netstat – network statistics
netstat displays network connections, routing tables, and interface statistics. On modern Linux, ss is the preferred replacement.
Synopsis
netstat [OPTIONS]
Common Options
| Option | Description |
|---|---|
-t | TCP connections |
-u | UDP connections |
-l | Listening sockets only |
-n | Numeric addresses (don’t resolve) |
-p | Show process using socket |
-a | All connections |
-r | Routing table |
-i | Interface statistics |
-s | Protocol statistics |
Examples
Show all listening ports
$ netstat -tlnp
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1234/sshd
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 5678/nginx
All connections (TCP and UDP)
$ netstat -tunap
Show routing table
$ netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
Interface statistics
$ netstat -i
Kernel Interface table
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0 1500 0 1234567 0 0 0 987654 0 0 0 BMRU
lo 65536 0 12345 0 0 0 12345 0 0 0 LRU
Protocol statistics
$ netstat -s
Find process on port
$ netstat -tlnp | grep :80
$ sudo netstat -tlnp | grep :443
Common Patterns
Check if port is in use
$ netstat -tln | grep :8080
Count connections by state
$ netstat -tan | awk '{print $6}' | sort | uniq -c
Watch connections in real-time
$ watch -n 1 'netstat -tun | wc -l'
Modern Alternative: ss
ss is faster and more feature-rich:
$ ss -tlnp # Same as netstat -tlnp
$ ss -s # Socket statistics
$ ss state established # Filter by state
Tips
- Use sudo: Need root to see process names
- Use -n: Faster (skips DNS resolution)
- Use ss instead: On modern Linux, ss is preferred
- macOS differs: Some options vary, use
lsof -iinstead
See Also
Related Commands
- ss — Modern socket statistics (preferred)
- lsof — List open files/sockets
- ip — Modern network configuration
