All netstat commands for Linux network management explained with examples

This article is all about netstat commands which are used for the Linux operating system network management. Here netstat is the abbreviation of network statistics. As the name suggests netstat commands will show all the network statistics of Linux operating systems used in our computer. In another word, we can say that netstat is the command-line tool which is used for monitoring all incoming and outgoing network connections and it is also used for viewing interface statistics, routing tables, multicast membership and masquerade connections in Linux OS.

The netstat command tool is available for all the Unix like operating systems such as Coherent, GNU, MINIX, Android, Mac OS, etc. With this, it is also available on the  Windows Operating systems. Netstat tool is the network service debugging tool which tells us about which ports are open and how many ports are open and how many ports are closed on our server. Netstat is widely used for network troubleshooting and performance measurement.

Now in this article, we will describe all the netstat commands with their example and what is the use of these commands and where these netstat commands are used in Linux OS.

featured image netstat command linux

Also Read: – Learn how to lock and unlock a user account in Linux operating system by using different methods

How to install netstat command in Linux operating system

The package that contains netstat command is called net-tools. On modern systems netstat comes pre-installed if you do not have pre-installed net-tools on your system. Then use given below commands according to your Linux distribution.

# yum install net-tools     [On CentOS/RHEL]
# apt install net-tools     [On Debian/Ubuntu]
# zypper install net-tools  [On OpenSuse]
# pacman -S netstat-nat     [On Arch Linux]

Usage of netstat commands

1.  List all ports connections using netstat command

To list all ports connection in Linux OS use netstat -a command, with the help of this command we can list out all the current connections from all the different protocols like TCP, UDP, and Unix sockets. This command also shows which ports are listening and not listening ports. An output of netstat -a command is shown below.

[email protected]:~# netstat -a
 Active Internet connections (servers and established)
 Proto Recv-Q Send-Q Local Address Foreign Address State
 tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN
 tcp 0 64 kali:ssh Autoboat:48462 ESTABLISHED
 tcp6 0 0 [::]:ssh [::]:* LISTEN
 udp 0 0 0.0.0.0:bootpc 0.0.0.0:*
 raw6 0 0 [::]:ipv6-icmp [::]:* 7
 Active UNIX domain sockets (servers and established)
 Proto RefCnt Flags Type State I-Node Path
 unix 2 [ ACC ] STREAM LISTENING 11783 /var/run/dbus/system_bus_socket
 unix 2 [ ACC ] STREAM LISTENING 11786 /run/uuidd/request
 unix 2 [ ACC ] STREAM LISTENING 11789 /var/run/pcscd/pcscd.comm
 unix 2 [ ACC ] STREAM LISTENING 17945 /tmp/ssh-n9IQmeJHgkfc/agent.803
 unix 2 [ ACC ] STREAM LISTENING 14311 @/tmp/.X11-unix/X0
 unix 2 [ ACC ] STREAM LISTENING 17835 @/tmp/.X11-unix/X1
 unix 2 [ ACC ] STREAM LISTENING 13872 /run/NetworkManager/private-dhcp
 unix 2 [ ACC ] STREAM LISTENING 17776 @/tmp/dbus-2NjAmqie
 unix 2 [ ACC ] STREAM LISTENING 13777 @/tmp/dbus-jg0tTyHR
 unix 2 [ ACC ] STREAM LISTENING 18181 @/tmp/.ICE-unix/803
 unix 2 [ ACC ] STREAM LISTENING 13773 @/tmp/dbus-sEMxUptb
 unix 2 [ ACC ] STREAM LISTENING 9815 /run/lvm/lvmetad.socket
 unix 2 [ ACC ] STREAM LISTENING 18267 /run/user/0/keyring/pkcs11
 unix 2 [ ACC ] STREAM LISTENING 18274 /run/user/0/keyring/ssh
 unix 2 [ ACC ] STREAM LISTENING 17768 /run/user/0/keyring/control
 unix 2 [ ACC ] STREAM LISTENING 14758 @/tmp/.ICE-unix/488
 unix 15 [ ] DGRAM 9858 /run/systemd/journal/dev-log
 unix 2 [ ACC ] STREAM LISTENING 17836 /tmp/.X11-unix/X1
 unix 2 [ ] DGRAM 14215 /run/user/131/systemd/notify
 unix 2 [ ACC ] STREAM LISTENING 18182 /tmp/.ICE-unix/803
 unix 3 [ ] STREAM CONNECTED 20277 /run/user/0/bus
 unix 3 [ ] STREAM CONNECTED 19721
 unix 3 [ ] STREAM CONNECTED 19135 @/tmp/.X11-unix/X1
 unix 3 [ ] STREAM CONNECTED 16428
 unix 3 [ ] STREAM CONNECTED 16381
 unix 3 [ ] STREAM CONNECTED 20058
 unix 3 [ ] STREAM CONNECTED 19849 /run/user/0/bus
 unix 3 [ ] STREAM CONNECTED 19745 /run/user/0/bus
 unix 3 [ ] STREAM CONNECTED 19420
 unix 3 [ ] STREAM CONNECTED 18921
 unix 3 [ ] STREAM CONNECTED 18744 /run/user/0/bus
 unix 3 [ ] STREAM CONNECTED 16527
 unix 3 [ ] STREAM CONNECTED 14934
 unix 3 [ ] STREAM CONNECTED 20056
 unix 3 [ ] STREAM CONNECTED 18359 /run/systemd/journal/stdout
 unix 3 [ ] STREAM CONNECTED 16616 /run/systemd/journal/stdout
 unix 3 [ ] STREAM CONNECTED 16437 @/tmp/dbus-4iCsDoVgCr
 unix 3 [ ] STREAM CONNECTED 14400
 unix 3 [ ] STREAM CONNECTED 16445
 [email protected]:~#

