netstat command in linux is a command-line tool used to view and analyze network connections and statistics. The tool provides detailed information about various network parameters such as network interfaces, routing tables, open ports, and active network connections.
The netstat utility is essential for Linux network administrators and system administrators to monitor and solve network-related issues and determine network traffic performance.
In this tutorial, I’m going to show an example of how we can use netstat in our daily operations to troubleshoot network-reported issues.
Table of Contents
- To View All Active Connections and Listening Ports Using the Netstat Command
- To View All TCP Connections Using the Netstat Command
- To view all UDP connections using the Netstat Command
- To view all listening ports and their associated processes using the Netstat Command
- To view the routing table using the Netstat Command:
- To view statistics for network interfaces using the Netstat Command:
- To view all Listing and active listening ports connections using the Netstat Command
- To View all the listning TCP ports using the Netstat Command
- To view all the Listning UDP ports using the Netstat Command
- To view the all the UNIX listning ports using the Netstat Command
- To Print Netstat Information Continuously using the Netstat Command
- Top view Listening Programs using the Netstat Command
- To view the TCP active Listning port numbers and IP addresses in numerical format service and process name using the Netstat Command
- To view the UDP active Listning port numbers and IP addresses in numerical format service and process name using the Netstat Command
- To view the TCP and UDP both active Listning port numbers and IP addresses in numerical format service and process name using the netstat Command
To View All Active Connections and Listening Ports Using the Netstat Command
# netstat -a | less
Usage Example:
[root@TechArticles ~]# netstat -a | less
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 TechArticles:domain 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:sunrpc 0.0.0.0:* LISTEN
tcp 0 0 TechArticles:ssh 192.168.111.16:64056 ESTABLISHED
tcp 0 36 TechArticles:ssh 192.168.111.16:63019 ESTABLISHED
tcp 0 0 TechArticles:ssh 192.168.111.16:57586 ESTABLISHED
tcp6 0 0 [::]:ssh [::]:* LISTEN
tcp6 0 0 localhost:ipp [::]:* LISTEN
tcp6 0 0 [::]:sunrpc [::]:* LISTEN
udp 0 0 0.0.0.0:47894 0.0.0.0:*
udp 0 0 0.0.0.0:mdns 0.0.0.0:*
udp 0 0 TechArticles:domain 0.0.0.0:*
udp 0 0 0.0.0.0:bootps 0.0.0.0:*
To View All TCP Connections Using the Netstat Command
[root@TechArticles ~]# netstat -at Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 TechArticles:domain 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:sunrpc 0.0.0.0:* LISTEN tcp 0 0 TechArticles:ssh 192.168.111.16:64056 ESTABLISHED tcp 0 52 TechArticles:ssh 192.168.111.16:63019 ESTABLISHED tcp 0 0 TechArticles:ssh 192.168.111.16:57586 ESTABLISHED tcp6 0 0 [::]:ssh [::]:* LISTEN tcp6 0 0 localhost:ipp [::]:* LISTEN tcp6 0 0 [::]:sunrpc [::]:* LISTEN [root@TechArticles ~]#
To view all UDP connections using the Netstat Command
[root@TechArticles ~]# netstat -au Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State udp 0 0 0.0.0.0:47894 0.0.0.0:* udp 0 0 0.0.0.0:mdns 0.0.0.0:* udp 0 0 TechArticles:domain 0.0.0.0:* udp 0 0 0.0.0.0:bootps 0.0.0.0:* udp 0 0 TechArticles:bootpc _gateway:bootps ESTABLISHED udp 0 0 0.0.0.0:sunrpc 0.0.0.0:* udp6 0 0 [::]:35947 [::]:* udp6 0 0 [::]:mdns [::]:* udp6 0 0 [::]:sunrpc [::]:* udp6 0 0 localhost:323 [::]:* [root@TechArticles ~]#
To view all listening ports and their associated processes using the Netstat Command
# netstat -tulpn
Usage Example:
[root@TechArticles ~]# netstat -tulpn Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 192.168.122.1:53 0.0.0.0:* LISTEN 1614/dnsmasq tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 937/sshd tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 939/cupsd tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1/systemd tcp6 0 0 :::22 :::* LISTEN 937/sshd tcp6 0 0 ::1:631 :::* LISTEN 939/cupsd tcp6 0 0 :::111 :::* LISTEN 1/systemd udp 0 0 0.0.0.0:47894 0.0.0.0:* 808/avahi-daemon: r udp 0 0 0.0.0.0:5353 0.0.0.0:* 808/avahi-daemon: r udp 0 0 192.168.122.1:53 0.0.0.0:* 1614/dnsmasq udp 0 0 0.0.0.0:67 0.0.0.0:* 1614/dnsmasq udp 0 0 0.0.0.0:111 0.0.0.0:* 1/systemd udp 0 0 127.0.0.1:323 0.0.0.0:* 815/chronyd udp6 0 0 :::35947 :::* 808/avahi-daemon: r udp6 0 0 :::5353 :::* 808/avahi-daemon: r udp6 0 0 :::111 :::* 1/systemd udp6 0 0 ::1:323 :::* 815/chronyd
To view the routing table using the Netstat Command:
# netstat -r
Usage Example:
[root@TechArticles ~]# netstat -r Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface default _gateway 0.0.0.0 UG 0 0 0 enp0s3 192.168.111.0 0.0.0.0 255.255.255.0 U 0 0 0 enp0s3 192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr0 [root@TechArticles ~]#
To view statistics for network interfaces using the Netstat Command:
# netstat -i
Usage Example:
[root@TechArticles ~]# netstat -i Kernel Interface table Iface MTU RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg enp0s3 1500 52483 0 0 0 17343 0 0 0 BMRU enp0s8 1500 68 0 0 0 295 0 0 0 BMRU enp0s9 1500 245 0 0 0 64 0 0 0 BMRU lo 65536 71 0 0 0 71 0 0 0 LRU virbr0 1500 0 0 0 0 0 0 0 0 BMU
To view all Listing and active listening ports connections using the Netstat Command
# netstat -l
Usage Example:
[root@TechArticles ~]# netstat -l Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 TechArticles:domain 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:sunrpc 0.0.0.0:* LISTEN tcp6 0 0 [::]:ssh [::]:* LISTEN tcp6 0 0 localhost:ipp [::]:* LISTEN tcp6 0 0 [::]:sunrpc [::]:* LISTEN udp 0 0 0.0.0.0:47894 0.0.0.0:* udp 0 0 0.0.0.0:mdns 0.0.0.0:* Active UNIX domain sockets (only servers) Proto RefCnt Flags Type State I-Node Path unix 2 [ ACC ] STREAM LISTENING 83970 @/tmp/.ICE-unix/6855 unix 2 [ ACC ] STREAM LISTENING 81900 /tmp/.esd-1000/socket unix 2 [ ACC ] STREAM LISTENING 22919 @irqbalance803.sock unix 2 [ ACC ] STREAM LISTENING 83599 @/tmp/dbus-tmbDv8Vfuw unix 2 [ ACC ] STREAM LISTENING 82711 /run/user/42/systemd/private unix 2 [ ACC ] STREAM LISTENING 83484 /run/user/42/wayland-0 unix 2 [ ACC ] STREAM LISTENING 82719 /run/user/42/bus unix 2 [ ACC ] STREAM LISTENING 82333 @/tmp/dbus-yOwiMtyc unix 2 [ ACC ] STREAM LISTENING 82725 /run/user/42/pulse/native
To View all the listning TCP ports using the Netstat Command
# netstat -lt
Usage Example:
[root@TechArticles ~]# netstat -lt Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 TechArticles:domain 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:sunrpc 0.0.0.0:* LISTEN tcp6 0 0 [::]:ssh [::]:* LISTEN tcp6 0 0 localhost:ipp [::]:* LISTEN tcp6 0 0 [::]:sunrpc [::]:* LISTEN
To view all the Listning UDP ports using the Netstat Command
# netstat -lu
Usage Example:
[root@TechArticles ~]# netstat -lu Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State udp 0 0 0.0.0.0:47894 0.0.0.0:* udp 0 0 0.0.0.0:mdns 0.0.0.0:* udp 0 0 TechArticles:domain 0.0.0.0:* udp 0 0 0.0.0.0:bootps 0.0.0.0:* udp 0 0 0.0.0.0:sunrpc 0.0.0.0:* udp6 0 0 [::]:35947 [::]:* udp6 0 0 [::]:mdns [::]:* udp6 0 0 [::]:sunrpc [::]:* udp6 0 0 localhost:323 [::]:*
To view the all the UNIX listning ports using the Netstat Command
[root@TechArticles ~]# netstat -lx | less Active UNIX domain sockets (only servers) Proto RefCnt Flags Type State I-Node Path unix 2 [ ACC ] STREAM LISTENING 83970 @/tmp/.ICE-unix/6855 unix 2 [ ACC ] STREAM LISTENING 81900 /tmp/.esd-1000/socket unix 2 [ ACC ] STREAM LISTENING 22919 @irqbalance803.sock unix 2 [ ACC ] STREAM LISTENING 83599 @/tmp/dbus-tmbDv8Vfuw unix 2 [ ACC ] STREAM LISTENING 82711 /run/user/42/systemd/private unix 2 [ ACC ] STREAM LISTENING 83484 /run/user/42/wayland-0 unix 2 [ ACC ] STREAM LISTENING 82719 /run/user/42/bus
