netstat command in Linux with examples

by Jay

Netstat is a command-line tool used to view and analyze network connections and statistics. The tool provides detailed information about various network parameters such as network interfaces, routing tables, open ports, and active network connections.

The netstat utility is essential for Linux network administrators and system administrators to monitor and solve network-related issues and determine network traffic performance.

netstat command

In this tutorial, I’m going to show an example of how we can use netstat in our daily operations to troubleshoot network-reported issues.

To view all active connections and listening ports, run the following command:

[root@TechArticles ~]# netstat -a |less

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 TechArticles:domain     0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:sunrpc          0.0.0.0:*               LISTEN
tcp        0      0 TechArticles:ssh        192.168.111.16:64056    ESTABLISHED
tcp        0     36 TechArticles:ssh        192.168.111.16:63019    ESTABLISHED
tcp        0      0 TechArticles:ssh        192.168.111.16:57586    ESTABLISHED
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN
tcp6       0      0 localhost:ipp           [::]:*                  LISTEN
tcp6       0      0 [::]:sunrpc             [::]:*                  LISTEN
udp        0      0 0.0.0.0:47894           0.0.0.0:*
udp        0      0 0.0.0.0:mdns            0.0.0.0:*
udp        0      0 TechArticles:domain     0.0.0.0:*
udp        0      0 0.0.0.0:bootps          0.0.0.0:*

To view all TCP connections, run the following command:

[root@TechArticles ~]# netstat -at

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 TechArticles:domain     0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:sunrpc          0.0.0.0:*               LISTEN
tcp        0      0 TechArticles:ssh        192.168.111.16:64056    ESTABLISHED
tcp        0     52 TechArticles:ssh        192.168.111.16:63019    ESTABLISHED
tcp        0      0 TechArticles:ssh        192.168.111.16:57586    ESTABLISHED
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN
tcp6       0      0 localhost:ipp           [::]:*                  LISTEN
tcp6       0      0 [::]:sunrpc             [::]:*                  LISTEN
[root@TechArticles ~]#

To view all UDP connections, run the following command:

[root@TechArticles ~]# netstat -au

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
udp        0      0 0.0.0.0:47894           0.0.0.0:*
udp        0      0 0.0.0.0:mdns            0.0.0.0:*
udp        0      0 TechArticles:domain     0.0.0.0:*
udp        0      0 0.0.0.0:bootps          0.0.0.0:*
udp        0      0 TechArticles:bootpc     _gateway:bootps         ESTABLISHED
udp        0      0 0.0.0.0:sunrpc          0.0.0.0:*
udp6       0      0 [::]:35947              [::]:*
udp6       0      0 [::]:mdns               [::]:*
udp6       0      0 [::]:sunrpc             [::]:*
udp6       0      0 localhost:323           [::]:*
[root@TechArticles ~]#

To view all listening ports and their associated processes, run the following command:

[root@TechArticles ~]# netstat -tulpn

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 192.168.122.1:53        0.0.0.0:*               LISTEN      1614/dnsmasq
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      937/sshd
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      939/cupsd
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      1/systemd
tcp6       0      0 :::22                   :::*                    LISTEN      937/sshd
tcp6       0      0 ::1:631                 :::*                    LISTEN      939/cupsd
tcp6       0      0 :::111                  :::*                    LISTEN      1/systemd
udp        0      0 0.0.0.0:47894           0.0.0.0:*                           808/avahi-daemon: r
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           808/avahi-daemon: r
udp        0      0 192.168.122.1:53        0.0.0.0:*                           1614/dnsmasq
udp        0      0 0.0.0.0:67              0.0.0.0:*                           1614/dnsmasq
udp        0      0 0.0.0.0:111             0.0.0.0:*                           1/systemd
udp        0      0 127.0.0.1:323           0.0.0.0:*                           815/chronyd
udp6       0      0 :::35947                :::*                                808/avahi-daemon: r
udp6       0      0 :::5353                 :::*                                808/avahi-daemon: r
udp6       0      0 :::111                  :::*                                1/systemd
udp6       0      0 ::1:323                 :::*                                815/chronyd

