/private unix 2 [ ACC ] SEQPACKET LISTENING 1784 /run/udev/control unix 2 [ ACC ] STREAM LISTENING 25933 /run/user/1000/keyring/control unix 2 [ ACC ] STREAM LISTENING 22555 /var/run/NetworkManager/private-dhcp unix 2 [ ACC ] STREAM LISTENING 24475 /run/user/1000/keyring/pkcs11 unix 2 [ ACC ] STREAM LISTENING 24477 /run/user/1000/keyring/ssh unix 2 [ ACC ] STREAM LISTENING 112357 /tmp/.com.google.Chrome.3r7jSQ/SingletonSocket

6. Show routing table

To display the routing table, use the following command:

$ netstat -r

The sample output will look like this:

Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface default TutorialsPoint1 0.0.0.0 UG 0 0 0 enp7s0 default 192.168.1.254 0.0.0.0 UG 0 0 0 wlp6s0 link-local * 255.255.0.0 U 0 0 0 enp7s0 192.168.1.0 * 255.255.255.0 U 0 0 0 enp7s0 192.168.1.0 * 255.255.255.0 U 0 0 0 wlp6s0

7. Display network statistics

To display network statistics, use the following command:

$ netstat -s

The sample output will look like this:

Ip: 226777 total packets received 99 with invalid addresses 0 forwarded 0 incoming packets discarded 213036 incoming packets delivered 126141 requests sent out 48 outgoing packets dropped Icmp: 420 ICMP messages received 120 input ICMP message failed. ICMP input histogram: destination unreachable: 414 echo requests: 6 576 ICMP messages sent 0 ICMP messages failed ICMP output histogram: destination unreachable: 570 echo replies: 6 IcmpMsg: InType3: 414 InType8: 6 OutType0: 6 OutType3: 570 ..............

8. The address families are not supported

To find unsupported address families use the following command:

$ netstat -v

The sample output will look like this:

Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 linux-Inspiron-35:46930 ec2-54-236-207-15:https ESTABLISHED tcp 0 0 linux-Inspiron-35:39418 arn09s10-in-f14.1:https ESTABLISHED tcp 0 0 linux-Inspiron-35:36398 maa03s20-in-f14.1:https ESTABLISHED tcp 0 0 linux-Inspiron-35:59950 maa03s22-in-f14.1:https ESTABLISHED tcp 0 0 linux-Inspiron-35:60888 117.18.237.42:http ESTABLISHED tcp 0 0 linux-Inspiron-35:55716 maa03s20-in-f3.1e:https TIME_WAIT tcp 0 0 linux-Inspiron-35:42044 bom05s08-in-f4.1e:https ESTABLISHED tcp 0 0 linux-Inspiron-35:49654 ec2-54-221-3-35.c:https ESTABLISHED tcp 0 0 linux-Inspiron-35:47238 sc-in-f188.1e100.n:5228 ESTABLISHED tcp 0 0 linux-Inspiron-35:42046 bom05s08-in-f4.1e:https ESTABLISHED ................

9. Network Information

To display more / more information about the network, use the following command:

$ netstat -e

The sample output will look like this:

Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State User Inode tcp 0 0 linux-Inspiron-35:46930 ec2-54-236-207-15:https ESTABLISHED linux 123811 tcp 0 0 linux-Inspiron-35:55458 52.222.136.134:https ESTABLISHED linux 148067 tcp 0 0 linux-Inspiron-35:43780 sb-in-f188.1e100.n:5228 ESTABLISHED linux 147150 tcp 0 0 linux-Inspiron-35:60924 117.18.237.42:http ESTAB LISHED linux 148291 tcp 0 0 linux-Inspiron-35:36446 maa03s20-in-f14.1:https ESTABLISHED linux 148068 tcp 0 0 linux-Inspiron-35:51126 edge-star-mini-sh:https ESTABLISHED linux 149411 tcp 0 0 linux-Inspiron-35:33338 ec2-54-221-62-191:https CLOSE_WAIT linux 146371 udp 0 0 linux-Inspiron-35:46539 maa03s20-in-f5.1e:https ESTABLISHED linux 117623 udp 768 0 localhost:46996 linux-Inspiron-3:domain ESTABLISHED linux 123551 ..............

10. Get help from Netstat

To get help from netstat, use the following command:

$ netstat -h

The sample output will look like this:

usage: netstat [-vWeenNcCF] [] -r netstat {-V|--version|-h|--help} netstat [-vWnNcaeol] [ .] netstat { [-vWeenNac] -i | [-cWnNe] -M | -s } -r, --route display routing table -i, --interfaces display interface table -g, --groups display multicast group memberships -s, --statistics display networking statistics (like SNMP) -M, --masquerade display masqueraded connections -v, --verbose be verbose -W, --wide don't truncate IP addresses -n, --numeric don't resolve names --numeric-hosts don't resolve host names --numeric-ports don't resolve port names --numeric-users don't resolve user names -N, --symbolic resolve hardware names -e, --extend display other/more information -p, --programs display PID/Program name for sockets -c, --continuous c ontinuous listing -l, --listening display listening server sockets -a, --all, --listening display all sockets (default: connected) -o, --timers display timers -F, --fib display Forwarding Information Base (default) -C, --cache display routing cache instead of FIB ={-t|--tcp} {-u|--udp} {-w|--raw} {-x|--unix} --ax25 --ipx --netrom =Use '-6|-4' or '-A ' or '--'; default: inet List of possible address families (which support routing): inet (DARPA Internet) inet6 (IPv6) ax25 (AMPR AX.25) netrom (AMPR NET/ROM) ipx (Novell IPX) ddp (Appletalk DDP) x25 (CCITT X.25)

David Pac

Update 18 December 2020