🎁 New User? Get 20% off your first purchase with code NEWUSER20 Register Now →
Menu

Categories

netstat Command

Intermediate Networking man(1)

Print network connections, routing tables, and stats (legacy)

👁 11 views 📅 Updated: Mar 15, 2026
SYNTAX
netstat [OPTION]...

What Does netstat Do?

netstat displays network connections, routing tables, interface statistics, and protocol information. While deprecated in favor of ss, netstat remains widely used and available on most systems.

netstat is commonly used to check which ports are open, what processes are listening, and to verify network connectivity. The most popular usage is netstat -tulnp which shows all listening TCP/UDP ports with process information.

For modern systems, the ss command is the recommended replacement as it is faster and provides more information. However, netstat remains in the net-tools package and is still the familiar choice for many administrators.

Options & Flags

OptionDescriptionExample
-t Show TCP connections netstat -t
-u Show UDP connections netstat -u
-l Show only listening sockets netstat -l
-n Show numerical addresses (skip DNS resolution) netstat -n
-p Show process ID and name sudo netstat -p
-r Show routing table netstat -r
-i Show network interface statistics netstat -i
-s Show protocol statistics netstat -s

Practical Examples

#1 Show listening ports

The most common usage — shows all TCP/UDP listening ports with process names.
$ sudo netstat -tulnp
Output: Proto Local Address State PID/Program tcp 0.0.0.0:22 LISTEN 1234/sshd tcp 0.0.0.0:80 LISTEN 5678/nginx

#2 Show all connections

Shows all connections with numerical addresses.
$ netstat -an

#3 Show routing table

Displays the kernel routing table with IP addresses (not hostnames).
$ netstat -rn

#4 Count connections by state

Shows a summary of connection states (ESTABLISHED, TIME_WAIT, etc.).
$ netstat -ant | awk '{print $6}' | sort | uniq -c | sort -rn
Output: 145 ESTABLISHED\n 23 TIME_WAIT\n 5 LISTEN

#5 Find process using a port

Shows which process is listening on port 80.
$ sudo netstat -tlnp | grep :80
Output: tcp 0.0.0.0:80 LISTEN 5678/nginx

#6 Interface statistics

Shows packet counts and errors for each network interface.
$ netstat -i

Tips & Best Practices

Use ss instead: ss is faster and more feature-rich than netstat. Equivalent command: ss -tulnp instead of netstat -tulnp.
Requires sudo for -p: The -p flag (show process names) requires root privileges to see processes owned by other users.
Deprecated command: netstat is deprecated in favor of ss. It may not be installed by default on newer distributions. Install with: apt install net-tools.

Frequently Asked Questions

How do I see which ports are open?
Use sudo netstat -tulnp (or sudo ss -tulnp). This shows all listening TCP/UDP ports with the associated process.
What does netstat -tulnp mean?
-t TCP, -u UDP, -l listening only, -n numerical, -p process names. It is the standard way to check open ports.
What replaced netstat?
The ss command from iproute2 replaced netstat. It is faster and shows more information. Use ss -tulnp instead of netstat -tulnp.

Master Linux with Professional eBooks

Curated IT eBooks covering Linux, DevOps, Cloud, and more

Browse Books →