VOOZH about

URL: https://www.tecmint.com/20-netstat-commands-for-linux-network-management/

⇱ 20 Netstat Commands for Linux Network Management

Skip to content

netstat (network statistics) is a command-line tool for monitoring network connections both incoming and outgoing as well as viewing routing tables, interface statistics, etc.

[ You might also like: 22 Linux Networking Commands for Sysadmin ]

netstat is available on all Unix-like Operating Systems and also available on Windows OS as well. It is very useful in terms of network troubleshooting and performance measurement.

netstat is one of the most basic network service debugging tools, telling you what ports are open and whether any programs are listening on ports.

Update: The Linux netstat command is replaced by new ss command, which is capable of displaying more information about network connections and it is much faster than the older netstat command.

The netstat tool is very important and much useful for Linux network administrators as well as system administrators to monitor and troubleshoot their network-related problems and determine network traffic performance.

This article shows usages of netstat command with their examples which may be useful in daily operation.

[ You might also like: 35 Practical Examples of Linux Find Command ]

1. Listing all the LISTENING Ports of TCP and UDP Connections

Listing all ports (both TCP and UDP) using netstat -a option.

# netstat -a | more

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:sunrpc *:* LISTEN
tcp 0 52 192.168.0.2:ssh 192.168.0.1:egs ESTABLISHED
tcp 1 0 192.168.0.2:59292 www.gov.com:http CLOSE_WAIT
tcp 0 0 localhost:smtp *:* LISTEN
tcp 0 0 *:59482 *:* LISTEN
udp 0 0 *:35036 *:*
udp 0 0 *:npmp-local *:*

Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 16972 /tmp/orbit-root/linc-76b-0-6fa08790553d6
unix 2 [ ACC ] STREAM LISTENING 17149 /tmp/orbit-root/linc-794-0-7058d584166d2
unix 2 [ ACC ] STREAM LISTENING 17161 /tmp/orbit-root/linc-792-0-546fe905321cc
unix 2 [ ACC ] STREAM LISTENING 15938 /tmp/orbit-root/linc-74b-0-415135cb6aeab

2. Listing TCP Ports connections

Listing only TCP (Transmission Control Protocol) port connections using netstat -at.

# netstat -at

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 localhost:ipp *:* LISTEN
tcp 0 0 localhost:smtp *:* LISTEN
tcp 0 52 192.168.0.2:ssh 192.168.0.1:egs ESTABLISHED
tcp 1 0 192.168.0.2:59292 www.gov.com:http CLOSE_WAIT

3. Listing UDP Ports connections

Listing only UDP (User Datagram Protocol ) port connections using netstat -au.

# netstat -au

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
udp 0 0 *:35036 *:*
udp 0 0 *:npmp-local *:*
udp 0 0 *:mdns *:*

4. Listing all LISTENING Connections

Listing all active listening ports connections with netstat -l.

# netstat -l

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:sunrpc *:* LISTEN
tcp 0 0 *:58642 *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
udp 0 0 *:35036 *:*
udp 0 0 *:npmp-local *:*

Active UNIX domain sockets (only servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 16972 /tmp/orbit-root/linc-76b-0-6fa08790553d6
unix 2 [ ACC ] STREAM LISTENING 17149 /tmp/orbit-root/linc-794-0-7058d584166d2
unix 2 [ ACC ] STREAM LISTENING 17161 /tmp/orbit-root/linc-792-0-546fe905321cc
unix 2 [ ACC ] STREAM LISTENING 15938 /tmp/orbit-root/linc-74b-0-415135cb6aeab

5. Listing all TCP Listening Ports

Listing all active listening TCP ports by using option netstat -lt.

# netstat -lt

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:dctp *:* LISTEN
tcp 0 0 *:mysql *:* LISTEN
tcp 0 0 *:sunrpc *:* LISTEN
tcp 0 0 *:munin *:* LISTEN
tcp 0 0 *:ftp *:* LISTEN
tcp 0 0 localhost.localdomain:ipp *:* LISTEN
tcp 0 0 localhost.localdomain:smtp *:* LISTEN
tcp 0 0 *:http *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 *:https *:* LISTEN

6. Listing all UDP Listening Ports

Listing all active listening UDP ports by using option netstat -lu.

# netstat -lu

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
udp 0 0 *:39578 *:*
udp 0 0 *:meregister *:*
udp 0 0 *:vpps-qua *:*
udp 0 0 *:openvpn *:*
udp 0 0 *:mdns *:*
udp 0 0 *:sunrpc *:*
udp 0 0 *:ipp *:*
udp 0 0 *:60222 *:*
udp 0 0 *:mdns *:*

7. Listing all UNIX Listening Ports

Listing all active UNIX listening ports using netstat -lx.