To Print Netstat Information Continuously using the Netstat Command
# netstat -c
Usage Example:
[root@TechArticles ~]# netstat -c Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 TechArticles:ssh 192.168.111.16:64056 ESTABLISHED tcp 0 36 TechArticles:ssh 192.168.111.16:63019 ESTABLISHED tcp 0 0 TechArticles:ssh 192.168.111.16:57586 ESTABLISHED Active UNIX domain sockets (w/o servers) Proto RefCnt Flags Type State I-Node Path unix 2 [ ] DGRAM 82707 /run/user/42/systemd/notify unix 3 [ ] DGRAM 1424 /run/systemd/notify unix 2 [ ] DGRAM 1426 /run/systemd/cgroups-agent unix 2 [ ] DGRAM 24506 /run/chrony/chronyd.sock
Top view Listening Programs using the Netstat Command
# netstat -ap | grep http
Usage Example:
[root@TechArticles ~]# netstat -ap | grep http
tcp 0 0 TechArticles:55530 192.168.111.16:https ESTABLISHED 6881/gnome-shell
To view the TCP active Listning port numbers and IP addresses in numerical format service and process name using the Netstat Command
# netstat -tnlp
Usage Example:
[root@TechArticles ~]# netstat -tnlp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 192.168.122.1:53 0.0.0.0:* LISTEN 1614/dnsmasq tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 937/sshd tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 939/cupsd tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1/systemd tcp6 0 0 :::22 :::* LISTEN 937/sshd tcp6 0 0 ::1:631 :::* LISTEN 939/cupsd tcp6 0 0 :::111 :::* LISTEN 1/systemd
-t: This switch displays information about all active TCP connections on the system.-n: This switch displays the port numbers and IP addresses in numerical format instead of resolving them to host names and services.-l: This switch displays all listening ports on the system.-p: This switch displays the process name and process ID (PID) associated with each connection or listening port.
To view the UDP active Listning port numbers and IP addresses in numerical format service and process name using the Netstat Command
# netstat -nulp
Usage Example:
[root@TechArticles ~]# netstat -nulp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name udp 0 0 0.0.0.0:47894 0.0.0.0:* 808/avahi-daemon: r udp 0 0 0.0.0.0:5353 0.0.0.0:* 808/avahi-daemon: r udp 0 0 192.168.122.1:53 0.0.0.0:* 1614/dnsmasq udp 0 0 0.0.0.0:67 0.0.0.0:* 1614/dnsmasq udp 0 0 0.0.0.0:111 0.0.0.0:* 1/systemd udp 0 0 127.0.0.1:323 0.0.0.0:* 815/chronyd udp6 0 0 :::35947 :::* 808/avahi-daemon: r udp6 0 0 :::5353 :::* 808/avahi-daemon: r udp6 0 0 :::111 :::* 1/systemd udp6 0 0 ::1:323 :::* 815/chronyd
To view the TCP and UDP both active Listning port numbers and IP addresses in numerical format service and process name using the netstat Command
# netstat -tnulp
Usage Example:
[root@TechArticles ~]# netstat -tnulp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 937/sshd tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1/systemd tcp6 0 0 :::22 :::* LISTEN 937/sshd tcp6 0 0 :::111 :::* LISTEN 1/systemd udp 0 0 0.0.0.0:47894 0.0.0.0:* 808/avahi-daemon: r udp 0 0 0.0.0.0:5353 0.0.0.0:* 808/avahi-daemon: r udp 0 0 0.0.0.0:111 0.0.0.0:* 1/systemd udp 0 0 127.0.0.1:323 0.0.0.0:* 815/chronyd udp6 0 0 :::35947 :::* 808/avahi-daemon: r udp6 0 0 :::5353 :::* 808/avahi-daemon: r udp6 0 0 :::111 :::* 1/systemd udp6 0 0 ::1:323 :::* 815/chronyd
Was this article of use to you? Post your insightful thoughts or recommendations in the comments section if you don’t find this article to be helpful or if you see any outdated information, a problem, or a typo to help this article better.
For a detailed explanation of the netstat command and its various options, you can refer to the official netstat man page.
