Cheatsheet & Examples: netstat
netstat is a command-line tool used to display network connections, routing tables, interface statistics, and more. It helps monitor and troubleshoot network-related issues on a system.
Display all active network connections and their states
Example Usage:netstat -a
What it does:
Shows all active network connections, including those in listening, established, and other states, along with their local and remote addresses.
Command-line Arguments Explained:
-a: Displays all connections (both listening and non-listening).--all: Same as-a, but less commonly used.
Show listening ports and their associated process IDs
Example Usage:sudo netstat -tulnp
What it does:
Lists TCP and UDP ports that are in a listening state, along with the process ID (PID) and program name using each port.
Command-line Arguments Explained:
-t: Show TCP connections.-u: Show UDP connections.-l: Display only listening ports.-n: Show numerical addresses and port numbers instead of resolving them.-p: Display the process ID (PID) and name associated with each connection.
Display network connections in numerical format
Example Usage:netstat -n
What it does:
Shows connection addresses and port numbers in numerical form instead of resolving them to hostnames or service names.
Command-line Arguments Explained:
-n: Prevents DNS lookups and displays addresses and ports as numbers.--numeric: Equivalent to-n.
Display protocol statistics
Example Usage:netstat -s
What it does:
Provides detailed statistics for each network protocol (e.g., TCP, UDP, IP, ICMP) in use.
Command-line Arguments Explained:
-s: Displays protocol statistics (e.g., packets sent/received, errors).
Display the routing table
Example Usage:netstat -r
What it does:
Shows the kernel's routing table, including the destination, gateway, netmask, and other routing information.
Command-line Arguments Explained:
-r: Displays the routing table.--route: Same as-r.
Show interface statistics
Example Usage:netstat -i
What it does:
Lists statistics for each network interface (e.g., packets transmitted/received, errors, collisions).
Command-line Arguments Explained:
-i: Displays interface statistics.--interfaces: Same as-i.
Display detailed connection information
Example Usage:netstat -e
What it does:
Shows extended information such as the user ID, PID, and other details for each connection.
Command-line Arguments Explained:
-e: Displays extended information.--extend: Same as-e.
Show TCP connections only
Example Usage:netstat -t
What it does:
Lists only TCP (Transmission Control Protocol) connections, including their states.
Command-line Arguments Explained:
-t: Filters to show only TCP connections.
Show UDP connections only
Example Usage:netstat -u
What it does:
Lists only UDP (User Datagram Protocol) connections, which are connectionless and often used for streaming or broadcasting.
Command-line Arguments Explained:
-u: Filters to show only UDP connections.
Show connections with timestamps
Example Usage:netstat -atv
What it does:
Displays active TCP connections along with timestamps for each connection, useful for analyzing idle or established connections.
Command-line Arguments Explained:
-t: TCP connections.-a: All connections.-v: Verbose output, including additional details.
Count established connections
Example Usage:netstat -ant | grep ESTABLISHED | wc -l
What it does:
Counts the number of established TCP connections by filtering the output of netstat -ant (all TCP connections) for the "ESTABLISHED" state and piping to wc -l.
Command-line Arguments Explained:
-t: TCP connections.-a: All connections.-n: Numerical addressing.
Display all connections in a human-readable format
Example Usage:netstat -atop
What it does:
Lists active TCP connections with process and port information, making it easier to interpret without numeric conversion.
Command-line Arguments Explained:
-t: TCP connections.-a: All connections.-o: Shows timers for each connection.-p: Displays process information.
Show connections to a specific port (e.g., port 80)
Example Usage:netstat -an | grep :80
What it does:
Filters and displays connections involving port 80 (HTTP) in numerical format.
Command-line Arguments Explained:
-a: All connections.-n: Numerical addressing.grep: A separate utility used to filter output by the port number.
Monitor network activity in real time
Example Usage:netstat -antp --interval=1
What it does:
Updates network connection information every second, useful for real-time monitoring of active connections.
Command-line Arguments Explained:
-t: TCP connections.-a: All connections.-n: Numerical addressing.-p: Process information.--interval=1: Refreshes the output every 1 second.
Display connections with symbolic names
Example Usage:netstat -a -p
What it does:
Shows connections with hostnames and service names resolved (if possible), which is the opposite of -n (numeric form).
Command-line Arguments Explained:
-a: All connections.-p: Show process information.--symbolic: Resolves hostnames and service names instead of using numeric values.