2.  List only TCP ports connections using netstat command

To list only TCP ports connections use netstat -at command. Here TCP stands for Transmission Control Protocol, which is used for sending data directly from one computer to another computer for which both computers should be connected to each other until transfer not complete. An output of netstat -at command is shown below.

[email protected]:~# netstat -at
 Active Internet connections (servers and established)
 Proto Recv-Q Send-Q Local Address Foreign Address State
 tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN
 tcp 0 64 kali:ssh Autoboat:48462 ESTABLISHED
 tcp6 0 0 [::]:ssh [::]:* LISTEN

3.  List only UDP ports connections using netstat command

To list only UDP ports connections use netstat -au command. Here UDP port stands for User Datagram Protocol, and these ports are used for sending data package information in a little package and release these package into the network with the hopes that it will get to the right place. An output of netstat -au command is shown below.

[email protected]:~# netstat -au
 Active Internet connections (servers and established)
 Proto Recv-Q Send-Q Local Address Foreign Address State
 udp 0 0 0.0.0.0:bootpc 0.0.0.0:*

4. Show statistics by the protocol using netstat command

To display statistics by protocol use netstat -s command in Linux terminal. This command displays the statistics for all the TCP, UDP, IP, and ICMP protocols. An output of netstat -s command is shown below.

[email protected]:~# netstat -s
 Ip:
 Forwarding: 2
 3454 total packets received
 5 with invalid addresses
 0 forwarded
 0 incoming packets discarded
 3449 incoming packets delivered
 4838 requests sent out
 41 dropped because of missing route
 Icmp:
 0 ICMP messages received
 0 input ICMP message failed
 ICMP input histogram:
 0 ICMP messages sent
 0 ICMP messages failed
 ICMP output histogram:
 Tcp:
 10 active connection openings
 1 passive connection openings
 8 failed connection attempts
 1 connection resets received
 1 connections established
 3388 segments received
 4829 segments sent out
 0 segments retransmitted
 0 bad segments received
 11 resets sent
 Udp:
 33 packets received
 0 packets to unknown port received
 0 packet receive errors
 38 packets sent
 0 receive buffer errors
 0 send buffer errors
 IgnoredMulti: 30
 UdpLite:
 TcpExt:
 4 delayed acks sent
 2 delayed acks further delayed because of locked socket
 Quick ack mode was activated 2 times
 824 packet headers predicted
 1823 acknowledgments not containing data payload received
 555 predicted acknowledgments
 Detected reordering 1 times using SACK
 TCPDSACKOldSent: 2
 TCPDSACKRecv: 1
 1 connections reset due to early user close
 TCPDSACKIgnoredNoUndo: 1
 TCPSackShiftFallback: 1
 TCPRcvCoalesce: 778
 TCPOFOQueue: 2
 TCPAutoCorking: 5
 TCPOrigDataSent: 4694
 TCPHystartTrainDetect: 1
 TCPHystartTrainCwnd: 16
 IpExt:
 InMcastPkts: 6
 InBcastPkts: 32
 OutBcastPkts: 6
 InOctets: 1016797
 OutOctets: 729688
 InMcastOctets: 192
 InBcastOctets: 2836
 OutBcastOctets: 284
 InNoECTPkts: 3868

5. Show statistics by TCP protocol using netstat command

To show statistics for only TCP protocol use netstat -st command in Linux. This command filters the other ports and displays statistics for TCP protocol. An output of netstat -st command is shown below.

