Netstat : 14 useful commands on Linux

Netstat is a command line that allows you to view the active TCP connections on a machine and list all the open TCP and UDP ports.

In this article shows 14 useful commands of Netstat with different options which may be useful in daily operation.

1- Listing all the LISTENING Ports (TCP or UDP) :

[root@server ~]# netstat -a 
[root@mail ~]# netstat -a
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN
tcp 0 0 localhost:smtp 0.0.0.0:* LISTEN
tcp 0 0 mail:ssh 192.168.139.1:54347 ESTABLISHED
tcp 0 0 mail:49684 mirror.marwan.ma:http TIME_WAIT
tcp 0 0 mail:46128 packet04.centos.or:http TIME_WAIT
tcp 0 0 mail:49682 mirror.wan.ma:http TIME_WAIT
tcp 0 0 mail:46138 packet04.centos.or:http TIME_WAIT
tcp 0 0 mail:49692 mirror.wan.ma:http TIME_WAIT
tcp 0 0 mail:49688 mirror.wan.ma:http TIME_WAIT
tcp 0 0 mail:49678 mirror.wan.ma:http TIME_WAIT
tcp 0 0 mail:49680 mirror.wan.ma:http TIME_WAIT
tcp 0 0 mail:49690 mirror.wan.ma:http TIME_WAIT
tcp 0 48 mail:ssh 192.168.139.1:60220 ESTABLISHED
tcp 0 48 mail:ssh 192.168.139.1:60220 ESTABLISHED
tcp6 0 0 [::]:ssh [::]:* LISTEN
tcp6 0 0 localhost:smtp [::]:* LISTEN
unix 3 [ ] STREAM CONNECTED 18397 /run/dbus/system_bus_socket
unix 3 [ ] STREAM CONNECTED 21945
unix 3 [ ] STREAM CONNECTED 21966
unix 3 [ ] STREAM CONNECTED 17499

2- Listing all TCP ports with netstat:

[root@server ~]# netstat -at 
[root@mail ~]# netstat -at
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN
tcp 0 0 localhost:smtp 0.0.0.0:* LISTEN
tcp 0 0 mail:ssh 192.168.139.1:54347 ESTABLISHED
tcp 0 48 mail:ssh 192.168.139.1:60220 ESTABLISHED
tcp6 0 0 [::]:ssh [::]:* LISTEN
tcp6 0 0 localhost:smtp [::]:* LISTEN

3- Listing all TCP ports :

[root@server ~]# netstat -au
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
udp 0 0 0.0.0.0:bootpc 0.0.0.0:*
udp 0 0 localhost:323 0.0.0.0:*
udp6 0 0 localhost:323 [::]:*

4- Listing all listening ports :

[root@server ~]# netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN
tcp 0 0 localhost:smtp 0.0.0.0:* LISTEN
tcp6 0 0 [::]:ssh [::]:* LISTEN
tcp6 0 0 localhost:smtp [::]:* LISTEN
udp 0 0 0.0.0.0:bootpc 0.0.0.0:*
udp 0 0 localhost:323 0.0.0.0:*
udp6 0 0 localhost:323 [::]:*
raw6 0 0 [::]:ipv6-icmp [::]:* 7
Active UNIX domain sockets (only servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 18177 /var/run/vmware/guestServicePipe
unix 2 [ ACC ] SEQPACKET LISTENING 13829 /run/udev/control
unix 2 [ ACC ] STREAM LISTENING 23051 /var/run/NetworkManager/private-dhcp
unix 2 [ ACC ] STREAM LISTENING 9011 /run/systemd/journal/stdout
unix 2 [ ACC ] STREAM LISTENING 21927 public/qmgr
unix 2 [ ACC ] STREAM LISTENING 21949 public/flush
unix 2 [ ACC ] STREAM LISTENING 21964 public/showq
unix 2 [ ACC ] STREAM LISTENING 21931 private/tlsmgr
unix 2 [ ACC ] STREAM LISTENING 13698 /run/systemd/private
unix 2 [ ACC ] STREAM LISTENING 13967 /run/lvm/lvmetad.socket
unix 2 [ ACC ] STREAM LISTENING 21934 private/rewrite
unix 2 [ ACC ] STREAM LISTENING 21937 private/bounce
unix 2 [ ACC ] STREAM LISTENING 21940 private/defer

5- Listing only listening TCP ports :

[root@server ~]# netstat -lt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN
tcp 0 0 localhost:smtp 0.0.0.0:* LISTEN
tcp6 0 0 [::]:ssh [::]:* LISTEN
tcp6 0 0 localhost:smtp [::]:* LISTEN

6- Listing only listening UDP ports :

[root@server ~]# netstat -lu
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
udp 0 0 0.0.0.0:bootpc 0.0.0.0:*
udp 0 0 localhost:323 0.0.0.0:*
udp6 0 0 localhost:323 [::]:*

7- Showing statistics for all ports :

[root@server ~]# netstat -s
Ip:
10761 total packets received
0 forwarded
0 incoming packets discarded
10738 incoming packets delivered
8946 requests sent out
42 outgoing packets dropped
25 dropped because of missing route
Icmp:
91 ICMP messages received
2 input ICMP message failed.
ICMP input histogram:
destination unreachable: 90
echo requests: 1
91 ICMP messages sent
0 ICMP messages failed
ICMP output histogram:
destination unreachable: 90
echo replies: 1
IcmpMsg:
InType3: 90
InType8: 1
OutType0: 1
OutType3: 90
Tcp:
18 active connections openings
2 passive connection openings
2 failed connection attempts
0 connection resets received
2 connections established
10425 segments received
8607 segments send out
2 segments retransmited
0 bad segments received.
0 resets sent
Udp:
136 packets received
86 packets to unknown port received.
0 packet receive errors
246 packets sent
0 receive buffer errors
0 send buffer errors
UdpLite:
TcpExt:
14 TCP sockets finished time wait in fast timer
21 delayed acks sent
2 packets directly queued to recvmsg prequeue.
9599 packet headers predicted
70 acknowledgments not containing data payload received
174 predicted acknowledgments
2 other TCP timeouts
TCPRcvCoalesce: 2523
TCPSpuriousRtxHostQueues: 4
TCPSynRetrans: 2
TCPOrigDataSent: 278

8- Showing statistics for TCP ports :

[root@mail ~]# netstat -st
IcmpMsg:
InType3: 90
InType8: 1
OutType0: 1
OutType3: 90
Tcp:
18 active connections openings
2 passive connection openings
2 failed connection attempts
0 connection resets received
2 connections established
10431 segments received
8611 segments send out
2 segments retransmited
0 bad segments received.
0 resets sent
UdpLite:
TcpExt:
14 TCP sockets finished time wait in fast timer
21 delayed acks sent
2 packets directly queued to recvmsg prequeue.
9599 packet headers predicted
72 acknowledgments not containing data payload received
175 predicted acknowledgments
2 other TCP timeouts
TCPRcvCoalesce: 2523
TCPSpuriousRtxHostQueues: 4
TCPSynRetrans: 2
TCPOrigDataSent: 282
IpExt:
InNoRoutes: 3
InBcastPkts: 21
InOctets: 36649091
OutOctets: 398390
InBcastOctets: 2091
InNoECTPkts: 26644

9- Showing statistics for UDP ports :

[root@server ~]# netstat -su
IcmpMsg:
InType3: 90
InType8: 1
OutType0: 1
OutType3: 90
Udp:
151 packets received
86 packets to unknown port received.
0 packet receive errors
261 packets sent
0 receive buffer errors
0 send buffer errors
UdpLite:
IpExt:
InNoRoutes: 3
InBcastPkts: 21
InOctets: 36650253
OutOctets: 399582
InBcastOctets: 2091
InNoECTPkts: 26660

10- Displaying Service name with PID :

This command is very useful when you want to know which program is running on a particular port :

