10 Netstat Command Examples on Linux

Netstat is a command line utility that can be utilized to list out all the network (socket) connections on a method comparable to network connections, routing tables, interface records, masquerade connections, multicast memberships etc. This article explains about – Top 10 Netstat Command Examples on Linux.
To show about listening and non-listening sockets, use the following command –
$ netstat -all
The sample output should be like this –
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 localhost:mysql *:* LISTEN
tcp 0 0 linux-Inspiron-3:domain *:* LISTEN
tcp 0 0 linux-Inspiron-35:46930 ec2-54-236-207-15:https ESTABLISHED
tcp 0 0 linux-Inspiron-35:59820 maa03s22-in-f14.1:https ESTABLISHED
tcp 0 0 linux-Inspiron-35:46662 sc-in-f188.1e100.n:5228 ESTABLISHED
tcp 0 0 linux-Inspiron-35:41914 bom05s08-in-f4.1e:https ESTABLISHED
tcp 0 0 linux-Inspiron-35:59760 maa03s22-in-f14.1:https ESTABLISHED
tcp 0 0 linux-Inspiron-35:33172 ec2-54-221-62-191:https ESTABLISHED
tcp 0 0 linux-Inspiron-35:43466 ec2-34-192-133-18:https ESTABLISHED
tcp 0 0 linux-Inspiron-35:43480 a104-81-21-73.depl:http TIME_WAIT
tcp 0 0 linux-Inspiron-35:36270 maa03s20-in-f14.1:https ESTABLISHED
tcp 0 0 linux-Inspiron-35:53360 maa03s20-in-f3.1e1:http ESTABLISHED
........................................................................................
To show the PID and name of the program to which each socket belongs, use the following command –
$ netstat --program
The sample output should be like this –
Active Internet connections (w/o servers)
Proto    Recv-Q    Send-Q    Local Address    Foreign Address    State PID/Program name
tcp       0          0 linux-Inspiron-35:46930 ec2-54-236-207-15:https ESTABLISHED 23074/chrome
tcp       0          0 linux-Inspiron-35:59820 maa03s22-in-f14.1:https ESTABLISHED 23235/chromium-brow
tcp       0          0 linux-Inspiron-35:46662 sc-in-f188.1e100.n:5228 ESTABLISHED 23074/chrome
tcp       0          0 linux-Inspiron-35:41914 bom05s08-in-f4.1e:https ESTABLISHED 23074/chrome
tcp       1          0 linux-Inspiron-35:60770 117.18.237.42:http CLOSE_WAIT 23074/chrome
tcp       0          0 linux-Inspiron-35:43466 ec2-34-192-133-18:https ESTABLISHED 23074/chrome
............................................................................................
To get the TCP ports information, use the following command –
$ netstat --tcp
The sample output should be like this –
Active Internet connections (w/o servers)
Proto    Recv-Q    Send-Q L   ocal Address    Foreign Address State
tcp       0          0 linux-Inspiron-35:36310 maa03s20-in-f14.1:https ESTABLISHED
tcp       0          0 linux-Inspiron-35:46930 ec2-54-236-207-15:https ESTABLISHED
tcp       0          0 linux-Inspiron-35:46662 sc-in-f188.1e100.n:5228 ESTABLISHED
tcp       0          0 linux-Inspiron-35:36320 maa03s20-in-f14.1:https ESTABLISHED
tcp       0          0 linux-Inspiron-35:33216 ec2-54-221-62-191:https ESTABLISHED
tcp       0          0 linux-Inspiron-35:46478 arn02s05-in-f3.1e:https ESTABLISHED
tcp       0          0 linux-Inspiron-35:43466 ec2-34-192-133-18:https ESTABLISHED
tcp       0          0 linux-Inspiron-35:60794 117.18.237.42:http ESTABLISHED
tcp       0          0 linux-Inspiron-35:48080 104.244.42.136:https ESTABLISHED
tcp       0          0 linux-Inspiron-35:58048 ip-166-62-112-150.:http ESTABLISHED
tcp       0          0 linux-Inspiron-35:33272 bom05s08-in-f163.:https ESTABLISHED
To get the UDP ports information, use the following command –
$ netstat --udp
The sample output should be like this –
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q   Local Address            Foreign Address          State
udp    0       0    linux-Inspiron-35:46539    maa03s20-in-f5.1e:https  ESTABLISHED
udp   768      0    localhost:46996            linux-Inspiron-3:domain  ESTABLISHED
To get the list of linux ports, use the following command –
$ netstat -lx
The sample output should be like this –
Active UNIX domain sockets (only servers)
Proto    RefCnt    Flags    Type       State     I-Node    Path
unix       2       [ ACC ] STREAM    LISTENING    27810    @/tmp/.ICE-unix/2345
unix       2       [ ACC ] STREAM    LISTENING    26776    @/tmp/ibus/dbus-RkYlcXlm
unix       2       [ ACC ] STREAM    LISTENING    20175    /var/run/mysqld/mysqld.sock
unix       2       [ ACC ] STREAM    LISTENING    25423    /run/user/1000/systemd/private
unix       2       [ ACC ] STREAM    LISTENING    24848    /run/user/126/systemd/private
unix       2       [ ACC ] SEQPACKET LISTENING    1784    /run/udev/control
unix       2       [ ACC ] STREAM    LISTENING    25933    /run/user/1000/keyring/control
unix       2       [ ACC ] STREAM    LISTENING    22555    /var/run/NetworkManager/private-dhcp
unix       2       [ ACC ] STREAM    LISTENING    24475    /run/user/1000/keyring/pkcs11
unix       2       [ ACC ] STREAM    LISTENING    24477    /run/user/1000/keyring/ssh
unix       2       [ ACC ] STREAM    LISTENING    112357    /tmp/.com.google.Chrome.3r7jSQ/SingletonSocket
To display routing table, use the following command –
$ netstat -r
The sample output should be like this –
Kernel IP routing table
Destination    Gateway          Genmask       Flags    MSS    Window    irtt    Iface
default       TutorialsPoint1    0.0.0.0       UG       0       0         0     enp7s0
default       192.168.1.254      0.0.0.0       UG       0       0         0     wlp6s0
link-local    *                  255.255.0.0   U        0       0         0     enp7s0
192.168.1.0   *                  255.255.255.0 U        0       0         0     enp7s0
192.168.1.0   *                  255.255.255.0 U        0       0         0     wlp6s0
To display networking statistics, use the following command –
$ netstat -s
The sample output should be like this –
Ip:
   226777 total packets received
   99 with invalid addresses
   0 forwarded
   0 incoming packets discarded
   213036 incoming packets delivered
   126141 requests sent out
   48 outgoing packets dropped
Icmp:
   420 ICMP messages received
   120 input ICMP message failed.
   ICMP input histogram:
      destination unreachable: 414
      echo requests: 6
   576 ICMP messages sent
   0 ICMP messages failed
   ICMP output histogram:
      destination unreachable: 570
      echo replies: 6
IcmpMsg:
   InType3: 414
   InType8: 6
   OutType0: 6
   OutType3: 570
....................................................................................
To find the nonsupportive Address families, use the following command –
$ netstat -v
The sample output should be like this –
Active Internet connections (w/o servers)
Proto    Recv-Q    Send-Q    Local Address             Foreign Address             State
tcp       0          0    linux-Inspiron-35:46930    ec2-54-236-207-15:https    ESTABLISHED
tcp       0          0    linux-Inspiron-35:39418    arn09s10-in-f14.1:https    ESTABLISHED
tcp       0          0    linux-Inspiron-35:36398    maa03s20-in-f14.1:https    ESTABLISHED
tcp       0          0    linux-Inspiron-35:59950    maa03s22-in-f14.1:https    ESTABLISHED
tcp       0          0    linux-Inspiron-35:60888    117.18.237.42:http         ESTABLISHED
tcp       0          0    linux-Inspiron-35:55716    maa03s20-in-f3.1e:https    TIME_WAIT
tcp       0          0    linux-Inspiron-35:42044    bom05s08-in-f4.1e:https    ESTABLISHED
tcp       0          0    linux-Inspiron-35:49654    ec2-54-221-3-35.c:https    ESTABLISHED
tcp       0          0    linux-Inspiron-35:47238    sc-in-f188.1e100.n:5228    ESTABLISHED
tcp       0          0    linux-Inspiron-35:42046    bom05s08-in-f4.1e:https    ESTABLISHED
...........................................................................................
To display other/more information about network, use the following command –
Active Internet connections (w/o servers)
Proto    Recv-Q    Send-Q    Local Address             Foreign Address           State       User    Inode
tcp       0          0    linux-Inspiron-35:46930    ec2-54-236-207-15:https  ESTABLISHED    linux   123811
tcp       0          0    linux-Inspiron-35:55458    52.222.136.134:https     ESTABLISHED    linux   148067
tcp       0          0    linux-Inspiron-35:43780    sb-in-f188.1e100.n:5228  ESTABLISHED    linux   147150
tcp       0          0    linux-Inspiron-35:60924    117.18.237.42:http ESTAB    LISHED      linux   148291
tcp       0          0    linux-Inspiron-35:36446    maa03s20-in-f14.1:https   ESTABLISHED   linux   148068
tcp       0          0    linux-Inspiron-35:51126    edge-star-mini-sh:https   ESTABLISHED   linux   149411
tcp       0          0    linux-Inspiron-35:33338    ec2-54-221-62-191:https   CLOSE_WAIT    linux   146371
udp       0          0    linux-Inspiron-35:46539    maa03s20-in-f5.1e:https   ESTABLISHED   linux   117623
udp      768         0    localhost:46996            linux-Inspiron-3:domain   ESTABLISHED   linux   123551
..................................................................................
To get the help of netstat, use the following command –
$ netstat -h
The sample output should be like this –
usage: netstat [-vWeenNcCF] [] -r    netstat {-V|--version|-h|--help}
       netstat [-vWnNcaeol] [ ...]
       netstat { [-vWeenNac] -i | [-cWnNe] -M | -s }

-r, --route             display routing table
-i, --interfaces        display interface table
-g, --groups            display multicast group memberships
-s, --statistics        display networking statistics (like SNMP)
-M, --masquerade        display masqueraded connections

-v, --verbose          be verbose
-W, --wide             don't truncate IP addresses
-n, --numeric          don't resolve names
--numeric-hosts          don't resolve host names
--numeric-ports          don't resolve port names
--numeric-users          don't resolve user names
-N, --symbolic          resolve hardware names
-e, --extend          display other/more information
-p, --programs          display PID/Program name for sockets
-c, --continuous c      ontinuous listing

-l, --listening       display listening server sockets
-a, --all, --listening display all sockets (default: connected)
-o, --timers          display timers
-F, --fib             display Forwarding Information Base (default)
-C, --cache          display routing cache instead of FIB

={-t|--tcp} {-u|--udp} {-w|--raw} {-x|--unix} --ax25 --ipx --netrom
=Use '-6|-4' or '-A ' or '--'; default: inet
List of possible address families (which support routing):
inet (DARPA Internet) inet6 (IPv6) ax25 (AMPR AX.25)
netrom (AMPR NET/ROM) ipx (Novell IPX) ddp (Appletalk DDP)
x25 (CCITT X.25)


In the above article, we have learnt about – Top 10 Netstat command examples on Linux. In our next articles, we will come up with more Linux based tricks and tips. Keep reading!