[email protected]:~# netstat -st
 Tcp:
 10 active connection openings
 1 passive connection openings
 8 failed connection attempts
 1 connection resets received
 1 connections established
 3430 segments received
 4900 segments sent out
 0 segments retransmitted
 0 bad segments received
 11 resets sent
 UdpLite:
 TcpExt:
 4 delayed acks sent
 2 delayed acks further delayed because of locked socket
 Quick ack mode was activated 2 times
 824 packet headers predicted
 1840 acknowledgments not containing data payload received
 561 predicted acknowledgments
 Detected reordering 1 times using SACK
 TCPDSACKOldSent: 2
 TCPDSACKRecv: 1
 1 connections reset due to early user close
 TCPDSACKIgnoredNoUndo: 1
 TCPSackShiftFallback: 1
 TCPRcvCoalesce: 778
 TCPOFOQueue: 2
 TCPAutoCorking: 8
 TCPOrigDataSent: 4735
 TCPHystartTrainDetect: 1
 TCPHystartTrainCwnd: 16
 IpExt:
 InMcastPkts: 6
 InBcastPkts: 32
 OutBcastPkts: 6
 InOctets: 1018271
 OutOctets: 734704
 InMcastOctets: 192
 InBcastOctets: 2836
 OutBcastOctets: 284
 InNoECTPkts: 3895

6. Show statistics by UDP protocol using netstat command

To show statistics by UDP protocol use netstat -su command in Linux OS. This command will filter the other ports and it will display only UDP protocol statistics. An output of netstat -su command is shown below.

[email protected]:~# netstat -su
 Udp:
 33 packets received
 0 packets to unknown port received
 0 packet receive errors
 38 packets sent
 0 receive buffer errors
 0 send buffer errors
 IgnoredMulti: 30
 UdpLite:
 IpExt:
 InMcastPkts: 7
 InBcastPkts: 32
 OutBcastPkts: 6
 InOctets: 1019067
 OutOctets: 736576
 InMcastOctets: 224
 InBcastOctets: 2836
 OutBcastOctets: 284
 InNoECTPkts: 3906

7. List all active listening ports connections using netstat command

To list all active listening ports connections use netstat -l command in Linux terminal. An output of netstat -l command is shown below.

