netstat Command
Intermediate Networking man(1)Print network connections, routing tables, and stats (legacy)
👁 11 views
📅 Updated: Mar 15, 2026
SYNTAX
netstat [OPTION]...
What Does netstat Do?
netstat displays network connections, routing tables, interface statistics, and protocol information. While deprecated in favor of ss, netstat remains widely used and available on most systems.
netstat is commonly used to check which ports are open, what processes are listening, and to verify network connectivity. The most popular usage is netstat -tulnp which shows all listening TCP/UDP ports with process information.
For modern systems, the ss command is the recommended replacement as it is faster and provides more information. However, netstat remains in the net-tools package and is still the familiar choice for many administrators.
netstat is commonly used to check which ports are open, what processes are listening, and to verify network connectivity. The most popular usage is netstat -tulnp which shows all listening TCP/UDP ports with process information.
For modern systems, the ss command is the recommended replacement as it is faster and provides more information. However, netstat remains in the net-tools package and is still the familiar choice for many administrators.
Options & Flags
| Option | Description | Example |
|---|---|---|
| -t | Show TCP connections | netstat -t |
| -u | Show UDP connections | netstat -u |
| -l | Show only listening sockets | netstat -l |
| -n | Show numerical addresses (skip DNS resolution) | netstat -n |
| -p | Show process ID and name | sudo netstat -p |
| -r | Show routing table | netstat -r |
| -i | Show network interface statistics | netstat -i |
| -s | Show protocol statistics | netstat -s |
Practical Examples
#1 Show listening ports
The most common usage — shows all TCP/UDP listening ports with process names.
$ sudo netstat -tulnp
Output:
Proto Local Address State PID/Program
tcp 0.0.0.0:22 LISTEN 1234/sshd
tcp 0.0.0.0:80 LISTEN 5678/nginx
#2 Show all connections
Shows all connections with numerical addresses.
$ netstat -an#3 Show routing table
Displays the kernel routing table with IP addresses (not hostnames).
$ netstat -rn#4 Count connections by state
Shows a summary of connection states (ESTABLISHED, TIME_WAIT, etc.).
$ netstat -ant | awk '{print $6}' | sort | uniq -c | sort -rn
Output:
145 ESTABLISHED\n 23 TIME_WAIT\n 5 LISTEN
#5 Find process using a port
Shows which process is listening on port 80.
$ sudo netstat -tlnp | grep :80
Output:
tcp 0.0.0.0:80 LISTEN 5678/nginx
#6 Interface statistics
Shows packet counts and errors for each network interface.
$ netstat -iTips & Best Practices
Use ss instead: ss is faster and more feature-rich than netstat. Equivalent command: ss -tulnp instead of netstat -tulnp.
Requires sudo for -p: The -p flag (show process names) requires root privileges to see processes owned by other users.
Deprecated command: netstat is deprecated in favor of ss. It may not be installed by default on newer distributions. Install with: apt install net-tools.
Frequently Asked Questions
How do I see which ports are open?
Use sudo netstat -tulnp (or sudo ss -tulnp). This shows all listening TCP/UDP ports with the associated process.
What does netstat -tulnp mean?
-t TCP, -u UDP, -l listening only, -n numerical, -p process names. It is the standard way to check open ports.
What replaced netstat?
The ss command from iproute2 replaced netstat. It is faster and shows more information. Use ss -tulnp instead of netstat -tulnp.
Related Commands
More Networking Commands
Master Linux with Professional eBooks
Curated IT eBooks covering Linux, DevOps, Cloud, and more
Browse Books →