Linux netstat Command Guide: Check Ports, Connections, and Stats
The netstat command (short for network statistics) is a classic Linux utility used to inspect network connections, analyze socket activity, and troubleshoot networking issues.
Although newer tools exist, netstat remains widely used for quick diagnostics and legacy system administration.
⚙️ 1. Installing netstat #
netstat is included in the net-tools package. If it’s missing on your system, install it using:
sudo apt install net-tools # Debian / Ubuntu
sudo yum install net-tools # CentOS / RHEL
🔍 2. Common Usage Examples #
View Network Connections #
| Command | Description |
|---|---|
netstat -a |
Show all connections and listening ports |
netstat -l |
Show only listening ports |
netstat -t |
Display TCP connections |
netstat -u |
Display UDP connections |
netstat -an |
Show numeric addresses (faster, no DNS lookup) |
netstat -p |
Show PID and process name |
System & Interface Monitoring #
-
Routing Table
netstat -r -
Network Interfaces Statistics
netstat -i -
Continuous Monitoring (Live Refresh)
netstat -c
The Most Useful Command (All-in-One) #
netstat -tunlp
Option breakdown:
-t→ TCP connections-u→ UDP connections-n→ Numeric output (no DNS resolution)-l→ Listening ports-p→ Process ID and name
👉 This is the go-to command for checking which services are running and which ports are open.
📊 3. Understanding netstat Output #
When running netstat, you’ll encounter several key fields:
-
Proto Protocol used (TCP or UDP)
-
Recv-Q Data waiting to be read by the local application
-
Send-Q Data waiting to be sent to the remote host
-
Local Address Local IP address and port
-
Foreign Address Remote IP address and port
-
State Connection state (e.g.,
LISTEN,ESTABLISHED,TIME_WAIT) -
PID/Program name Process associated with the connection
Understanding these fields is essential for diagnosing network bottlenecks and connection issues.
⚡ 4. netstat vs ss: Modern Alternative #
While netstat is still useful, modern Linux systems recommend the ss command from the iproute2 package.
Why use ss?
#
- Faster execution
- More detailed socket information
- Better suited for high-performance environments
Example Equivalent: #
ss -tunlp
Despite this, netstat remains valuable for:
- Legacy systems
- Quick troubleshooting
- Familiar workflows
✅ Summary #
The netstat command is a reliable and versatile tool for:
- Monitoring active connections
- Checking open ports
- Inspecting routing tables
- Troubleshooting network issues
Even as newer tools like ss gain popularity, mastering netstat ensures you’re well-equipped to handle both modern and legacy Linux environments.