[email protected]:~# netstat -l
 Active Internet connections (only servers)
 Proto Recv-Q Send-Q Local Address Foreign Address State
 tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN
 tcp6 0 0 [::]:ssh [::]:* LISTEN
 udp 0 0 0.0.0.0:bootpc 0.0.0.0:*
 raw6 0 0 [::]:ipv6-icmp [::]:* 7
 Active UNIX domain sockets (only servers)
 Proto RefCnt Flags Type State I-Node Path
 unix 2 [ ACC ] STREAM LISTENING 11783 /var/run/dbus/system_bus_socket
 unix 2 [ ACC ] STREAM LISTENING 11786 /run/uuidd/request
 unix 2 [ ACC ] STREAM LISTENING 11789 /var/run/pcscd/pcscd.comm
 unix 2 [ ACC ] STREAM LISTENING 17945 /tmp/ssh-n9IQmeJHgkfc/agent.803
 unix 2 [ ACC ] STREAM LISTENING 14311 @/tmp/.X11-unix/X0
 unix 2 [ ACC ] STREAM LISTENING 17835 @/tmp/.X11-unix/X1
 unix 2 [ ACC ] STREAM LISTENING 13872 /run/NetworkManager/private-dhcp
 unix 2 [ ACC ] STREAM LISTENING 17776 @/tmp/dbus-2NjAmqie
 unix 2 [ ACC ] STREAM LISTENING 13777 @/tmp/dbus-jg0tTyHR
 unix 2 [ ACC ] STREAM LISTENING 18181 @/tmp/.ICE-unix/803
 unix 2 [ ACC ] STREAM LISTENING 13773 @/tmp/dbus-sEMxUptb
 unix 2 [ ACC ] STREAM LISTENING 9815 /run/lvm/lvmetad.socket
 unix 2 [ ACC ] STREAM LISTENING 18267 /run/user/0/keyring/pkcs11
 unix 2 [ ACC ] STREAM LISTENING 18274 /run/user/0/keyring/ssh
 unix 2 [ ACC ] STREAM LISTENING 17768 /run/user/0/keyring/control
 unix 2 [ ACC ] STREAM LISTENING 14758 @/tmp/.ICE-unix/488
 unix 2 [ ACC ] STREAM LISTENING 17836 /tmp/.X11-unix/X1
 unix 2 [ ACC ] STREAM LISTENING 18182 /tmp/.ICE-unix/803
 unix 2 [ ACC ] STREAM LISTENING 14312 /tmp/.X11-unix/X0
 unix 2 [ ACC ] STREAM LISTENING 14759 /tmp/.ICE-unix/488
 unix 2 [ ACC ] STREAM LISTENING 14219 /run/user/131/systemd/private
 unix 2 [ ACC ] STREAM LISTENING 14224 /run/user/131/gnupg/S.gpg-agent.ssh
 unix 2 [ ACC ] STREAM LISTENING 14227 /run/user/131/gnupg/S.gpg-agent.browser
 unix 2 [ ACC ] STREAM LISTENING 14229 /run/user/131/gnupg/S.gpg-agent.extra
 unix 2 [ ACC ] STREAM LISTENING 14231 /run/user/131/pulse/native
 unix 2 [ ACC ] STREAM LISTENING 14234 /run/user/131/bus
 unix 2 [ ACC ] STREAM LISTENING 14236 /run/user/131/gnupg/S.dirmngr
 unix 2 [ ACC ] STREAM LISTENING 14238 /run/user/131/gnupg/S.gpg-agent
 unix 2 [ ACC ] STREAM LISTENING 13776 @/tmp/dbus-56fKsoHw
 unix 2 [ ACC ] STREAM LISTENING 17588 /run/user/0/systemd/private
 unix 2 [ ACC ] STREAM LISTENING 13774 @/tmp/dbus-HyNbdF2j
 unix 2 [ ACC ] STREAM LISTENING 17593 /run/user/0/gnupg/S.dirmngr
 unix 2 [ ACC ] STREAM LISTENING 17596 /run/user/0/gnupg/S.gpg-agent.ssh
 unix 2 [ ACC ] STREAM LISTENING 17598 /run/user/0/bus
 unix 2 [ ACC ] STREAM LISTENING 17600 /run/user/0/pulse/native
 unix 2 [ ACC ] STREAM LISTENING 17603 /run/user/0/gnupg/S.gpg-agent.extra
 unix 2 [ ACC ] STREAM LISTENING 17605 /run/user/0/gnupg/S.gpg-agent
 unix 2 [ ACC ] STREAM LISTENING 17607 /run/user/0/gnupg/S.gpg-agent.browser
 unix 2 [ ACC ] STREAM LISTENING 17775 @/tmp/dbus-sN2K71Ub
 unix 2 [ ACC ] STREAM LISTENING 9676 /run/systemd/private
 unix 2 [ ACC ] STREAM LISTENING 9686 /run/systemd/fsck.progress
 unix 2 [ ACC ] STREAM LISTENING 9689 /run/lvm/lvmpolld.socket
 unix 2 [ ACC ] SEQPACKET LISTENING 9695 /run/udev/control
 unix 2 [ ACC ] STREAM LISTENING 9697 /run/systemd/journal/stdout
 unix 2 [ ACC ] STREAM LISTENING 14588 @/tmp/dbus-4iCsDoVgCr
 unix 2 [ ACC ] STREAM LISTENING 18128 @/tmp/dbus-gaI0XPw8nv

Do you Know: – Some Fascinating Facts About Windows and its History

8.  List all the TCP listening ports using netstat command

To list all the TCP listening ports use netstat -lt command in your PC. This command will filter the other ports and it will display only TCP listening ports on the screen. An output of netstat -lt command is shown below.

[email protected]:~# netstat -lt
 Active Internet connections (only servers)
 Proto Recv-Q Send-Q Local Address Foreign Address State
 tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN
 tcp6 0 0 [::]:ssh [::]:* LISTEN

9. List all the UDP listening ports using netstat command

To list all active UDP listening ports use netstat -lu command on Linux OS. This command will filter the other ports and it will display only UDP listening ports on the screen. An output of netstat -lu command is shown below.

[email protected]:~# netstat -lu
 Active Internet connections (only servers)
 Proto Recv-Q Send-Q Local Address Foreign Address State
 udp 0 0 0.0.0.0:bootpc 0.0.0.0:*

10. List all UNIX listening ports using netstat command

To list all the active UNIX listening ports use netstat -lx command in Linux OS. This command will filter the other ports and it will display only UNIX listening ports on the screen. An output of netstat -lx command is shown below.

