Top 10 examples of Netstat commands on Linux
This article will share with you the top 10 examples of Netstat commands on Linux.
1.all
$ netstat -all
The sample output will look like this:
Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 localhost:mysql *:* LISTEN tcp 0 0 linux-Inspiron-3:domain *:* LISTEN tcp 0 0 linux-Inspiron-35:46930 ec2-54-236-207-15:https ESTABLISHED tcp 0 0 linux-Inspiron-35:59820 maa03s22-in-f14.1:https ESTABLISHED tcp 0 0 linux-Inspiron-35:46662 sc-in-f188.1e100.n:5228 ESTABLISHED tcp 0 0 linux-Inspiron-35:41914 bom05s08-in-f4.1e:https ESTABLISHED tcp 0 0 linux-Inspiron-35:59760 maa03s22-in-f14.1:https ESTABLISHED tcp 0 0 linux-Inspiron-35:33172 ec2-54-221-62-191:https ESTABLISHED tcp 0 0 linux-Inspiron-35:43466 ec2-34-192-133-18:https ESTABLISHED tcp 0 0 linux-Inspiron-35:43480 a104-81-21-73.depl:http TIME_WAIT tcp 0 0 linux-Inspiron-35:36270 maa03s20-in-f14.1:https ESTABLISHED tcp 0 0 linux-Inspiron-35:53360 maa03s20-in-f3.1e1:http ESTABLISHED ...............
2. PID and name of the program
To display the PID and name of the program that each socket belongs, use the following command:
$ netstat --program
The sample output will look like this:
Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 linux-Inspiron-35:46930 ec2-54-236-207-15:https ESTABLISHED 23074/chrome tcp 0 0 linux-Inspiron-35:59820 maa03s22-in-f14.1:https ESTABLISHED 23235/chromium-brow tcp 0 0 linux-Inspiron-35:46662 sc-in-f188.1e100.n:5228 ESTABLISHED 23074/chrome tcp 0 0 linux-Inspiron-35:41914 bom05s08-in-f4.1e:https ESTABLISHED 23074/chrome tcp 1 0 linux-Inspiron-35:60770 117.18.237.42:http CLOSE_WAIT 23074/chrome tcp 0 0 linux-Inspiron-35:43466 ec2-34-192-133-18:https ESTABLISHED 23074/chrome ................
3. TCP port information
To get information about TCP ports, use the following command:
$ netstat --tcp
The sample output will look like this:
Active Internet connections (w/o servers) Proto Recv-Q Send-Q L ocal Address Foreign Address State tcp 0 0 linux-Inspiron-35:36310 maa03s20-in-f14.1:https ESTABLISHED tcp 0 0 linux-Inspiron-35:46930 ec2-54-236-207-15:https ESTABLISHED tcp 0 0 linux-Inspiron-35:46662 sc-in-f188.1e100.n:5228 ESTABLISHED tcp 0 0 linux-Inspiron-35:36320 maa03s20-in-f14.1:https ESTABLISHED tcp 0 0 linux-Inspiron-35:33216 ec2-54-221-62-191:https ESTABLISHED tcp 0 0 linux-Inspiron-35:46478 arn02s05-in-f3.1e:https ESTABLISHED tcp 0 0 linux-Inspiron-35:43466 ec2-34-192-133-18:https ESTABLISHED tcp 0 0 linux-Inspiron-35:60794 117.18.237.42:http ESTABLISHED tcp 0 0 linux-Inspiron-35:48080 104.244.42.136:https ESTABLISHED tcp 0 0 linux-Inspiron-35:58048 ip-166-62-112-150.:http ESTABLISHED tcp 0 0 linux-Inspiron-35:33272 bom05s08-in-f163.:https ESTABLISHED
4. UDP port information
To get UDP port information, use the following command:
$ netstat --udp
The sample output will look like this:
Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State udp 0 0 linux-Inspiron-35:46539 maa03s20-in-f5.1e:https ESTABLISHED udp 768 0 localhost:46996 linux-Inspiron-3:domain ESTABLISHED
5. List of Linux ports
To get a list of Linux ports, use the following command:
$ netstat -lx
The sample output will look like this:
Active UNIX domain sockets (only servers) Proto RefCnt Flags Type State I-Node Path unix 2 [ ACC ] STREAM LISTENING 27810 @/tmp/.ICE-unix/2345 unix 2 [ ACC ] STREAM LISTENING 26776 @/tmp/ibus/dbus-RkYlcXlm unix 2 [ ACC ] STREAM LISTENING 20175 /var/run/mysqld/mysqld.sock unix 2 [ ACC ] STREAM LISTENING 25423 /run/user/1000/systemd/private unix 2 [ ACC ] STREAM LISTENING 24848 /run/user/126/systemd/private unix 2 [ ACC ] SEQPACKET LISTENING 1784 /run/udev/control unix 2 [ ACC ] STREAM LISTENING 25933 /run/user/1000/keyring/control unix 2 [ ACC ] STREAM LISTENING 22555 /var/run/NetworkManager/private-dhcp unix 2 [ ACC ] STREAM LISTENING 24475 /run/user/1000/keyring/pkcs11 unix 2 [ ACC ] STREAM LISTENING 24477 /run/user/1000/keyring/ssh unix 2 [ ACC ] STREAM LISTENING 112357 /tmp/.com.google.Chrome.3r7jSQ/SingletonSocket
6. Show routing table
To display the routing table, use the following command:
$ netstat -r
The sample output will look like this:
Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface default TutorialsPoint1 0.0.0.0 UG 0 0 0 enp7s0 default 192.168.1.254 0.0.0.0 UG 0 0 0 wlp6s0 link-local * 255.255.0.0 U 0 0 0 enp7s0 192.168.1.0 * 255.255.255.0 U 0 0 0 enp7s0 192.168.1.0 * 255.255.255.0 U 0 0 0 wlp6s0
7. Display network statistics
To display network statistics, use the following command:
$ netstat -s
The sample output will look like this:
Ip: 226777 total packets received 99 with invalid addresses 0 forwarded 0 incoming packets discarded 213036 incoming packets delivered 126141 requests sent out 48 outgoing packets dropped Icmp: 420 ICMP messages received 120 input ICMP message failed. ICMP input histogram: destination unreachable: 414 echo requests: 6 576 ICMP messages sent 0 ICMP messages failed ICMP output histogram: destination unreachable: 570 echo replies: 6 IcmpMsg: InType3: 414 InType8: 6 OutType0: 6 OutType3: 570 ..............