# netstat -lx

Active UNIX domain sockets (only servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 4171 @ISCSIADM_ABSTRACT_NAMESPACE
unix 2 [ ACC ] STREAM LISTENING 5767 /var/run/cups/cups.sock
unix 2 [ ACC ] STREAM LISTENING 7082 @/tmp/fam-root-
unix 2 [ ACC ] STREAM LISTENING 6157 /dev/gpmctl
unix 2 [ ACC ] STREAM LISTENING 6215 @/var/run/hald/dbus-IcefTIUkHm
unix 2 [ ACC ] STREAM LISTENING 6038 /tmp/.font-unix/fs7100
unix 2 [ ACC ] STREAM LISTENING 6175 /var/run/avahi-daemon/socket
unix 2 [ ACC ] STREAM LISTENING 4157 @ISCSID_UIP_ABSTRACT_NAMESPACE
unix 2 [ ACC ] STREAM LISTENING 60835836 /var/lib/mysql/mysql.sock
unix 2 [ ACC ] STREAM LISTENING 4645 /var/run/audispd_events
unix 2 [ ACC ] STREAM LISTENING 5136 /var/run/dbus/system_bus_socket
unix 2 [ ACC ] STREAM LISTENING 6216 @/var/run/hald/dbus-wsUBI30V2I
unix 2 [ ACC ] STREAM LISTENING 5517 /var/run/acpid.socket
unix 2 [ ACC ] STREAM LISTENING 5531 /var/run/pcscd.comm

8. Showing Statistics by Protocol

Displays statistics by protocol. By default, statistics are shown for the TCP, UDP, ICMP, and IP protocols. The -s parameter can be used to specify a set of protocols.

# netstat -s

Ip:
 2461 total packets received
 0 forwarded
 0 incoming packets discarded
 2431 incoming packets delivered
 2049 requests sent out
Icmp:
 0 ICMP messages received
 0 input ICMP message failed.
 ICMP input histogram:
 1 ICMP messages sent
 0 ICMP messages failed
 ICMP output histogram:
 destination unreachable: 1
Tcp:
 159 active connections openings
 1 passive connection openings
 4 failed connection attempts
 0 connection resets received
 1 connections established
 2191 segments received
 1745 segments send out
 24 segments retransmited
 0 bad segments received.
 4 resets sent
Udp:
 243 packets received
 1 packets to unknown port received.
 0 packet receive errors
 281 packets sent

9. Showing Statistics by TCP Protocol

Showing statistics of only TCP protocol by using option netstat -st.

# netstat -st

Tcp:
 2805201 active connections openings
 1597466 passive connection openings
 1522484 failed connection attempts
 37806 connection resets received
 1 connections established
 57718706 segments received
 64280042 segments send out
 3135688 segments retransmited
 74 bad segments received.
 17580 resets sent

10. Showing Statistics by UDP Protocol

# netstat -su

Udp:
 1774823 packets received
 901848 packets to unknown port received.
 0 packet receive errors
 2968722 packets sent

11. Displaying Service name with PID

Displaying service name with their PID number, using option netstat -tp will display “PID/Program Name“.

# netstat -tp

Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 192.168.0.2:ssh 192.168.0.1:egs ESTABLISHED 2179/sshd
tcp 1 0 192.168.0.2:59292 www.gov.com:http CLOSE_WAIT 1939/clock-applet

12. Displaying Promiscuous Mode

Displaying Promiscuous mode with -ac switch, netstat print the selected information or refresh screen every five seconds. The default screen refreshes every second.

# netstat -ac 5 | grep tcp

tcp 0 0 *:sunrpc *:* LISTEN
tcp 0 0 *:58642 *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 localhost:ipp *:* LISTEN
tcp 0 0 localhost:smtp *:* LISTEN
tcp 1 0 192.168.0.2:59447 www.gov.com:http CLOSE_WAIT
tcp 0 52 192.168.0.2:ssh 192.168.0.1:egs ESTABLISHED
tcp 0 0 *:sunrpc *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 localhost:ipp *:* LISTEN
tcp 0 0 localhost:smtp *:* LISTEN
tcp 0 0 *:59482 *:* LISTEN

13. Displaying Kernel IP routing

Display Kernel IP routing table with netstat and route command.