[email protected]:~# netstat -lx
 Active UNIX domain sockets (only servers)
 Proto RefCnt Flags Type State I-Node Path
 unix 2 [ ACC ] STREAM LISTENING 11783 /var/run/dbus/system_bus_socket
 unix 2 [ ACC ] STREAM LISTENING 11786 /run/uuidd/request
 unix 2 [ ACC ] STREAM LISTENING 11789 /var/run/pcscd/pcscd.comm
 unix 2 [ ACC ] STREAM LISTENING 17945 /tmp/ssh-n9IQmeJHgkfc/agent.803
 unix 2 [ ACC ] STREAM LISTENING 14311 @/tmp/.X11-unix/X0
 unix 2 [ ACC ] STREAM LISTENING 17835 @/tmp/.X11-unix/X1
 unix 2 [ ACC ] STREAM LISTENING 13872 /run/NetworkManager/private-dhcp
 unix 2 [ ACC ] STREAM LISTENING 17776 @/tmp/dbus-2NjAmqie
 unix 2 [ ACC ] STREAM LISTENING 13777 @/tmp/dbus-jg0tTyHR
 unix 2 [ ACC ] STREAM LISTENING 18181 @/tmp/.ICE-unix/803
 unix 2 [ ACC ] STREAM LISTENING 13773 @/tmp/dbus-sEMxUptb
 unix 2 [ ACC ] STREAM LISTENING 9815 /run/lvm/lvmetad.socket
 unix 2 [ ACC ] STREAM LISTENING 18267 /run/user/0/keyring/pkcs11
 unix 2 [ ACC ] STREAM LISTENING 18274 /run/user/0/keyring/ssh
 unix 2 [ ACC ] STREAM LISTENING 17768 /run/user/0/keyring/control
 unix 2 [ ACC ] STREAM LISTENING 14758 @/tmp/.ICE-unix/488
 unix 2 [ ACC ] STREAM LISTENING 17836 /tmp/.X11-unix/X1
 unix 2 [ ACC ] STREAM LISTENING 18182 /tmp/.ICE-unix/803
 unix 2 [ ACC ] STREAM LISTENING 14312 /tmp/.X11-unix/X0
 unix 2 [ ACC ] STREAM LISTENING 14759 /tmp/.ICE-unix/488
 unix 2 [ ACC ] STREAM LISTENING 14219 /run/user/131/systemd/private
 unix 2 [ ACC ] STREAM LISTENING 14224 /run/user/131/gnupg/S.gpg-agent.ssh
 unix 2 [ ACC ] STREAM LISTENING 14227 /run/user/131/gnupg/S.gpg-agent.browser
 unix 2 [ ACC ] STREAM LISTENING 14229 /run/user/131/gnupg/S.gpg-agent.extra
 unix 2 [ ACC ] STREAM LISTENING 14231 /run/user/131/pulse/native
 unix 2 [ ACC ] STREAM LISTENING 14234 /run/user/131/bus
 unix 2 [ ACC ] STREAM LISTENING 14236 /run/user/131/gnupg/S.dirmngr
 unix 2 [ ACC ] STREAM LISTENING 14238 /run/user/131/gnupg/S.gpg-agent
 unix 2 [ ACC ] STREAM LISTENING 13776 @/tmp/dbus-56fKsoHw
 unix 2 [ ACC ] STREAM LISTENING 17588 /run/user/0/systemd/private
 unix 2 [ ACC ] STREAM LISTENING 13774 @/tmp/dbus-HyNbdF2j
 unix 2 [ ACC ] STREAM LISTENING 17593 /run/user/0/gnupg/S.dirmngr
 unix 2 [ ACC ] STREAM LISTENING 17596 /run/user/0/gnupg/S.gpg-agent.ssh
 unix 2 [ ACC ] STREAM LISTENING 17598 /run/user/0/bus
 unix 2 [ ACC ] STREAM LISTENING 17600 /run/user/0/pulse/native
 unix 2 [ ACC ] STREAM LISTENING 17603 /run/user/0/gnupg/S.gpg-agent.extra
 unix 2 [ ACC ] STREAM LISTENING 17605 /run/user/0/gnupg/S.gpg-agent
 unix 2 [ ACC ] STREAM LISTENING 17607 /run/user/0/gnupg/S.gpg-agent.browser
 unix 2 [ ACC ] STREAM LISTENING 17775 @/tmp/dbus-sN2K71Ub
 unix 2 [ ACC ] STREAM LISTENING 9676 /run/systemd/private
 unix 2 [ ACC ] STREAM LISTENING 9686 /run/systemd/fsck.progress
 unix 2 [ ACC ] STREAM LISTENING 9689 /run/lvm/lvmpolld.socket
 unix 2 [ ACC ] SEQPACKET LISTENING 9695 /run/udev/control
 unix 2 [ ACC ] STREAM LISTENING 9697 /run/systemd/journal/stdout
 unix 2 [ ACC ] STREAM LISTENING 14588 @/tmp/dbus-4iCsDoVgCr
 unix 2 [ ACC ] STREAM LISTENING 18128 @/tmp/dbus-gaI0XPw8nv

