Netstat command displays various network related information such as network connections, routing tables, interface statistics, masquerade connections, multicast memberships etc.,
In this article, let us review 10 practical unix netstat command examples.
1. List All Ports (both listening and non listening ports)
List all ports using netstat -a
# netstat -a | more Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 localhost:30037 *:* LISTEN udp 0 0 *:bootpc *:* Active UNIX domain sockets (servers and established) Proto RefCnt Flags Type State I-Node Path unix 2 [ ACC ] STREAM LISTENING 6135 /tmp/.X11-unix/X0 unix 2 [ ACC ] STREAM LISTENING 5140 /var/run/acpid.socket
List all tcp ports using netstat -at
# netstat -at Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 localhost:30037 *:* LISTEN tcp 0 0 localhost:ipp *:* LISTEN tcp 0 0 *:smtp *:* LISTEN tcp6 0 0 localhost:ipp [::]:* LISTEN
List all udp ports using netstat -au
# netstat -au Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State udp 0 0 *:bootpc *:* udp 0 0 *:49119 *:* udp 0 0 *:mdns *:*
2. List Sockets which are in Listening State
List only listening ports using netstat -l
# netstat -l Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 localhost:ipp *:* LISTEN tcp6 0 0 localhost:ipp [::]:* LISTEN udp 0 0 *:49119 *:*
List only listening TCP Ports using netstat -lt
# netstat -lt Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 localhost:30037 *:* LISTEN tcp 0 0 *:smtp *:* LISTEN tcp6 0 0 localhost:ipp [::]:* LISTEN
List only listening UDP Ports using netstat -lu
# netstat -lu Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State udp 0 0 *:49119 *:* udp 0 0 *:mdns *:*
List only the listening UNIX Ports using netstat -lx
# netstat -lx Active UNIX domain sockets (only servers) Proto RefCnt Flags Type State I-Node Path unix 2 [ ACC ] STREAM LISTENING 6294 private/maildrop unix 2 [ ACC ] STREAM LISTENING 6203 public/cleanup unix 2 [ ACC ] STREAM LISTENING 6302 private/ifmail unix 2 [ ACC ] STREAM LISTENING 6306 private/bsmtp
3. Show the statistics for each protocol
Show statistics for all ports using netstat -s
# netstat -s
Ip:
11150 total packets received
1 with invalid addresses
0 forwarded
0 incoming packets discarded
11149 incoming packets delivered
11635 requests sent out
Icmp:
0 ICMP messages received
0 input ICMP message failed.
Tcp:
582 active connections openings
2 failed connection attempts
25 connection resets received
Udp:
1183 packets received
4 packets to unknown port received.
.....
Show statistics for TCP (or) UDP ports using netstat -st (or) -su
# netstat -st # netstat -su
4. Display PID and program names in netstat output using netstat -p
netstat -p option can be combined with any other netstat option. This will add the “PID/Program Name” to the netstat output. This is very useful while debugging to identify which program is running on a particular port.
# netstat -pt Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 1 0 ramesh-laptop.loc:47212 192.168.185.75:www CLOSE_WAIT 2109/firefox tcp 0 0 ramesh-laptop.loc:52750 lax:www ESTABLISHED 2109/firefox
5. Don’t resolve host, port and user name in netstat output
When you don’t want the name of the host, port or user to be displayed, use netstat -n option. This will display in numbers, instead of resolving the host name, port name, user name.
This also speeds up the output, as netstat is not performing any look-up.
# netstat -an
If you don’t want only any one of those three items ( ports, or hosts, or users ) to be resolved, use following commands.
# netsat -a --numeric-ports # netsat -a --numeric-hosts # netsat -a --numeric-users
6. Print netstat information continuously
netstat will print information continuously every few seconds.
# netstat -c Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 ramesh-laptop.loc:36130 101-101-181-225.ama:www ESTABLISHED tcp 1 1 ramesh-laptop.loc:52564 101.11.169.230:www CLOSING tcp 0 0 ramesh-laptop.loc:43758 server-101-101-43-2:www ESTABLISHED tcp 1 1 ramesh-laptop.loc:42367 101.101.34.101:www CLOSING ^C
7. Find the non supportive Address families in your system
netstat --verbose
At the end, you will have something like this.
netstat: no support for `AF IPX' on this system. netstat: no support for `AF AX25' on this system. netstat: no support for `AF X25' on this system. netstat: no support for `AF NETROM' on this system.
8. Display the kernel routing information using netstat -r
# netstat -r Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 192.168.1.0 * 255.255.255.0 U 0 0 0 eth2 link-local * 255.255.0.0 U 0 0 0 eth2 default 192.168.1.1 0.0.0.0 UG 0 0 0 eth2
Note: Use netstat -rn to display routes in numeric format without resolving for host-names.
