Active Internet connections servers and established. Proto Recv Q Send Q Local Address Foreign Address State. LISTEN. tcp 0 0 localhost ipp LISTEN. ESTABLISHED. tcp 0 0 enlightened. ESTABLISHED. tcp. LISTEN. udp 0 0 enlightened domain Active UNIX domain sockets servers and established. Proto Ref. Cnt Flags Type State I Node Path. ACC STREAM LISTENING 1. IDgfj. 3UGXX. unix 2 ACC STREAM LISTENING 4. UC6. CCx. The above command shows all connections from different protocols like tcp, udp and unix sockets. However this is not quite useful. Administrators often want to pick out specific connections based on protocols or port numbers for example. List only TCP or UDP connections. To list out only tcp connections use the t options. Active Internet connections servers and established. Proto Recv Q Send Q Local Address Foreign Address State. LISTEN. tcp 0 0 localhost ipp LISTEN. ESTABLISHED. tcp 0 0 enlightened. ESTABLISHED. tcp 0 0 enlightened. ABTS North Static http ESTABLISHED. Similarly to list out only udp connections use the u option. Active Internet connections servers and established. Proto Recv Q Send Q Local Address Foreign Address State. The above output shows both ipv. Disable reverse dns lookup for faster output. By default, the netstat command tries to find out the hostname of each ip address in the connection by doing a reverse dns lookup. This slows down the output. If you do not need to know the host name and just the ip address is sufficient then suppress the hostname lookup with the n option. Active Internet connections servers and established. Proto Recv Q Send Q Local Address Foreign Address State. LISTEN. tcp 0 0 1. LISTEN. tcp 0 0 1. ESTABLISHED. tcp 0 0 1. ESTABLISHED. tcp. LISTENThe above command shows ALL TCP connections with NO dns resolution. Got it Good. 4. List out only listening connections. Any network daemonservice keeps an open port to listen for incoming connections. These too are like socket connections and are listed out by netstat. To view only listening ports use the l options. Active Internet connections only servers. Proto Recv Q Send Q Local Address Foreign Address State. LISTEN. tcp 0 0 1. LISTEN. tcp. 6 0 0 1 6. LISTENNow we can see only listening tcp portsconnections. If you want to see all listening ports, remove the t option. If you want to see only listening udp ports use the u option instead of t. Make sure to remove the a option, otherwise all connections would get listed and not just the listening connections. Get process namepid and user id. When viewing the openlistening ports and connections, its often useful to know the process namepid which has opened that port or connection. For example the Apache httpd server opens port 8. So if you want to check whether any http server is running or not, or which http server is running, apache or nginx, then track down the process name. The process details are made available by the p option. Active Internet connections only servers. Proto Recv Q Send Q Local Address Foreign Address State PIDProgram name. LISTEN 1. 14. 4dnsmasq. LISTEN 6. 61cupsd. LISTEN 6. 61cupsd. When using the p option, netstat must be run with root privileges, otherwise it cannot detect the pids of processes running with root privileges and most services like http and ftp often run with root privileges. Along with process namepid its even more useful to get the usernameuid owning that particular process. Use the e option along with the p option to get the username too. Active Internet connections only servers. Proto Recv Q Send Q Local Address Foreign Address State User Inode PIDProgram name. LISTEN root 1. LISTEN root 9. LISTEN root 9. The above example lists out Listening connections of Tcp type with Process information and Extended information. The extended information contains the username and inode of the process. This is a useful command for network administrators. Note If you use the n option with the e option, the uid would be listed and not the username. Print statistics. The netstat command can also print out network statistics like total number of packets received and transmitted by protocol type and so on. To list out statistics of all packet types netstat s. ICMP messages received. ICMP message failed. ICMP input histogram. ICMP messages sent. ICMP messages failed. ICMP output histogram. OUTPUT TRUNCATED. To print out statistics of only select protocols like TCP or UDP use the corresponding options like t and u along with the s option. Simple 7. Display kernel routing information. The kernel routing information can be printed with the r option. It is the same output as given by the route command. We also use the n option to disable the hostname lookup. Kernel IP routing table. Destination Gateway Genmask Flags MSS Window irtt Iface. UG 0 0 0 eth. U 0 0 0 eth. Print network interfaces. The netstat command can also print out the information about the network interfaces. The i option does the task. Kernel Interface table. Iface MTU Met RX OK RX ERR RX DRP RX OVR TX OK TX ERR TX DRP TX OVR Flg. BMRU. lo 6. 55. LRUThe above output contains information in a very raw format. To get a more human friendly version of the output use the e option along with i. Kernel Interface table. Link encap Ethernet HWaddr 0. Bcast 1. 92. 1. 68. Mask 2. 55. 2. 55. Scope Link. UP BROADCAST RUNNING MULTICAST MTU 1. Metric 1. RX packets 3. TX packets 2. 75. RX bytes 2. 96. 37. MB TX bytes 4. 59. MB. Interrupt 1. Memory da. Link encap Local Loopback. Mask 2. 55. 0. 0. Scope Host. UP LOOPBACK RUNNING MTU 6. Metric 1. RX packets 2. TX packets 2. 92. RX bytes 3. 05. 29. KB TX bytes 3. 05. KBThe above output is similar to the output shown by the ifconfig command. Get netstat output continuously. Netstat can output connection information continuously with the c option. The above command will output tcp connections continuously. Display multicast group information. The g option will display the multicast group information for IPv. IPv. 6 protocols. IPv. 6IPv. 4 Group Memberships. Interface Ref. Cnt Group. More examples of netstat command. Okay, we covered the basic examples of netstat command above. Now its time to do some geek stuff with style. Print active connections. Active socket connections are in ESTABLISHED state. So to get all current active connections use netstat with grep as follows netstat atnp grep ESTA. Not all processes could be identified, non owned process info. ESTABLISHED 1. 69. ESTABLISHED 1. 69. To watch a continous list of active connections, use the watch command along with netstat and grep watch d n.