# netstat -r

Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
192.168.0.0 * 255.255.255.0 U 0 0 0 eth0
link-local * 255.255.0.0 U 0 0 0 eth0
default 192.168.0.1 0.0.0.0 UG 0 0 0 eth0

14. Showing Network Interface Transactions

Showing network interface packet transactions including both transferring and receiving packets with MTU size.

# netstat -i

Kernel Interface table
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0 1500 0 4459 0 0 0 4057 0 0 0 BMRU
lo 16436 0 8 0 0 0 8 0 0 0 LRU

15. Showing Kernel Interface Table

Showing Kernel interface table, similar to ifconfig command.

# netstat -ie

Kernel Interface table
eth0 Link encap:Ethernet HWaddr 00:0C:29:B4:DA:21
 inet addr:192.168.0.2 Bcast:192.168.0.255 Mask:255.255.255.0
 inet6 addr: fe80::20c:29ff:feb4:da21/64 Scope:Link
 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
 RX packets:4486 errors:0 dropped:0 overruns:0 frame:0
 TX packets:4077 errors:0 dropped:0 overruns:0 carrier:0
 collisions:0 txqueuelen:1000
 RX bytes:2720253 (2.5 MiB) TX bytes:1161745 (1.1 MiB)
 Interrupt:18 Base address:0x2000

lo Link encap:Local Loopback
 inet addr:127.0.0.1 Mask:255.0.0.0
 inet6 addr: ::1/128 Scope:Host
 UP LOOPBACK RUNNING MTU:16436 Metric:1
 RX packets:8 errors:0 dropped:0 overruns:0 frame:0
 TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
 collisions:0 txqueuelen:0
 RX bytes:480 (480.0 b) TX bytes:480 (480.0 b)

16. Displaying IPv4 and IPv6 Information

Displays multicast group membership information for both IPv4 and IPv6.

# netstat -g

IPv6/IPv4 Group Memberships
Interface RefCnt Group
--------------- ------ ---------------------
lo 1 all-systems.mcast.net
eth0 1 224.0.0.251
eth0 1 all-systems.mcast.net
lo 1 ff02::1
eth0 1 ff02::202
eth0 1 ff02::1:ffb4:da21
eth0 1 ff02::1

17. Print Netstat Information Continuously

To get netstat information every few seconds, then use the following command, it will print netstat information continuously, say every few seconds.

# netstat -c

Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 tecmint.com:http sg2nlhg007.shr.prod.s:36944 TIME_WAIT
tcp 0 0 tecmint.com:http sg2nlhg010.shr.prod.s:42110 TIME_WAIT
tcp 0 132 tecmint.com:ssh 115.113.134.3.static-:64662 ESTABLISHED
tcp 0 0 tecmint.com:http crawl-66-249-71-240.g:41166 TIME_WAIT
tcp 0 0 localhost.localdomain:54823 localhost.localdomain:smtp TIME_WAIT
tcp 0 0 localhost.localdomain:54822 localhost.localdomain:smtp TIME_WAIT
tcp 0 0 tecmint.com:http sg2nlhg010.shr.prod.s:42091 TIME_WAIT
tcp 0 0 tecmint.com:http sg2nlhg007.shr.prod.s:36998 TIME_WAIT

18. Finding non-supportive Address

Finding un-configured address families with some useful information.

# netstat --verbose

netstat: no support for `AF IPX' on this system.
netstat: no support for `AF AX25' on this system.
netstat: no support for `AF X25' on this system.
netstat: no support for `AF NETROM' on this system.

19. Finding Listening Programs

Find out how many listening programs running on a port.

# netstat -ap | grep http

tcp 0 0 *:http *:* LISTEN 9056/httpd
tcp 0 0 *:https *:* LISTEN 9056/httpd
tcp 0 0 tecmint.com:http sg2nlhg008.shr.prod.s:35248 TIME_WAIT -
tcp 0 0 tecmint.com:http sg2nlhg007.shr.prod.s:57783 TIME_WAIT -
tcp 0 0 tecmint.com:http sg2nlhg007.shr.prod.s:57769 TIME_WAIT -
tcp 0 0 tecmint.com:http sg2nlhg008.shr.prod.s:35270 TIME_WAIT -
tcp 0 0 tecmint.com:http sg2nlhg009.shr.prod.s:41637 TIME_WAIT -
tcp 0 0 tecmint.com:http sg2nlhg009.shr.prod.s:41614 TIME_WAIT -
unix 2 [ ] STREAM CONNECTED 88586726 10394/httpd

20. Displaying RAW Network Statistics

# netstat --statistics --raw

Ip:
 62175683 total packets received
 52970 with invalid addresses
 0 forwarded
Icmp:
 875519 ICMP messages received
 destination unreachable: 901671
 echo request: 8
 echo replies: 16253
IcmpMsg:
 InType0: 83
IpExt:
 InMcastPkts: 117

That’s it, If you are looking for more information and options about the netstat command, refer to netstat manual docs or use the man netstat command to know all the information.

