netstat

  • Post author:
  • Post last modified:August 24, 2023
  • Reading time:11 mins read

1. netstat command

The netstat command in Linux provides network statistics and information about the networking subsystem. It gives information about network connections, routing tables and network interface statistics. For example,

$ netstat
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 myhost.local:53744      mail.example.i:imaps    ESTABLISHED
tcp        0      0 myhost.local:36149      example.com:http        ESTABLISHED
tcp        0      0 myhost.local:57051      imap.example.n:imap2    ESTABLISHED
tcp        0      0 myhost.local:51209      mail.example.i:imaps    ESTABLISHED
tcp        0      0 myhost.local:35617      example.com:http        ESTABLISHED
tcp        0      0 myhost.local:51207      mail.example.i:imaps    ESTABLISHED
tcp        0      0 myhost.local:52281      r-198-51-100-12.tw:http ESTABLISHED
tcp        0      0 myhost.local:51208      mail.example.i:imaps    ESTABLISHED
tcp        0      0 myhost.local:52282      r-198-51-100-12.tw:http TIME_WAIT
...
tcp        0      0 myhost.local:51193      mail.example.i:imaps    ESTABLISHED
tcp        0      0 myhost.local:59586      imap.example.n:imap2    ESTABLISHED
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags   Type       State         I-Node   Path
unix  11     [ ]     DGRAM                    9660     /dev/log
unix  3      [ ]     STREAM     CONNECTED     137371   
unix  2      [ ]     STREAM     CONNECTED     130029   
...
unix  3      [ ]     STREAM     CONNECTED     104545   /var/run/dbus/system_bus_socket
unix  3      [ ]     STREAM     CONNECTED     75140    @/tmp/dbus-GT5WnOFBJm
unix  3      [ ]     STREAM     CONNECTED     73585    
unix  3      [ ]     STREAM     CONNECTED     74032    @/tmp/.ICE-unix/1888
unix  3      [ ]     STREAM     CONNECTED     73584    
unix  3      [ ]     STREAM     CONNECTED     72096    @/tmp/dbus-GT5WnOFBJm
....

The Proto column gives the protocol for the socket. The common values are tcp, tcp6, udp, udp6 for Internet connections and unix for Unix domain sockets. Recv-Q and Send-Q give the bytes in transit, Recv-Q, being the bytes not taken by the user process and Send-Q being the bytes not acknowledged by the remote host. The State is the state of the socket, possible values being ESTABLISHED, SYN_SENT, SYN_RECV, FIN_WAIT1, FIN_WAIT2, TIME_WAIT, CLOSE, CLOSE_WAIT, LAST_ACK, LISTEN, CLOSING and UNKNOWN.

2. netstat -n

netstat -n command prints numeric IP addresses, port and user ids. User id is printed with the -e option.

$ netstat -n
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 192.168.1.103:53744     198.51.100.12:993       ESTABLISHED
tcp        0      0 192.168.1.103:36149     203.0.113.1:80          ESTABLISHED
tcp        0      0 192.168.1.103:57051     198.51.100.10:143       ESTABLISHED
...        
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags       Type       State         I-Node   Path
unix  11     [ ]         DGRAM                    9660     /dev/log
unix  3      [ ]         STREAM     CONNECTED     170916   /var/run/cups/cups.sock
unix  3      [ ]         STREAM     CONNECTED     171998
...

–numeric-hosts gives numeric host IP addresses but displays symbolic names for the ports and user id. Similarly –numeric-ports shows numeric port numbers but resolves the host name to its symbolic value and prints the user id as a string. –numeric-users prints user id as a number but resolves host name and port id to symbolic names.

3. netstat -a

The above netstat examples report the non-listening sockets only. netstat -a gives all, listening and non-listening, sockets.