9. Find out on which port a program is running
# netstat -ap | grep ssh (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 1 0 dev-db:ssh 101.174.100.22:39213 CLOSE_WAIT - tcp 1 0 dev-db:ssh 101.174.100.22:57643 CLOSE_WAIT -
Find out which process is using a particular port:
# netstat -an | grep ':80'
10. Show the list of network interfaces
# netstat -i Kernel Interface table Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg eth0 1500 0 0 0 0 0 0 0 0 0 BMU eth2 1500 0 26196 0 0 0 26883 6 0 0 BMRU lo 16436 0 4 0 0 0 4 0 0 0 LRU
Display extended information on the interfaces (similar to ifconfig) using netstat -ie:
# netstat -ie
Kernel Interface table
eth0 Link encap:Ethernet HWaddr 00:10:40:11:11:11
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
Memory:f6ae0000-f6b00000
My name is Ramesh Natarajan. I will be posting instruction guides, how-to, troubleshooting tips and tricks on Linux, database, hardware, security and web. My focus is to write articles that will either teach you or help you resolve a problem. Read more about
Comments on this entry are closed.
my favourite netstat combination is sudo netstat -pnutl
it needs sudo to see all the applications names, but it works without it, but shows less information
Ramesh ,
Good stuff . Thing I wanted to try out , but felt too lazy to read the man.
Great stuff, so many things can be achieved by using netstat i.e ‘netstat -ie’ can be used in the place of ‘ifconfig ethX’ and ‘netstat -r’ in the place of ‘route -n’.
Thanx Ramesh.
excellent article for network stuff specially the netsatat -pt and netstat -c..
But would like to also know (if possible) the meaning of timer in netstat and how to interpret the same..In man page its showing (this needs to be written)
Thanking you all again
netstat is pretty archaic. You should be using /sbin/ss on Linux.
what is the output of the following command:
netstat -anp
netstat -l and netstat -p are not working on AIX. not sure about other flavors
$ netstat -p
netstat: A flag requires a parameter: p
usage: netstat [-Aan] [-f address_family] [core unix netinet addr]
[-D]
[-cCgimnrsPv] [-f address_family] [-p proto] [core unix netinet addr]
[-n] [-I interface] [interval] [core unix netinet addr]
$ uname
AIX
$ netstat -l
netstat: Not a recognized flag: l
usage: netstat [-Aan] [-f address_family] [core unix netinet addr]
[-D]
[-cCgimnrsPv] [-f address_family] [-p proto] [core unix netinet addr]
[-n] [-I interface] [interval] [core unix netinet addr]
$
i sometimes use the following command to see all active connections
$netstat -atnp |grep ESTA
or in realtime
$watch -d -n0 “netstat -atnp |grep ESTA”
cheers
Nice explanation on netstat 🙂
How you can add system time in netstat ? like system time .. netstat output..
explain netstat -plten
Overall Good site to brush Skill !! Well Gatering of information!!!
Awesome stuff !! Keep writing more Ramesh..
For a basic usage this is much better than reading the man page. Thank u very much!
Dear Ramesh
I cannot express my thanks and regards to you, what a beautiful work you are doing my friend.
Don’t have any words to say
Thanks a ton for helping us
that was great.thank u
Nice clarification on Netstat.
Thanks
Great stuff, thanks for sharing
Thanks a lot
Thankx for perfect explanation
Great stuff, pretty useful.
I have one question, can someone please help?
How do we find out the historic usage of a port.
For example I want to know what all processes/pids connected to particular port in last 24 hours?
Pentastic , very much useful
Below is the output of the netstat command with -n & -r options in which the destination field shows compacted address (127.1/16). I wanted to know that is there any way or options available to netstat command to display entire Destination IP (127.1.0.0/16) rather than (127.1/16) ?
#netstat -r -n
Destination Gateway Flags Refs Use Mtu Interface
127.0.0.1 127.0.0.1 UH 110 296172 33212 lo0
127.1/16 link#7 UC 2 0 – vlan10
Plz Suggest….
Very informative article. Thanks.
I have output of netstat -nr as below
161.129/28 161.131.208.1 UG 0 534925 en1 – –
what does 161.129/28 mean ? Please clarify
hi，guys，very good article,but could you plz explain the output of netstat
for exapmle,the netstat -tunlp
there have some port dont have pid and program name,so ,tell me why
thanks~
Awesome Unix stuff……Superb……
What is the TIME_WAIT in netstat output ?
Great article ty for your efforts in making such an understandable article..
this is great but misses a critical point… it is not enough to know the commands or visualize the output from those commands. Critical is to be able to interpret the meaning & impact of the intelligence
Q: is there a tutorial on this?
Hi,
Wonderful and awesome Linux-Unix examples.
Vasu Rao
i have thousands of zipped tarfiles( ab.tar.gz, km.tar.gz,.. etc) in a directory named say dir1 .now i want to find all files (along with path) in zipped tar files in which a particular word say ‘mayur’ is existing.
Which command we should use!!!
@Mayur
You can just zgrep mayur /path
Very good stuff…….Thank u..
Interesting story, but in Windows some things could be hidden beyond the reach of this netstat thing.
How is it with Linux things.
I use netstat to check if the pythonscript is completely stoped check the port is listening and getting traffic, i need to make sure traffic is zero before starting the script. if not it iwll not start properly.
netatat -l | grep 1000 | wc -l
1000 is port and wc -l counts the traffic.
God Bless you Ramesh
netstat -tunap|grep vsftpd
or
netstat -tunap|grep Port
Awesome Article about netstat.Thank you so much
Great and helpful hints
Hi all,
How to check packet loss with in Linux box?
have a question here !!
how to check the process id with the port number in linux and AIX?
cat /proc/sys/kernel/threads-max what is the need of this file and if i change the value ,will it require reboot to reflect to process the jobs?
Excellent tutorial for Netstat commands