To view the routing table, run the following command:

[root@TechArticles ~]# netstat -r

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
default         _gateway        0.0.0.0         UG        0 0          0 enp0s3
192.168.111.0   0.0.0.0         255.255.255.0   U         0 0          0 enp0s3
192.168.122.0   0.0.0.0         255.255.255.0   U         0 0          0 virbr0
[root@TechArticles ~]#

To view statistics for network interfaces, run the following command:

[root@TechArticles ~]# netstat -i
Kernel Interface table
Iface             MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
enp0s3           1500    52483      0      0 0         17343      0      0      0 BMRU
enp0s8           1500       68      0      0 0           295      0      0      0 BMRU
enp0s9           1500      245      0      0 0            64      0      0      0 BMRU
lo              65536       71      0      0 0            71      0      0      0 LRU
virbr0           1500        0      0      0 0             0      0      0      0 BMU

To view allListing and active listening ports connections

[root@TechArticles ~]# netstat -l

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 TechArticles:domain     0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:sunrpc          0.0.0.0:*               LISTEN
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN
tcp6       0      0 localhost:ipp           [::]:*                  LISTEN
tcp6       0      0 [::]:sunrpc             [::]:*                  LISTEN
udp        0      0 0.0.0.0:47894           0.0.0.0:*
udp        0      0 0.0.0.0:mdns            0.0.0.0:*
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node   Path
unix  2      [ ACC ]     STREAM     LISTENING     83970    @/tmp/.ICE-unix/6855
unix  2      [ ACC ]     STREAM     LISTENING     81900    /tmp/.esd-1000/socket
unix  2      [ ACC ]     STREAM     LISTENING     22919    @irqbalance803.sock
unix  2      [ ACC ]     STREAM     LISTENING     83599    @/tmp/dbus-tmbDv8Vfuw
unix  2      [ ACC ]     STREAM     LISTENING     82711    /run/user/42/systemd/private
unix  2      [ ACC ]     STREAM     LISTENING     83484    /run/user/42/wayland-0
unix  2      [ ACC ]     STREAM     LISTENING     82719    /run/user/42/bus
unix  2      [ ACC ]     STREAM     LISTENING     82333    @/tmp/dbus-yOwiMtyc
unix  2      [ ACC ]     STREAM     LISTENING     82725    /run/user/42/pulse/native

To View all the listning TCP ports

[root@TechArticles ~]# netstat -lt

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 TechArticles:domain     0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:sunrpc          0.0.0.0:*               LISTEN
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN
tcp6       0      0 localhost:ipp           [::]:*                  LISTEN
tcp6       0      0 [::]:sunrpc             [::]:*                  LISTEN

To view all the Listning UDP ports

[root@TechArticles ~]# netstat -lu

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
udp        0      0 0.0.0.0:47894           0.0.0.0:*
udp        0      0 0.0.0.0:mdns            0.0.0.0:*
udp        0      0 TechArticles:domain     0.0.0.0:*
udp        0      0 0.0.0.0:bootps          0.0.0.0:*
udp        0      0 0.0.0.0:sunrpc          0.0.0.0:*
udp6       0      0 [::]:35947              [::]:*
udp6       0      0 [::]:mdns               [::]:*
udp6       0      0 [::]:sunrpc             [::]:*
udp6       0      0 localhost:323           [::]:*

To view the all the UNIX listning ports

[root@TechArticles ~]# netstat -lx | less

Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node   Path
unix  2      [ ACC ]     STREAM     LISTENING     83970    @/tmp/.ICE-unix/6855
unix  2      [ ACC ]     STREAM     LISTENING     81900    /tmp/.esd-1000/socket
unix  2      [ ACC ]     STREAM     LISTENING     22919    @irqbalance803.sock
unix  2      [ ACC ]     STREAM     LISTENING     83599    @/tmp/dbus-tmbDv8Vfuw
unix  2      [ ACC ]     STREAM     LISTENING     82711    /run/user/42/systemd/private
unix  2      [ ACC ]     STREAM     LISTENING     83484    /run/user/42/wayland-0
unix  2      [ ACC ]     STREAM     LISTENING     82719    /run/user/42/bus

