Linux provides a lot of tools for network management and visibility. netstat is another popular and useful tool used by a lot of systems and network administrators. In this tutorial, we will look at usage examples of netstat.

Syntax

We will use the following syntax for the netstat command.

netstat [address_family_options] [options]

List All Connections

A typical Linux system will have a lot of different connections. These connection types can be Unix Sockets, IPX Sockets, IPv4, IPv6, etc. All connections about these can be listed with -a parameter.

$ netstat -a

List Only TCP Connections

While listing connection only TCP connections may be needed. Only TCP connections can be listed with -t parameter. All listening and established TCP connections will be listed here. Keep in mind this will list IPv6 too.

$ netstat -at

List Only UDP Connections

Another useful feature is listing only UDP connections. Keep in mind this will list IPv6 too.

$ netstat -au

List Both TCP and UDP Connections

TCP and UDP connections and ports can be listed in a single shot. Just provide both UDP and TCP parameters previously examined like below.

$ netstat -a -t -u

List Only Listening Ports

While listing all connections and ports will be listed by default. There is -l option which will list all LISTEN interfaces which means the port is listening for new connections.

$ netstat  -l

You may notice that TCP protocol ports provide state as LISTEN but UDP ports do not have any state information. Because UDP is a connectionless protocol.

List Only Unix Sockets/Ports

Netstat has the ability to list operating system level Unix or Linux sockets those used locally by applications. While listing Unix sockets information like Reference count, flags, type, state, i-node provided.

$ netstat -x

Print Ports Numerically

While printing information about the ports and protocols by default text presentation is printed. For example to list an ssh protocol ssh is used not 22 . This can be changed with --numeric-ports option.

$ netstat -l --numeric-ports

Disable DNS Lookup

While listing existing connections the DNS names will be printed to screen. To get DNS information about IP addresses the DNS resolution must be made. This can be a time-wasting operation if we do not need them. Or we need only the IP address.

$ netstat -n -a

Get Listening Process Owner User Id

All listening ports have some process-related. These processes will open the port for listening or connecting. These processes have associated users. This user information can get with -e . This feature requires root privileges. So we will provide sudo or run this command as directly root user. There is also inode information available.

$ sudo netstat -l -e

Get Listening Process Id

As we have listed in the previous example the user-id also process id can be listed. The parameter used for this operation is -p and this feature needs root privileges too.

$ sudo netstat -l -p

Print Network Statistics

Linux network stack has support for different types of protocols. While using these protocols a lot of traffic is generated. This traffic information and statistics can be listed with -s parameter. This will print all statistics like TCP, UDP, ICMP

$ netstat -s

Print Statistics of TCP

Only statistics about TCP protocol stack can be listed by providing the TCP filter parameter.

$ netstat -s -t

Print Statistics of UDP

Only statistics about TCP protocol stack can be listed by providing the TCP filter parameter.

$ netstat -s -u

Print Route Table

The routing table can be printing different tools. Netstat also provides routing table information too.

$ netstat -r

Print Network Interfaces

For information purposes, network interfaces can be printed like below. There will be information about MTU, RX, TX Errors

$ netstat -i

Print Stats Continuously

Normally running command will generate output and send it to the terminal only once. If we need to send output of the same command continuously we should provide -c parameter.

$ netstat -t -c

Print Active TCP Connections

There is a lot of information while printing. This information can overwhelm us when we need only active connections which is already established. This can be done with the help of grep command.

$ netstat -a | grep 'EST\|TIM'