$ netstat -a
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 *:domain                *:*                     LISTEN
tcp        0      0 *:ssh                   *:*                     LISTEN
tcp        0      0 localhost:ipp           *:*                     LISTEN
tcp        1      0 myhost.local:35035      example.canonical:http  CLOSE_WAIT
tcp        0      0 myhost.local:53744      mail.example.i:imaps    ESTABLISHED
...
tcp6       0      0 [::]:domain             [::]:*                  LISTEN
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN
tcp6       0      0 ip6-localhost:ipp       [::]:*                  LISTEN
udp        0      0 *:60886                 *:*
...
udp6       0      0 [::]:37633              [::]:*
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags       Type       State         I-Node   Path
unix  2      [ ACC ]     STREAM     LISTENING     10907    @/tmp/.ICE-unix/1888
unix  2      [ ACC ]     STREAM     LISTENING     7987     /tmp/.X11-unix/X0
unix  2      [ ACC ]     STREAM     LISTENING     11967    /tmp/keyring-2SQcW8/control
unix  2      [ ACC ]     STREAM     LISTENING     10903    @/tmp/dbus-GT5WnOFBJm
unix  2      [ ACC ]     STREAM     LISTENING     10460    /var/run/acpid.socket
...
unix  2      [ ACC ]     STREAM     LISTENING     10460    /var/run/acpid.socket
unix  2      [ ]         STREAM     CONNECTED     216491   
unix  3      [ ]         STREAM     CONNECTED     214403   
...

netstat -l (minus ell) gives only the listening sockets.

$ netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 localhost.localdo:mysql *:*                     LISTEN     
tcp        0      0 *:pop3                  *:*                     LISTEN     
tcp        0      0 *:imap2                 *:*                     LISTEN     
tcp        0      0 *:http                  *:*                     LISTEN     
tcp        0      0 localhost.loca:http-alt *:*                     LISTEN     
tcp        0      0 *:ssh                   *:*                     LISTEN     
tcp        0      0 *:smtp                  *:*                     LISTEN     
tcp        0      0 *:sieve                 *:*                     LISTEN   
...

4. netstat -p

The -p option displays the program name and the process id associated with the socket. The -p option is useful because, more often than not, we wish to know about connection (socket) along with the associated process and the program that is being run by that process. For printing information about sockets owned by other users, the -p option needs to be run with root privileges.

$ sudo netstat -pn 
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name  
tcp        0      0 192.168.1.103:54626     198.51.100.14:993      ESTABLISHED 2507/thunderbird  
tcp        0      0 192.168.1.103:45852     198.51.100.14:22       ESTABLISHED 4279/ssh        
tcp        0      0 192.168.1.103:55362     198.51.100.14:993      ESTABLISHED 2507/thunderbird
tcp        0      0 192.168.1.103:45031     198.51.100.14:443     ESTABLISHED 2719/chrome     
tcp        0      0 192.168.1.103:54625     198.51.100.14:993      ESTABLISHED 2507/thunderbird
tcp        0      0 192.168.1.103:55963     198.51.100.14:993      ESTABLISHED 2507/thunderbird  
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags       Type       State         I-Node   PID/Program name    Path
unix  13     [ ]         DGRAM                    1786     1164/rsyslogd       /dev/log
unix  2      [ ]         DGRAM                    81283    4637/sudo           
...

5. netstat –protocol= family, -A

With the –protocol, or the -A option, the network address family can be specified. Some important family values are inet and inet6 for external communication using IPv4 and IPv6 respectively and unix for communication among local processes using unix domain sockets. The inet family includes the raw, TCP and UDP sockets.

$ sudo netstat --protocol=inet -p -n
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address         Foreign Address      State        PID/Program name
tcp        0      0 192.168.1.103:51496   203.0.113.1:80       TIME_WAIT    -               
tcp        0      0 192.168.1.103:40091   198.51.100.14:80     ESTABLISHED  2346/chrome     
tcp        0      0 192.168.1.103:53744   198.51.100.12:993    ESTABLISHED  2129/thunderbird
tcp        0      0 192.168.1.103:40090   198.51.100.20:80     ESTABLISHED  2346/chrome     
tcp        1      0 192.168.1.103:36131   203.0.113.2:80       CLOSE_WAIT   2235/python     
tcp        0      0 192.168.1.103:54090   198.51.100.12:993    ESTABLISHED  2129/thunderbird
tcp        0      0 192.168.1.103:51207   198.51.100.12:993    ESTABLISHED  2129/thunderbird
tcp        0      0 192.168.1.103:42313   203.0.113.5:80       TIME_WAIT    -               
tcp        0      0 192.168.1.103:51193   198.51.100.12:993    ESTABLISHED  2129/thunderbird

The above command could have been also given as sudo netstat –inet -p -n. Also,

  • netstat -t, prints TCP connections, and
  • netstat -u, prints UDP connections.