11. Find non-supportive address in the system using netstat command

To find a non-supportive address in the system use netstat –verbose command in Linux OS. This command shows us about un-configured address families with useful information. An output of netstat –verbose command is shown below.

[email protected]:~# netstat --verbose
 Active Internet connections (w/o servers)
 Proto Recv-Q Send-Q Local Address Foreign Address State
 tcp 0 64 kali:ssh Autoboat:48462 ESTABLISHED
 netstat: no support for `AF INET (sctp)' on this system.
 netstat: no support for `AF INET (sctp)' on this system.
 Active UNIX domain sockets (w/o servers)
 Proto RefCnt Flags Type State I-Node Path
 unix 15 [ ] DGRAM 9858 /run/systemd/journal/dev-log
 unix 2 [ ] DGRAM 14215 /run/user/131/systemd/notify
 unix 2 [ ] DGRAM 17584 /run/user/0/systemd/notify
 unix 3 [ ] DGRAM 9672 /run/systemd/notify
 unix 2 [ ] DGRAM 9682 /run/systemd/journal/syslog
 unix 8 [ ] DGRAM 9699 /run/systemd/journal/socket
 unix 3 [ ] STREAM CONNECTED 20053 @/tmp/.X11-unix/X1
 unix 3 [ ] STREAM CONNECTED 16549 /run/user/131/bus
 unix 3 [ ] STREAM CONNECTED 16439 /run/user/131/bus
 unix 3 [ ] STREAM CONNECTED 12770 /run/systemd/journal/stdout
 unix 3 [ ] STREAM CONNECTED 16441 @/tmp/.X11-unix/X0
 unix 3 [ ] STREAM CONNECTED 14403 /run/user/131/bus
 unix 3 [ ] STREAM CONNECTED 20277 /run/user/0/bus
 unix 3 [ ] STREAM CONNECTED 19721
 unix 3 [ ] STREAM CONNECTED 19135 @/tmp/.X11-unix/X1
 unix 3 [ ] STREAM CONNECTED 16428
 unix 3 [ ] STREAM CONNECTED 16381
 unix 3 [ ] STREAM CONNECTED 20058
 unix 3 [ ] STREAM CONNECTED 19849 /run/user/0/bus
 unix 3 [ ] STREAM CONNECTED 19745 /run/user/0/bus
 unix 3 [ ] STREAM CONNECTED 19420
 netstat: no support for `AF IPX' on this system.
 netstat: no support for `AF AX25' on this system.
 netstat: no support for `AF X25' on this system.
 netstat: no support for `AF NETROM' on this system.
 netstat: no support for `AF ROSE' on this system.

12. Find running the Listening program using netstat command

To find out the number of listening programs running on a port use netstat -ap | grep ssh command. An output of netstat -ap | grep ssh command is shown below.

[email protected]:~# netstat -ap | grep ssh
 tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN 430/sshd
 tcp 0 64 kali:ssh Autoboat:48462 ESTABLISHED 1270/sshd: [email protected]
 tcp6 0 0 [::]:ssh [::]:* LISTEN 430/sshd
 unix 2 [ ACC ] STREAM LISTENING 17945 852/ssh-agent /tmp/ssh-n9IQmeJHgkfc/agent.803
 unix 2 [ ACC ] STREAM LISTENING 18274 791/gnome-keyring-d /run/user/0/keyring/ssh
 unix 2 [ ACC ] STREAM LISTENING 14224 464/systemd /run/user/131/gnupg/S.gpg-agent.ssh
 unix 2 [ ACC ] STREAM LISTENING 17596 774/systemd /run/user/0/gnupg/S.gpg-agent.ssh
 unix 3 [ ] STREAM CONNECTED 13466 430/sshd
 unix 2 [ ] DGRAM 20986 1270/sshd: [email protected]

13. Display RAW network statistics using netstat command

To display RAW network statistics on your Linux OS use netstat –statistics –raw command in your PC. An output of netstat –statistics –raw command is shown below.

