netstat is a command-line tool used to display network connections, routing tables, interface statistics, and more. It helps monitor and troubleshoot network-related issues on a system.
Display all active network connections and their states
Example Usage:
netstat -a
What it does:
Shows all active network connections, including those in listening, established, and other states, along with their local and remote addresses.
Command-line Arguments Explained:
-a: Displays all connections (both listening and non-listening). --all: Same as -a, but less commonly used.
Show listening ports and their associated process IDs
Example Usage:
sudo netstat -tulnp
What it does:
Lists TCP and UDP ports that are in a listening state, along with the process ID (PID) and program name using each port.
Command-line Arguments Explained:
-t: Show TCP connections. -u: Show UDP connections. -l: Display only listening ports. -n: Show numerical addresses and port numbers instead of resolving them. -p: Display the process ID (PID) and name associated with each connection.
Example Usage:
netstat -n
What it does:
Shows connection addresses and port numbers in numerical form instead of resolving them to hostnames or service names.
Command-line Arguments Explained:
-n: Prevents DNS lookups and displays addresses and ports as numbers. --numeric: Equivalent to -n.
Display protocol statistics
Example Usage:
netstat -s
What it does:
Provides detailed statistics for each network protocol (e.g., TCP, UDP, IP, ICMP) in use.
Command-line Arguments Explained:
-s: Displays protocol statistics (e.g., packets sent/received, errors).
Display the routing table
Example Usage:
netstat -r
What it does:
Shows the kernel's routing table, including the destination, gateway, netmask, and other routing information.
Command-line Arguments Explained:
-r: Displays the routing table. --route: Same as -r.
Show interface statistics
Example Usage:
netstat -i
What it does:
Lists statistics for each network interface (e.g., packets transmitted/received, errors, collisions).
Command-line Arguments Explained:
-i: Displays interface statistics. --interfaces: Same as -i.
Example Usage:
netstat -e
What it does:
Shows extended information such as the user ID, PID, and other details for each connection.
Command-line Arguments Explained:
-e: Displays extended information. --extend: Same as -e.
Show TCP connections only
Example Usage:
netstat -t
What it does:
Lists only TCP (Transmission Control Protocol) connections, including their states.
Command-line Arguments Explained:
-t: Filters to show only TCP connections.
Show UDP connections only
Example Usage:
netstat -u
What it does:
Lists only UDP (User Datagram Protocol) connections, which are connectionless and often used for streaming or broadcasting.
Command-line Arguments Explained:
-u: Filters to show only UDP connections.
Show connections with timestamps
Example Usage:
netstat -atv
What it does:
Displays active TCP connections along with timestamps for each connection, useful for analyzing idle or established connections.
Command-line Arguments Explained:
-t: TCP connections. -a: All connections. -v: Verbose output, including additional details.
Count established connections
Example Usage:
netstat -ant | grep ESTABLISHED | wc -l
What it does:
Counts the number of established TCP connections by filtering the output of netstat -ant (all TCP connections) for the "ESTABLISHED" state and piping to wc -l.
Command-line Arguments Explained:
-t: TCP connections. -a: All connections. -n: Numerical addressing.
Example Usage:
netstat -atop
What it does:
Lists active TCP connections with process and port information, making it easier to interpret without numeric conversion.
Command-line Arguments Explained:
-t: TCP connections. -a: All connections. -o: Shows timers for each connection. -p: Displays process information.
Show connections to a specific port (e.g., port 80)
Example Usage:
netstat -an | grep :80
What it does:
Filters and displays connections involving port 80 (HTTP) in numerical format.
Command-line Arguments Explained:
-a: All connections. -n: Numerical addressing. grep: A separate utility used to filter output by the port number.
Monitor network activity in real time
Example Usage:
netstat -antp --interval=1
What it does:
Updates network connection information every second, useful for real-time monitoring of active connections.
Command-line Arguments Explained:
-t: TCP connections. -a: All connections. -n: Numerical addressing. -p: Process information. --interval=1: Refreshes the output every 1 second.
Display connections with symbolic names
Example Usage:
netstat -a -p
What it does:
Shows connections with hostnames and service names resolved (if possible), which is the opposite of -n (numeric form).
Command-line Arguments Explained:
-a: All connections. -p: Show process information. --symbolic: Resolves hostnames and service names instead of using numeric values.