8. The address families are not supported
To find unsupported address families use the following command:
$ netstat -v
The sample output will look like this:
Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 linux-Inspiron-35:46930 ec2-54-236-207-15:https ESTABLISHED tcp 0 0 linux-Inspiron-35:39418 arn09s10-in-f14.1:https ESTABLISHED tcp 0 0 linux-Inspiron-35:36398 maa03s20-in-f14.1:https ESTABLISHED tcp 0 0 linux-Inspiron-35:59950 maa03s22-in-f14.1:https ESTABLISHED tcp 0 0 linux-Inspiron-35:60888 117.18.237.42:http ESTABLISHED tcp 0 0 linux-Inspiron-35:55716 maa03s20-in-f3.1e:https TIME_WAIT tcp 0 0 linux-Inspiron-35:42044 bom05s08-in-f4.1e:https ESTABLISHED tcp 0 0 linux-Inspiron-35:49654 ec2-54-221-3-35.c:https ESTABLISHED tcp 0 0 linux-Inspiron-35:47238 sc-in-f188.1e100.n:5228 ESTABLISHED tcp 0 0 linux-Inspiron-35:42046 bom05s08-in-f4.1e:https ESTABLISHED ................
9. Network Information
To display more / more information about the network, use the following command:
$ netstat -e
The sample output will look like this:
Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State User Inode tcp 0 0 linux-Inspiron-35:46930 ec2-54-236-207-15:https ESTABLISHED linux 123811 tcp 0 0 linux-Inspiron-35:55458 52.222.136.134:https ESTABLISHED linux 148067 tcp 0 0 linux-Inspiron-35:43780 sb-in-f188.1e100.n:5228 ESTABLISHED linux 147150 tcp 0 0 linux-Inspiron-35:60924 117.18.237.42:http ESTAB LISHED linux 148291 tcp 0 0 linux-Inspiron-35:36446 maa03s20-in-f14.1:https ESTABLISHED linux 148068 tcp 0 0 linux-Inspiron-35:51126 edge-star-mini-sh:https ESTABLISHED linux 149411 tcp 0 0 linux-Inspiron-35:33338 ec2-54-221-62-191:https CLOSE_WAIT linux 146371 udp 0 0 linux-Inspiron-35:46539 maa03s20-in-f5.1e:https ESTABLISHED linux 117623 udp 768 0 localhost:46996 linux-Inspiron-3:domain ESTABLISHED linux 123551 ..............
10. Get help from Netstat
To get help from netstat, use the following command:
$ netstat -h
The sample output will look like this:
usage: netstat [-vWeenNcCF] [] -r netstat {-V|--version|-h|--help} netstat [-vWnNcaeol] [ .] netstat { [-vWeenNac] -i | [-cWnNe] -M | -s } -r, --route display routing table -i, --interfaces display interface table -g, --groups display multicast group memberships -s, --statistics display networking statistics (like SNMP) -M, --masquerade display masqueraded connections -v, --verbose be verbose -W, --wide don't truncate IP addresses -n, --numeric don't resolve names --numeric-hosts don't resolve host names --numeric-ports don't resolve port names --numeric-users don't resolve user names -N, --symbolic resolve hardware names -e, --extend display other/more information -p, --programs display PID/Program name for sockets -c, --continuous c ontinuous listing -l, --listening display listening server sockets -a, --all, --listening display all sockets (default: connected) -o, --timers display timers -F, --fib display Forwarding Information Base (default) -C, --cache display routing cache instead of FIB ={-t|--tcp} {-u|--udp} {-w|--raw} {-x|--unix} --ax25 --ipx --netrom =Use '-6|-4' or '-A ' or '--'; default: inet List of possible address families (which support routing): inet (DARPA Internet) inet6 (IPv6) ax25 (AMPR AX.25) netrom (AMPR NET/ROM) ipx (Novell IPX) ddp (Appletalk DDP) x25 (CCITT X.25)
You should read it
- 5 Linux commands every sysadmin needs to know
- How to Run Linux Commands on Windows with WSL 2
- Guide to network operation for Linux users: 11 commands to know
- 15 Tar commands should try in Linux
- 14 interesting Linux commands in Terminal
- Useful commands in Unix / Linux
- 11 df commands in Linux (with example)
- How to run 2 or more Terminal commands at the same time on Linux
- Summary of the common Run CMD commands
- Kali Linux commands from AZ and commonly used commands
- Extremely dangerous commands on Windows, Linux, Mac, don't try even once
- Basic Linux commands everyone needs to know
Maybe you are interested
Turn your Nokia 'brick' phone into a mini computer running Linux
Moving files between Linux systems with SCP
Dangerous 'Helldown' Ransomware Warning Expands to Linux and VMware
Warning of new dangerous malware attack campaign targeting Linux
4 Reasons to Keep a Linux Live USB Handy
Habits to Keep Linux System Resource Usage Low