[root@server ~]# netstat -p
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 mail:ssh 192.168.139.1:54347 ESTABLISHED 1647/sshd: root@not
tcp 0 48 mail:ssh 192.168.139.1:60220 ESTABLISHED 1643/sshd: root@pts
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags Type State I-Node PID/Program name Path
unix 3 [ ] DGRAM 9001 1/systemd /run/systemd/notify
unix 2 [ ] DGRAM 9003 1/systemd /run/systemd/cgroups-agent
unix 5 [ ] DGRAM 9014 1/systemd /run/systemd/journal/socket
unix 17 [ ] DGRAM 9016 1/systemd /dev/log
unix 2 [ ] DGRAM 17820 665/chronyd /var/run/chrony/chronyd.sock
unix 2 [ ] DGRAM 13787 1/systemd /run/systemd/shutdownd
unix 3 [ ] STREAM CONNECTED 21962 1254/master
unix 2 [ ] DGRAM 20881 997/systemd-logind
unix 3 [ ] STREAM CONNECTED 21975 1254/master
unix 3 [ ] STREAM CONNECTED 17416 654/dbus-daemon
unix 3 [ ] STREAM CONNECTED 14640 508/lvmetad
unix 3 [ ] STREAM CONNECTED 21990 1254/master
unix 3 [ ] STREAM CONNECTED 20910 654/dbus-daemon /run/dbus/system_bus_socket
unix 3 [ ] STREAM CONNECTED 21932 1254/master
unix 2 [ ] DGRAM 21393 1011/crond
unix 3 [ ] STREAM CONNECTED 18397 654/dbus-daemon /run/dbus/system_bus_socket
unix 3 [ ] STREAM CONNECTED 21945 1254/master
unix 3 [ ] STREAM CONNECTED 21966 1254/master
unix 3 [ ] STREAM CONNECTED 17499 656/VGAuthService
unix 2 [ ] DGRAM 14183 1/systemd
unix 2 [ ] DGRAM 23083 1595/dhclient
unix 3 [ ] STREAM CONNECTED 20439 1/systemd /run/systemd/journal/stdout
unix 3 [ ] STREAM CONNECTED 21929 1254/master
unix 3 [ ] STREAM CONNECTED 18351 1/systemd /run/systemd/journal/stdout
unix 3 [ ] STREAM CONNECTED 21954 1254/master
unix 3 [ ] STREAM CONNECTED 19493 654/dbus-daemon /run/dbus/system_bus_socket
unix 3 [ ] STREAM CONNECTED 17602 1/systemd /run/systemd/journal/stdout
unix 3 [ ] STREAM CONNECTED 17418 654/dbus-daemon /run/dbus/system_bus_socket

11- Displaying Connections with IP addresses :

To show all connections and ports listening but only show IP addresses without name resolution :

[root@server ~]# netstat -an
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
tcp 0 0 192.168.139.153:22 192.168.139.1:54347 ESTABLISHED
tcp 0 48 192.168.139.153:22 192.168.139.1:60220 ESTABLISHED
tcp6 0 0 :::22 :::* LISTEN
tcp6 0 0 ::1:25 :::* LISTEN
udp 0 0 0.0.0.0:68 0.0.0.0:*
udp 0 0 127.0.0.1:323 0.0.0.0:*
udp6 0 0 ::1:323 :::*
raw6 0 0 :::58 :::* 7
Active UNIX domain sockets (servers and established)

12- Show PID’s Connections :

[root@server ~]# netstat -o
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State Timer
tcp 0 0 mail:ssh 192.168.139.1:54347 ESTABLISHED keepalive (3490.29/0/0)
tcp 0 48 mail:ssh 192.168.139.1:60220 ESTABLISHED on (0.23/0/0)
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags Type State I-Node Path
unix 3 [ ] DGRAM 9001 /run/systemd/notify
unix 2 [ ] DGRAM 9003 /run/systemd/cgroups-agent
unix 5 [ ] DGRAM 9014 /run/systemd/journal/socket
unix 18 [ ] DGRAM 9016 /dev/log
unix 2 [ ] DGRAM 17820 /var/run/chrony/chronyd.sock
unix 2 [ ] DGRAM 13787 /run/systemd/shutdownd
unix 3 [ ] STREAM CONNECTED 21962
unix 2 [ ] DGRAM 20881
unix 3 [ ] STREAM CONNECTED 21975
unix 3 [ ] STREAM CONNECTED 17416

13- Display the routing table :

[root@server ~]# netstat -r
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
default gateway 0.0.0.0 UG 0 0 0 ens33
192.168.139.0 0.0.0.0 255.255.255.0 U 0 0 0 ens33

14- Displaying IPv4 and IPv6 Information :

[root@mail ~]# netstat -r
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
default gateway 0.0.0.0 UG 0 0 0 ens33
192.168.139.0 0.0.0.0 255.255.255.0 U 0 0 0 ens33