To Print Netstat Information Continuously

[root@TechArticles ~]# netstat -c

Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 TechArticles:ssh        192.168.111.16:64056    ESTABLISHED
tcp        0     36 TechArticles:ssh        192.168.111.16:63019    ESTABLISHED
tcp        0      0 TechArticles:ssh        192.168.111.16:57586    ESTABLISHED
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags       Type       State         I-Node   Path
unix  2      [ ]         DGRAM                    82707    /run/user/42/systemd/notify
unix  3      [ ]         DGRAM                    1424     /run/systemd/notify
unix  2      [ ]         DGRAM                    1426     /run/systemd/cgroups-agent
unix  2      [ ]         DGRAM                    24506    /run/chrony/chronyd.sock

Top view Listening Programs

[root@TechArticles ~]# netstat -ap | grep http
    tcp        0      0 TechArticles:55530      192.168.111.16:https    ESTABLISHED 6881/gnome-shell 

To view the TCP active Listning port numbers and IP addresses in numerical format service and process name

[root@TechArticles ~]# netstat -tnlp

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 192.168.122.1:53        0.0.0.0:*               LISTEN      1614/dnsmasq
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      937/sshd
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      939/cupsd
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      1/systemd
tcp6       0      0 :::22                   :::*                    LISTEN      937/sshd
tcp6       0      0 ::1:631                 :::*                    LISTEN      939/cupsd
tcp6       0      0 :::111                  :::*                    LISTEN      1/systemd
  • -t: This switch displays information about all active TCP connections on the system.
  • -n: This switch displays the port numbers and IP addresses in numerical format instead of resolving them to host names and services.
  • -l: This switch displays all listening ports on the system.
  • -p: This switch displays the process name and process ID (PID) associated with each connection or listening port.

To view the UDP active Listning port numbers and IP addresses in numerical format service and process name

[root@TechArticles ~]# netstat -nulp

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
udp        0      0 0.0.0.0:47894           0.0.0.0:*                           808/avahi-daemon: r
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           808/avahi-daemon: r
udp        0      0 192.168.122.1:53        0.0.0.0:*                           1614/dnsmasq
udp        0      0 0.0.0.0:67              0.0.0.0:*                           1614/dnsmasq
udp        0      0 0.0.0.0:111             0.0.0.0:*                           1/systemd
udp        0      0 127.0.0.1:323           0.0.0.0:*                           815/chronyd
udp6       0      0 :::35947                :::*                                808/avahi-daemon: r
udp6       0      0 :::5353                 :::*                                808/avahi-daemon: r
udp6       0      0 :::111                  :::*                                1/systemd
udp6       0      0 ::1:323                 :::*                                815/chronyd

To view the TCP and UDP both active Listning port numbers and IP addresses in numerical format service and process name

[root@TechArticles ~]# netstat -tnulp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      937/sshd
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      1/systemd
tcp6       0      0 :::22                   :::*                    LISTEN      937/sshd
tcp6       0      0 :::111                  :::*                    LISTEN      1/systemd
udp        0      0 0.0.0.0:47894           0.0.0.0:*                           808/avahi-daemon: r
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           808/avahi-daemon: r
udp        0      0 0.0.0.0:111             0.0.0.0:*                           1/systemd
udp        0      0 127.0.0.1:323           0.0.0.0:*                           815/chronyd
udp6       0      0 :::35947                :::*                                808/avahi-daemon: r
udp6       0      0 :::5353                 :::*                                808/avahi-daemon: r
udp6       0      0 :::111                  :::*                                1/systemd
udp6       0      0 ::1:323                 :::*                                815/chronyd

Was this article of use to you? Post your insightful thoughts or recommendations in the comments section if you don’t find this article to be helpful or if you see any outdated information, a problem, or a typo to help this article better.

Related Posts

Leave a Comment

* By using this form you agree with the storage and handling of your data by this website.