[email protected]:~# netstat --statistics --raw
 Ip:
 Forwarding: 2
 3894 total packets received
 5 with invalid addresses
 0 forwarded
 0 incoming packets discarded
 3889 incoming packets delivered
 5406 requests sent out
 41 dropped because of missing route
 Icmp:
 0 ICMP messages received
 0 input ICMP message failed
 ICMP input histogram:
 0 ICMP messages sent
 0 ICMP messages failed
 ICMP output histogram:
 UdpLite:
 IpExt:
 InMcastPkts: 14
 InBcastPkts: 35
 OutBcastPkts: 6
 InOctets: 1043203
 OutOctets: 861636
 InMcastOctets: 448
 InBcastOctets: 3070
 OutBcastOctets: 284
 InNoECTPkts: 4308

14. Display service name with PID number using netstat command

To display the service name with their PID number use netstat -tp command in Linux OS based PC. This command will show the PID number with the program name. An output of netstat -tp command is shown below.

[email protected]:~# netstat -tp
 Active Internet connections (w/o servers)
 Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
 tcp 0 64 kali:ssh Autoboat:48462 ESTABLISHED 1270/sshd: [email protected]

15. Display the promiscuous mode using netstat command

To display the promiscuous mode use netstat -ac 5 | grep tcp command. An output of netstat -ac 5 | grep tcp command is shown below.

[email protected]:~# netstat -ac 5 | grep tcp
 tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN
 tcp 0 64 kali:ssh Autoboat:48462 ESTABLISHED
 tcp6 0 0 [::]:ssh [::]:* LISTEN
 tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN
 tcp 0 0 kali:ssh Autoboat:48462 ESTABLISHED
 tcp6 0 0 [::]:ssh [::]:* LISTEN
 tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN
 tcp 0 0 kali:ssh Autoboat:48462 ESTABLISHED

16. Display Kernal IP routing table using netstat command

To display the kernel IP routing table we will use netstat -r command. You can also use netstat -rn command for the same purposes on your system. The output of netstat -r command is shown below.

[email protected]:~# netstat -r
 Kernel IP routing table
 Destination Gateway Genmask Flags MSS Window irtt Iface
 default jiofi.local.htm 0.0.0.0 UG 0 0 0 eth1
 192.168.225.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1

17. Show network interface packet transactions using netstat command

To show network interface packet transactions use netstat -i command. This command will show both sending and receive packets with their MTU size. An output of netstat -i command is shown below.

[email protected]:~# netstat -i
 Kernel Interface table
 Iface MTU RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
 eth0 1500 0 0 0 0 0 0 0 0 BMRU
 eth1 1500 4736 0 0 0 5724 0 0 0 BMRU
 lo 65536 22 0 0 0 22 0 0 0 LRU

18. Show kernel interface table using netstat command

To show kernel interface table use netstat -ie command. This command works similarly as ifconfig command in Linux distributions. The output of netstat -ie command is shown below.

[email protected]:~# netstat -ie
 Kernel Interface table
 eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
 ether 08:00:27:e4:a3:4b txqueuelen 1000 (Ethernet)
 RX packets 0 bytes 0 (0.0 B)
 RX errors 0 dropped 0 overruns 0 frame 0
 TX packets 0 bytes 0 (0.0 B)
 TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
 inet 192.168.225.211 netmask 255.255.255.0 broadcast 192.168.225.255
 inet6 fe80::a00:27ff:fe2b:e840 prefixlen 64 scopeid 0x20<link>
 ether 08:00:27:2b:e8:40 txqueuelen 1000 (Ethernet)
 RX packets 4750 bytes 1156118 (1.1 MiB)
 RX errors 0 dropped 0 overruns 0 frame 0
 TX packets 5732 bytes 982036 (959.0 KiB)
 TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
 inet 127.0.0.1 netmask 255.0.0.0
 inet6 ::1 prefixlen 128 scopeid 0x10<host>
 loop txqueuelen 1000 (Local Loopback)
 RX packets 22 bytes 1194 (1.1 KiB)
 RX errors 0 dropped 0 overruns 0 frame 0
 TX packets 22 bytes 1194 (1.1 KiB)
 TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

19. Display IPv4 and IPv6 group membership information using netstat command

To display multicast group membership information for IPv4 and IPv6 we will use netstat -g command. The output of netstat -g command is shown below.