If we’ve missed anything in the list, please inform us using our comment section below. So, we could keep updating this list based on your comments.

If this article helped, share it with someone on your team.
TecMint Weekly Newsletter
Get the Learn Linux 7 Days Crash Course free when you join 34,000+ Linux professionals reading every Thursday.
Check your email for a magic link to get started.
Something went wrong. Please try again.
☕
TecMint has been free for 14 years. Help keep it that way.
Google AI Overviews and tools like ChatGPT have cut into search traffic for independent tech sites like TecMint. Running this site costs over $2,000 every month for hosting, infrastructure, and paying authors to keep the content accurate and tested.

If this article helped you solve a problem, consider buying a coffee. It helps keep TecMint free, supports the authors, and keeps the project going.
☕ Buy Me a Coffee
Ravi Saive
I'm Ravi Saive, an award-winning entrepreneur and founder of several successful 5-figure online businesses, including TecMint.com, GeeksMint.com, UbuntuMint.com, and the premium learning hub Pro.Tecmint.com.

Each tutorial at TecMint is created by a team of experienced Linux system administrators so that it meets our high-quality standards.

18 Comments

Leave a Reply

  1. Hi, This is Bala,

    This article is very help to us, but one thing netstat command is used to display the information only or we can able to edit the network settings?

    Here you will mentioning display the information only, if i want to edit the some TCP/UDP port means how can i do this?

    Reply

    • @Bala,

      The command netstat is used to display network related information only, to configure network check our articles at tecmint.com.

      Reply

  2. Can I take this data for 1 hr. For example I want dump or data of this command from 1 PM to 2 PM.
    Please suggest.

    Reply

  3. is there a way of generating logs reports of proxy server like sarg , squidAnalyzer. there has major drawback , the url link not generate accurates,

    i want a software tools or hardware tools , for generating accurate url link of client or user of Network.

    but possible in Linux

    Reply

    • @saurav

      We’ll have to check out such a tool. We hope you can wait a little as we try to find one.

      Reply

  4. What is the best way to go about finding all ports being used by MySQL for clustering purposes?

    I am on Linux platform with MySQL NDB 5.7. I am trying to monitor all traffic related to MySQL clustering – between data nodes, management node and sql nodes. To that end, I used netstat to list all open ports listening on my machine before starting MySQL cluster.

    Then, I started MySQL cluster and ran netstat again. I assumed that the ports that were listening the second time around, but not the first time, were related to MySQL clustering.

    But there are two problems with this. First, there could be ports opened by other processes between the two netstat runs. Second, MySQL might open other ports after I ran the netstat command the second time.

    What is the best way to go about finding all ports being used by MySQL for clustering purposes?

    I believe ephemeral ports are picked dynamically, so perhaps if I knew all the MySQL clustering related processes that would be running, I can figure out every port that they are using. Pointers will be very welcome.

    Reply

    • @Muhammad

      Try to use:

      netstat -tlnpl

      This command will indicate the port number and process ID(PID)/program name as well.

      Reply

  5. I also use netstat-tulpn.

    Reply

  6. Thanks a lot for the article. Keep up the good work.

    Reply

  7. see if you can map HP OVPM charts data points to unix commands results data points.

    Reply

  9. In my network I’ve set three IP range. All are reachable, but one IP is reachable. I want to refresh port, what command can I use?

    Reply

  10. Thank you so much.

    Reply

  12. How about netstat -M?

    Reply

  13. If you want to view active ports and running processes for them, use:
    netstat -tulpn

    Reply

  14. Looks great. Anyone got a quick combo of shell commands to figure out the current rate of throughput (bandwidth usage) over an interface? e.g. X mbit/s or Xmbit/10seconds etc. A few commands output the amount in bytes that have been used since the interface was up…

    Reply

    • to achieve this, you may want to use a tool like ‘iftop’, for example:

      ## bits
      # iftop -nNP -i

      ## bytes
      # iftop -NP -i -B

      Reply

Got Something to Say? Join the Discussion... Cancel reply

Free Course
Get a free Linux course before you go.
Subscribe to TecMint Weekly and get the Learn Linux 7 Days Crash Course free. Read by 34,000+ Linux professionals every Thursday.
Check your email for a magic link to get started.