The last example gives the non-listening sockets. If we add the -a option to it and add inet6 protocol family, we get a list of the system's all internet connections.

$ sudo netstat --protocol=inet,inet6 -npa
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1461/nginx.conf 
tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN      1297/dnsmasq    
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1139/sshd       
...
tcp        0      0 192.168.1.103:54626     198.51.100.12:993      ESTABLISHED 2507/thunderbird
tcp        0      0 192.168.1.103:45852     198.51.100.12:22       ESTABLISHED 4279/ssh        
tcp        0      0 192.168.1.103:41975     203.0.113.1:443      ESTABLISHED 2719/chrome     
tcp        0      0 192.168.1.103:35753     203.0.113.1:443      ESTABLISHED 2719/chrome     
tcp        0      0 192.168.1.103:55362     198.51.100.12:993      ESTABLISHED 2507/thunderbird
...
tcp6       0      0 :::53                   :::*                    LISTEN      1297/dnsmasq    
tcp6       0      0 :::22                   :::*                    LISTEN      1139/sshd       
tcp6       0      0 ::1:631                 :::*                    LISTEN      1188/cupsd      
udp        0      0 0.0.0.0:53              0.0.0.0:*                           1297/dnsmasq    
udp        0      0 0.0.0.0:67              0.0.0.0:*                           1297/dnsmasq    
udp        0      0 0.0.0.0:68              0.0.0.0:*                           1088/dhclient3  
udp        0      0 192.168.1.103:123       0.0.0.0:*                           863/ntpd        
udp6       0      0 :::53661                :::*                                1163/avahi-daemon: 
udp6       0      0 :::53                   :::*                                1297/dnsmasq    
udp6       0      0 fe80::7add:8ff:fef1:123 :::*                                863/ntpd        
udp6       0      0 ::1:123                 :::*                                863/ntpd        
udp6       0      0 :::123                  :::*                                863/ntpd        
udp6       0      0 :::5353                 :::*                                1163/avahi-daemon:

And, if we are interested in knowing about all services using TCP ports, the command would be,

$ sudo netstat -t -npl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1461/nginx.conf 
tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN      1297/dnsmasq    
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1139/sshd       
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      1188/cupsd      
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      1461/nginx.conf 
tcp        0      0 0.0.0.0:6080            0.0.0.0:*               LISTEN      1476/python     
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      1375/mysqld     
tcp6       0      0 :::53                   :::*                    LISTEN      1297/dnsmasq    
tcp6       0      0 :::22                   :::*                    LISTEN      1139/sshd       
tcp6       0      0 ::1:631                 :::*                    LISTEN      1188/cupsd

6. netstat -r

netstat -r prints the kernel's routing table. For example,

$ netstat -r
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
default         192.168.1.1     0.0.0.0         UG        0 0          0 wlan0
link-local      *               255.255.0.0     U         0 0          0 eth0
192.168.1.0     *               255.255.255.0   U         0 0          0 wlan0
192.168.2.0     *               255.255.255.0   U         0 0          0 eth0

The output is the same as that produced by the command, route -e.

7. netstat -i

The netstat -i command prints data about the network interfaces.

$ netstat -i 
Kernel Interface table
Iface   MTU Met  RX-OK RX-ERR RX-DRP RX-OVR  TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0    1500 0       0      0      0 0           0      0      0      0 BMU
lo     16436 0      44      0      0 0          44      0      0      0 LRU
wlan0   1500 0  112946      0      0 0      112326      0      0      0 BMRU

The MTU is the maximum transfer unit for the interface. Met is the interface metric. TX and RX are the receive and transmit statistics for an interface. RX-OK and TX-OK are the packets received and transmitted error-free respectively. RX-ERR and TX-ERR and the packets received or transmitted with errors, RX-DRP and TX-DRP are the packets that got dropped and RX-OVR and TX-OVR are the packets lost due to overrun. The flags are as follows:

  • B – broadcast address set
  • L – loopback device
  • M – all packets received (promiscous mode)
  • R – Interface is running
  • U – Interface is up

8. netstat -e

The -e option prints the extended output. With the -e option, one can get the user id and inode associated with each socket. For example,

$ sudo netstat --protocol=inet,inet6 -pae | more
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode       PID/Program name
tcp        0      0 *:http                  *:*                     LISTEN      root       9819        1461/nginx.conf 
tcp        0      0 *:domain                *:*                     LISTEN      root       10486       1297/dnsmasq    
tcp        0      0 *:ssh                   *:*                     LISTEN      root       1754        1139/sshd       
tcp        0      0 localhost:ipp           *:*                     LISTEN      root       45754       1188/cupsd      
tcp        0      0 *:https                 *:*                     LISTEN      root       9820        1461/nginx.conf 
tcp        0      0 *:6080                  *:*                     LISTEN      nova       9868        1476/python     
tcp        0      0 localhost:mysql         *:*                     LISTEN      mysql      10170       1375/mysqld     
tcp        0      0 bagpipe.local:54626     mail.mydomain.i:imaps ESTABLISHED user1      17487       2507/thunderbird
tcp        0      0 bagpipe.local:45852     mail.mydomain.in:ssh  ESTABLISHED user1      56802       4279/ssh        
tcp        0      0 bagpipe.local:48008     maa03s16-in-f13.1e:http ESTABLISHED user1      113555      2719/chrome     
tcp        0      0 bagpipe.local:51192     maa03s04-in-f9.1e:https ESTABLISHED user1     113558      2719/chrome     
...
tcp6       0      0 [::]:domain             [::]:*                  LISTEN      root       10488       1297/dnsmasq    
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN      root       1756        1139/sshd       
tcp6       0      0 ip6-localhost:ipp       [::]:*                  LISTEN      root       45753       1188/cupsd      
udp        0      0 *:domain                *:*                                 root       10485       1297/dnsmasq    
udp        0      0 *:bootps                *:*                                 root       10479       1297/dnsmasq    
udp6       0      0 [::]:53661              [::]:*                              avahi      918         1163/avahi-daemon: 
udp6       0      0 [::]:domain             [::]:*                              root       10487       1297/dnsmasq    
...

9. netstat -o

netstat -o prints information regarding networking timers. For example,

$ netstat -o -n --tcp
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address       State       Timer
tcp        0      0 192.168.1.103:53744     198.51.100.12:993     ESTABLISHED off (0.00/0/0)
tcp        0      0 192.168.1.103:45935     203.0.113.2:143       ESTABLISHED keepalive (19.36/0/0)  
tcp        0      0 192.168.1.103:57051     203.0.113.1:143       ESTABLISHED off (0.00/0/0)
tcp        0      0 192.168.1.103:37010     203.0.113.1:143       ESTABLISHED off (0.00/0/0)
tcp        1      0 192.168.1.103:39539     203.0.113.4:80        CLOSE_WAIT  off (0.00/0/0)
tcp        0      0 192.168.1.103:54090     198.51.100.12:993     ESTABLISHED off (0.00/0/0)
tcp        0      0 192.168.1.103:51207     198.51.100.12:993     ESTABLISHED off (0.00/0/0)
tcp        0      0 192.168.1.103:51208     198.51.100.12:993     ESTABLISHED off (0.00/0/0)
tcp        1      0 192.168.1.103:33100     203.0.113.6:80        CLOSE_WAIT  off (0.00/0/0)
tcp        0      0 192.168.1.103:45948     203.0.113.8:80        ESTABLISHED keepalive (21.16/0/0)  
tcp        0      0 192.168.1.103:51193     198.51.100.12:993     ESTABLISHED off (0.00/0/0)
tcp        1      0 192.168.1.103:39538     203.0.113.9:80        CLOSE_WAIT  off (0.00/0/0)

The last column gives data about the timers. If off is displayed, the connection is getting closed. If keepalive is displayed, the connection is using TCP keepalives. The first figure in parenthesis indicates in seconds when the keepalive timer will expire. The second figure indicates the number of keepalive packets already sent.

10. netstat -c

With the -c option, netstat prints the selected output continuously. It prints the output every second. For example,

netstat -ntc

prints information about TCP sockets every second, printing the host IP addresses, ports and user-ids in the numeric form.

11. netstat -s

The -s option prints the summary statistics for each protocol.

Related Posts
ip command in Linux with examples
Routing in Linux
Synchronize your computer's clock using the NTP
sar command in Linux
ss command in Linux
Share
Tags: , , , , , , , ,

Karunesh Johri

Software developer, working with C and Linux.
0 0 votes
Article Rating
Subscribe
Notify of
guest
0 Comments
Inline Feedbacks
View all comments