Provided by: net-tools_1.60+git20161116.90da8a0-1ubuntu1_amd64
NAME
netstat – Print network connections, routing tables, interface statistics, masquerade
connections, and multicast memberships
SYNOPSIS
This program is mostly obsolete. Replacement for netstat is ss. Replacement for netstat
-r is ip route. Replacement for netstat -i is ip -s link. Replacement for netstat -g is
ip maddr.
DESCRIPTION
route(8), ifconfig(8), iptables(8), proc(5) ss(8) ip(8)
BUGS
Occasionally strange information may appear if a socket changes as it is viewed. This is
unlikely to occur.
AUTHORS
Provided by: net-tools_1.60-25ubuntu2_amd64
Starting with Linux release 2.2 netstat -i does not show interface statistics for alias
interfaces. To get per alias interface counters you need to setup explicit rules using the
ipchains(8) command.
route(8), ifconfig(8), ipchains(8), iptables(8), proc(5)
The netstat command line utility shows information about the network status of a workstation or server. netstat is available on Unix-like and Windows operating systems, with some differences in its usage between these systems.
netstat is an older utility, and some components of its functionality have been superseded by newer tools, like the ss command. A primary benefit of using netstat is that it is frequently pre-installed on Linux systems, while other tools might not be. As well, many (but not all) of the command line options for netstat can be run without root privileges, so it can still be useful on a system where you do not have root or sudo privileges.
This guide assumes some basic knowledge of networking in Linux, including network interfaces, routing tables, and network connections and sockets.
In This Guide
This guide will explore the options available when running netstat on Linux. netstat can be used to inspect:
A list of the command line options can be found below, and some advanced examples of using netstat with the AWK command will be introduced at the end of the guide.
Basic Usage
If netstat is not present on your Linux server or workstation, it can be added by installing the net-tools package:
sudo apt install net-tools # Debian-based systems
sudo yum install net-tools # CentOS and RHEL systems
Running netstat without Any Options
If you execute netstat without any command line arguments and options, the utility will display all open sockets and network connections, formatted in two tables. This will most likely be a relatively long list:
Command Line Options
The rest of this guide will put the most important of these command line options to work in order to help you learn their usage. However, nothing can replace experimenting with netstat on your own.
Sockets/Network Connections
Run netstat with the -a option to show both listening and non-listening network connections and sockets:
Only Show the LISTENING State
Run netstat with the -l option to only show listening network connections and sockets:
Show IPv4 Connections Only
The -A inet, –inet and -4 command line options will all tell netstat to show IPv4 connections (both TCP and UDP) only. Because listening connections are not shown by default, this command displays connections that are in a non-listening state:
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 1 0 li140-253.members.:smtp 193.32.160.143:41356 CLOSE_WAIT
tcp 0 300 li140-253.members.l:ssh athedsl-405473.ho:64917 ESTABLISHED
tcp 1 0 li140-253.members.:smtp 193.32.160.136:37752 CLOSE_WAIT
tcp 1 0 li140-253.members.:smtp 193.32.160.136:49900 CLOSE_WAIT
tcp 1 0 li140-253.members.:smtp 193.32.160.136:49900 CLOSE_WAIT
If you want to display IPv4 connections that are in both listening and non-listening state, add the -a command line option:
Show IPv6 Connections Only
The -A inet6, –inet6 and -6 command line options will all tell netstat to show IPv6 connections (both TCP and UDP) only. Because listening connections are not shown by default, this command displays connections that are in a non-listening state:
Show Listening UNIX Sockets
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 1 0 109.74.193.253:25 193.32.160.143:41356 CLOSE_WAIT
tcp 0 0 109.74.193.253:22 79.131.135.223:64917 ESTABLISHED
tcp 1 0 109.74.193.253:25 193.32.160.136:37752 CLOSE_WAIT
tcp 1 0 109.74.193.253:25 193.32.160.136:49900 CLOSE_WAIT
tcp6 0 0 109.74.193.253:80 104.18.40.175:26111 SYN_RECV
tcp6 0 0 109.74.193.253:80 104.18.40.175:47427 SYN_RECV
tcp6 0 0 109.74.193.253:80 104.18.41.175:24763 SYN_RECV
tcp6 0 0 109.74.193.253:80 104.18.41.175:32295 SYN_RECV
tcp6 0 0 109.74.193.253:80 104.18.41.175:53268 SYN_RECV
tcp6 0 0 109.74.193.253:80 104.18.40.175:4436 SYN_RECV
tcp6 0 0 109.74.193.253:80 104.18.40.175:17099 SYN_RECV
tcp6 0 0 109.74.193.253:80 104.18.41.175:12892 SYN_RECV
The -n option in the previous command tells netstat to not resolve IP addresses to hostnames.
If you want to display both listening and non-listening TCP connections, add the -a command line option:
Show IPv4 TCP Connections Only
If you want to display both listening and non-listening IPv4 TCP connections, add the -a command line option:
Show Listening TCP Connections Only
If you want to display listening TCP connections only, combine -l and -t:
Show UDP Connections Only
If you are only interested in seeing UDP connections, use the -u option:
netstat -u
To show only IPv4 or IPv6 UDP connections, combine -u with -4 or -6:
netstat -u4
netstat -u6
Show Extended Output
The -p option displays the process ID and program name that corresponds to a network connection or Unix socket.
This command will display the PID and program name for a system’s listening TCP connections:
sudo netstat -ltp
In particular, the previous example’s command is a fast way to learn about which networked services are running on your system.
Combining -p and -e
sudo netstat -ltpe
Routing Tables
One of the most frequent uses of netstat is for showing the routing table of a machine:
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 109.74.193.1 0.0.0.0 UG 0 0 0 eth0
109.74.193.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
In this output, the U flag means that the route is in use and the G flag denotes the default gateway. The H flag, which is not displayed here, would mean that the route is to a host and not to a network.
Network Interfaces
The -i option shows network statistics on a per-interface basis:
Kernel Interface table
Iface MTU RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0 1500 7075525 0 0 0 6830902 0 0 0 BMRU
lo 65536 573817 0 0 0 573817 0 0 0 LRU
If you combine -a with -i, netstat will also display interfaces that are not up:
Kernel Interface table
Iface MTU RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
dummy0 1500 0 0 0 0 0 0 0 0 BO
erspan0 1450 0 0 0 0 0 0 0 0 BM
eth0 1500 13128358 0 0 0 15677694 0 0 0 BMRU
gre0 1476 0 0 0 0 0 0 0 0 O
gretap0 1462 0 0 0 0 0 0 0 0 BM
ip6_vti0 1364 0 0 0 0 0 0 0 0 O
ip6gre0 1448 0 0 0 0 0 0 0 0 O
ip6tnl0 1452 0 0 0 0 0 0 0 0 O
ip_vti0 1480 0 0 0 0 0 0 0 0 O
lo 65536 846097 0 0 0 846097 0 0 0 LRU
sit0 1480 0 0 0 0 0 0 0 0 O
teql0 1500 0 0 0 0 0 0 0 0 O
tunl0 1480 0 0 0 0 0 0 0 0 O
Network Protocols
Use the -s option to see network statistics on a per-protocol basis:
Including the -w option will tell netstat to display raw network statistics:
sudo netstat -sw
Multicast Group Membership
The netstat -g command displays multicast group membership information:
The default output of netstat -g displays both IPv4 and IPv6 data.
Using AWK to process netstat output
The AWK programming language can help you process netstat output and generate handy reports.
Showing the Number of Listening Processes Per Username
mysql: 1
root: 5
- The first grep command deletes the line with the header information generated by netstat.
- The second grep command deletes empty lines from the output.
- After that, the uniq command counts line occurrences while omitting repeated output.
- Lastly, the second awk command reverses the two columns of the uniq command’s output and prints the data on screen.
HTTP Connections
2 193.32.160.136
1 79.131.135.223
1 193.32.160.143
1 106.13.205.251
Counting TCP States
The next command counts the various types of TCP states:
2 ESTABLISHED
3 CLOSE_WAIT
6 LISTEN
Summary
Even if there exists other more modern tools that can replace netstat, netstat remains a handy tool that will definitely help you if you ever have networking problems on your Linux machine. However, never forget to check your log files for errors or warnings related to your network problem before troubleshooting.
The netstat command, meaning network statistics, is a Command Prompt command used to display very detailed information about how your computer is communicating with other computers or network devices.
Specifically, it can show details about individual network connections, overall and protocol-specific networking statistics, and much more, all of which could help troubleshoot certain kinds of networking issues.
Lifewire / Nez Riaz
Netstat Command Availability
This command is available from within the Command Prompt in Windows 11, Windows 10, Windows 8, Windows 7, Windows Vista, Windows XP, Windows Server operating systems, and some older versions of Windows, too.
Since netstat is a cross-platform command, it’s also available in other operating systems like macOS and Linux.
The availability of certain netstat command switches and other netstat command syntax may differ from operating system to operating system.
Netstat Command Syntax
How to Read Command Syntax
Netstat Command List
netstat
Execute the netstat command alone to show a relatively simple list of all active TCP connections which, for each one, will show the local IP address (your computer), the foreign IP address (the other computer or network device), along with their respective port numbers, as well as the TCP state.
-a
This switch displays active TCP connections, TCP connections with the listening state, as well as UDP ports that are being listened to.
-b
This netstat switch is very similar to the -o switch listed below, but instead of displaying the PID, will display the process’s actual file name. Using -b over -o might seem like it’s saving you a step or two but using it can sometimes greatly extend the time it takes netstat to fully execute.
-e
Use this switch with the netstat command to show statistics about your network connection. This data includes bytes, unicast packets, non-unicast packets, discards, errors, and unknown protocols received and sent since the connection was established.
-f
The -f switch will force the netstat command to display the Fully Qualified Domain Name (FQDN) for each foreign IP addresses when possible.
-n
Use the -n switch to prevent netstat from attempting to determine host names for foreign IP addresses. Depending on your current network connections, using this switch could considerably reduce the time it takes for netstat to fully execute.
-p
Use the -p switch to show connections or statistics only for a particular protocol. You can not define more than one protocol at once, nor can you execute netstat with -p without defining a protocol.
protocol
When specifying a protocol with the -p option, you can use tcp, udp, tcpv6, or udpv6. If you use -s with -p to view statistics by protocol, you can use icmp, ip, icmpv6, or ipv6 in addition to the first four I mentioned.
-r
Execute netstat with -r to show the IP routing table. This is the same as using the route command to execute route print.
-s
The -s option can be used with the netstat command to show detailed statistics by protocol. You can limit the statistics shown to a particular protocol by using the -soption and specifying that protocol, but be sure to use -s before -p protocol when using the switches together.
-t
Use the -t switch to show the current TCP chimney offload state in place of the typically displayed TCP state.
-y
The -y switch can be used to show the TCP connection template for all connection. You cannot use -y with any other netstat option.
time_interval
This is the time, in seconds, that you’d like the netstat command to re-execute automatically, stopping only when you use Ctrl-C to end the loop.
/?
Use the help switch to show details about the netstat command’s several options.
Netstat Command Examples
Here are several examples showing how the netstat command might be used:
Show Active TCP Connections
Here’s an example of what you might see:
As you can see, there were 11 active TCP connections at the time netstat was executed in this example. The only protocol (in the Proto column) listed is TCP, which was expected because we didn’t use -a.
You can also see three sets of IP addresses in the Local Address column—the actual address of 192.168.1.14 and both IPv4 and IPv6 versions of the loopback addresses, along with the port each connection is using. The Foreign Address column lists the FQDN (75.125.212.75 didn’t resolve for some reason) along with that port as well.
Finally, the State column lists the TCP state of that particular connection.
Show Connections and Process Identifiers
Here’s what the computer displayed:
You probably noticed the new PID column. In this case, the PIDs are all the same, meaning the same program on the computer opened these connections.
To determine what program is represented by the PID of 2948 on the computer, open Task Manager to the Processes tab, and note the Image Name listed next to the PID we’re looking for in the PID column.1
While this and the previous example were both run on the same computer, and within just a minute of each other, you can see that the list of active TCP connections is considerably different. This is because your computer is constantly connecting to, and disconnecting from, various other devices on your network and over the internet.
Show Specific Connections Only
The above example is similar to what we’ve already looked at, but instead of displaying all connections, we’re telling the command to show only the connections that are using a specific PID, 28604 in this example.
A similar command could be used to filter out the connections with a CLOSE_WAIT state, by replacing the PID with ESTABLISHED.
Show Protocol-Specific Stats
This is what that netstat command produced for us:
As you can see, various statistics for the TCP protocol are displayed, as are all active TCP connections at the time.
Show Updated Network Stats
Here’s what’s produced on screen:
Various pieces of information, which you can see here and that we listed in the -e syntax above, are displayed.
The command only automatically executed one extra time, as you can see by the two tables in the result. Note the ^C at the bottom, indicating that the Ctrl+C abort command was used to stop the re-running of the command.
Netstat Related Commands
The netstat command is often used with other networking related Command Prompt commands like nslookup, ping, tracert, ipconfig, and others.
- How do I use netstat to look up my proxy?Run ntestat -ban and look through the list for the Process Identifier (PID) of iexplore.exe. This sill show you the proxy port and IP of your system.
- What’s the difference between netstat and nbstat commands?In general, netstat commands are used to display TCP and IP address info, while nbstat commends specifically pertain to NetBIOS statitstics.
Thanks for letting us know!
Get the Latest Tech News Delivered Every Day
Описание команды NETSTAT
Netstat – это утилита командной строки Windows выводящая на дисплей состояние TCP-соединений. Команда netstat отображает статистику активных подключений TCP, портов, прослушиваемых компьютером, статистики Ethernet, таблицы маршрутизации IP, статистики IPv4 (для протоколов IP, ICMP, TCP и UDP) и IPv6 (для протоколов IPv6, ICMPv6, TCP через IPv6 и UDP через IPv6). Запущенная без параметров, команда netstat отображает подключения TCP.
Синтаксис и параметры команды NETSTAT
- -a – вывод всех активных подключений TCP и прослушиваемых компьютером портов TCP и UDP.
- -e – вывод статистики Ethernet, например количества отправленных и принятых байтов и пакетов. Этот параметр может комбинироваться с ключом -s.
- -n – вывод активных подключений TCP с отображением адресов и номеров портов в числовом формате без попыток определения имен.
- -o – вывод активных подключений TCP и включение кода процесса (PID) для каждого подключения. Код процесса позволяет найти приложение на вкладке Процессы диспетчера задач Windows. Этот параметр может комбинироваться с ключами -a, -n и -p.
- -p протокол – вывод подключений для протокола, указанного параметром протокол. В этом случае параметр протокол может принимать значения tcp, udp, tcpv6 или udpv6. Если данный параметр используется с ключом -s для вывода статистики по протоколу, параметр протокол может иметь значение tcp, udp, icmp, ip, tcpv6, udpv6, icmpv6 или ipv6.
- -s – вывод статистики по протоколу. По умолчанию выводится статистика для протоколов TCP, UDP, ICMP и IP. Если установлен протокол IPv6 для Windows XP, отображается статистика для протоколов TCP через IPv6, UDP через IPv6, ICMPv6 и IPv6. Параметр -p может использоваться для указания набора протоколов.
- -r – вывод содержимого таблицы маршрутизации IP. Эта команда эквивалентна команде route print.
- интервал – обновление выбранных данных с интервалом, определенным параметром интервал (в секундах). Нажатие клавиш CTRL+C останавливает обновление. Если этот параметр пропущен, netstat выводит выбранные данные только один раз.
- /? – отображение справки в командной строке.
Примеры команды NETSTAT
Пример работы команды Netstat на Windows 10 показан на рисунке выше, утилита работает на всех версиях операционных систем Windows.
- Для отображения справки по команде введите в командной строке netstat /?;
- Для вывода статистики Ethernet и статистики по всем протоколам введите следующую команду: netstat -e -s;
- Для вывода статистики только по протоколам TCP и UDP введите следующую команду: netstat -s -p tcp udp;
- Для вывода активных подключений TCP и кодов процессов каждые 5 секунд введите следующую команду: netstat -o 5.
