↓ Skip to main content

Linux netstat Command Guide: Check Ports, Connections, and Stats

·391 words·2 mins
Linux Networking System Administration Command Line

Linux netstat Command Guide: Check Ports, Connections, and Stats

The netstat command (short for network statistics) is a classic Linux utility used to inspect network connections, analyze socket activity, and troubleshoot networking issues.

Although newer tools exist, netstat remains widely used for quick diagnostics and legacy system administration.

⚙️ 1. Installing netstat
#

netstat is included in the net-tools package. If it’s missing on your system, install it using:

sudo apt install net-tools   # Debian / Ubuntu
sudo yum install net-tools   # CentOS / RHEL

🔍 2. Common Usage Examples
#

View Network Connections
#

Command Description
netstat -a Show all connections and listening ports
netstat -l Show only listening ports
netstat -t Display TCP connections
netstat -u Display UDP connections
netstat -an Show numeric addresses (faster, no DNS lookup)
netstat -p Show PID and process name

System & Interface Monitoring
#

  • Routing Table

    netstat -r

  • Network Interfaces Statistics

    netstat -i

  • Continuous Monitoring (Live Refresh)

    netstat -c

The Most Useful Command (All-in-One)
# 

netstat -tunlp

Option breakdown:

  • -t → TCP connections
  • -u → UDP connections
  • -n → Numeric output (no DNS resolution)
  • -l → Listening ports
  • -p → Process ID and name

👉 This is the go-to command for checking which services are running and which ports are open.

📊 3. Understanding netstat Output
#

When running netstat, you’ll encounter several key fields:

  • Proto Protocol used (TCP or UDP)

  • Recv-Q Data waiting to be read by the local application

  • Send-Q Data waiting to be sent to the remote host

  • Local Address Local IP address and port

  • Foreign Address Remote IP address and port

  • State Connection state (e.g., LISTEN, ESTABLISHED, TIME_WAIT)

  • PID/Program name Process associated with the connection

Understanding these fields is essential for diagnosing network bottlenecks and connection issues.

⚡ 4. netstat vs ss: Modern Alternative
#

While netstat is still useful, modern Linux systems recommend the ss command from the iproute2 package.

Why use ss?
#

  • Faster execution
  • More detailed socket information
  • Better suited for high-performance environments

Example Equivalent:
# 

ss -tunlp

Despite this, netstat remains valuable for:

  • Legacy systems
  • Quick troubleshooting
  • Familiar workflows

✅ Summary
#

The netstat command is a reliable and versatile tool for:

  • Monitoring active connections
  • Checking open ports
  • Inspecting routing tables
  • Troubleshooting network issues

Even as newer tools like ss gain popularity, mastering netstat ensures you’re well-equipped to handle both modern and legacy Linux environments.

Related