[email protected]:~# netstat -g
 IPv6/IPv4 Group Memberships
 Interface RefCnt Group
 --------------- ------ ---------------------
 lo 1 all-systems.mcast.net
 eth0 1 all-systems.mcast.net
 eth1 1 all-systems.mcast.net
 lo 1 ip6-allnodes
 lo 1 ff01::1
 eth0 1 ip6-allnodes
 eth0 1 ff01::1
 eth1 1 ff02::1:ff2b:e840
 eth1 1 ip6-allnodes
 eth1 1 ff01::1

20. Display active internet connection continuously using netstat command

To get an active internet connection information for every second we will use netstat -c command. This command will refresh the data every second and display it on the screen. The output of netstat -c command is shown below.

[email protected]:~# netstat -c
 Active Internet connections (w/o servers)
 Proto Recv-Q Send-Q Local Address Foreign Address State
 tcp 0 0 kali:ssh Autoboat:48462 ESTABLISHED
 Active UNIX domain sockets (w/o servers)
 Proto RefCnt Flags Type State I-Node Path
 unix 15 [ ] DGRAM 9858 /run/systemd/journal/dev-log
 unix 2 [ ] DGRAM 14215 /run/user/131/systemd/notify
 unix 2 [ ] DGRAM 17584 /run/user/0/systemd/notify
 unix 3 [ ] DGRAM 9672 /run/systemd/notify
 unix 2 [ ] DGRAM 9682 /run/systemd/journal/syslog
 unix 8 [ ] DGRAM 9699 /run/systemd/journal/socket
 unix 3 [ ] STREAM CONNECTED 20053 @/tmp/.X11-unix/X1
 unix 3 [ ] STREAM CONNECTED 16549 /run/user/131/bus
 unix 3 [ ] STREAM CONNECTED 16439 /run/user/131/bus
 unix 3 [ ] STREAM CONNECTED 12770 /run/systemd/journal/stdout
 unix 3 [ ] STREAM CONNECTED 16441 @/tmp/.X11-unix/X0
 unix 3 [ ] STREAM CONNECTED 14403 /run/user/131/bus
 unix 3 [ ] STREAM CONNECTED 20277 /run/user/0/bus
 unix 3 [ ] STREAM CONNECTED 19721
 unix 3 [ ] STREAM CONNECTED 19135 @/tmp/.X11-unix/X1
 unix 3 [ ] STREAM CONNECTED 16428

21. Disable reverse DNS lookup for faster output using netstat command

To disable reverse DNS lookup for fast output response run netstat -ant command on Linux OS. Reverse DNS lookup is used to find out the hostname of each IP address in the connection and slows down the output. From this command, we can suppress the hostname lookup which will increase the output response rate. An output of netstat -ant command is shown below.

[email protected]:~# netstat -ant
 Active Internet connections (servers and established)
 Proto Recv-Q Send-Q Local Address Foreign Address State
 tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
 tcp 0 64 192.168.225.211:22 192.168.225.131:48462 ESTABLISHED
 tcp6 0 0 :::22 :::* LISTEN

22. Display statistics about active internet connections using netstat command

To display Statistics about active internet connections on a Linux OS then use netstat -natp command on your system. The output of this command is shown below.

[email protected]:~# netstat -natp
 Active Internet connections (servers and established)
 Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
 tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 430/sshd
 tcp 0 288 192.168.225.211:22 192.168.225.131:48462 ESTABLISHED 1270/sshd: [email protected]
 tcp6 0 0 :::22 :::* LISTEN 430/sshd

Do you Know: – How to hack Google?

23. Netstat command for collect statistics about the amount of active connections on a port

For collecting statistics about the number of active connections on a specific port, then use netstat -an | grep :22  | wc -l. Here instead of 22 use your preferred port where you want to calculate the number of active connections on that specific port. The output of this command is shown below.

[email protected]:~# netstat -an |grep :80 | wc -l
 0
 [email protected]:~#
 [email protected]:~# netstat -an |grep :22 | wc -l
 3
 [email protected]:~#

24. Command for read netstat manual docs on your system

You can use the given below command to know more information about netstat command and also read manual docs of netstat command on your system. By using this command you can easily know about all the options of netstat command.

[email protected]:~# man netstat

THAT’S IT

These are the examples of netstat command on Linux distribution. If you want to learn netstat command in detail and want more information about this command then refer netstat manual docs or you can use main netstat command on your Linux OS. If you have any queries regarding this then solved out through the comment section and also follow our blog for further updates.

You may also like...

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: