Netstat (short for “network statistics”) is a command-line utility that displays various network-related information. It’s an essential tool for system administrators, developers, and users to monitor, troubleshoot, and diagnose network connections and network interface statistics on their computer or server.

It’s available on almost all major operating systems, including Windows, Linux, macOS, and Unix-like systems, though the exact options and output format might vary slightly.

What Information Does Netstat Provide?

Netstat can provide a wealth of information about your system’s network activity, including:

• Active Network Connections: This is one of its most common uses. It shows a list of all established, listening, and other state (like TIME_WAIT, CLOSE_WAIT) connections for both incoming and outgoing traffic.

• Listening Ports: It can identify which ports on your system are open and actively listening for incoming connections. This is crucial for understanding what services are running and potentially accessible from the network.

• Routing Table: It can display the kernel IP routing table, showing how your system routes network traffic to different destinations.

• Network Interface Statistics: It provides statistics for network interfaces, such as the number of packets sent, received, errors, and drops.

• Protocol Statistics: It can show statistics for various network protocols like TCP, UDP, ICMP, and IP, including counts of sent/received segments, errors, and retransmissions.

• Process Information (on some OS versions): With certain options, netstat can show the Process ID (PID) and the name of the program associated with each network connection or listening port. This is extremely useful for identifying which application is using a specific port.

Why is Netstat Useful?

• Troubleshooting Network Issues:

  • Connectivity Problems: Check if a connection is established, if a service is listening on the expected port, or if there are connection errors.

  • Application Debugging: See if an application is correctly binding to a port or making the expected network calls.

  • Network Congestion: Analyze Recv-Q (receive queue) and Send-Q (send queue) values to see if data is backing up.

• Security Monitoring:

  • Identifying Unauthorized Connections: Spot suspicious outgoing connections that might indicate malware or a compromised system.

  • Finding Open Ports: Discover if unexpected ports are open and listening, which could be a security vulnerability.

  • Malware Detection: If you suspect a Trojan or other malicious software, netstat can help reveal if it’s establishing connections or opening backdoors.

• Performance Analysis: Monitor network traffic patterns and statistics to identify bottlenecks or abnormal usage.

• Network Learning: Gain a deeper understanding of how your operating system manages network connections and protocols.

Common Netstat Options (Syntax can vary slightly by OS):

The general syntax is netstat [options]. Here are some of the most frequently used options:

• -a or --all: Displays all active connections and listening ports (both TCP and UDP).

• -n or --numeric: Displays addresses and port numbers in numerical form instead of trying to resolve them to hostnames or service names (e.g., 192.168.1.100:8080 instead of myhost.example.com:http-alt). This speeds up output and is good for scripting.

• -p or --programs (Linux/Unix): Displays the Process ID (PID) and program name associated with each connection or listening port. (On Windows, use -o for PID, and -b for executable name).

• -t or --tcp: Displays only TCP connections.

• -u or --udp: Displays only UDP connections.

• -l or --listening: Displays only listening sockets (ports that are waiting for incoming connections).

• -r or --route: Displays the IP routing table.

• -s or --statistics: Displays per-protocol statistics (e.g., for IP, ICMP, TCP, UDP).

• -i or --interfaces: Displays a table of all network interfaces, along with their statistics (packets sent/received, errors, etc.).

• -c or --continuous (Linux/Unix): Continuously updates the output every second (or at a specified interval). Press Ctrl+C to stop.

Common Netstat Commands and Their Output:

Let’s look at some practical examples:

1. List all active connections and listening ports (numeric): netstat -an (Linux/macOS) netstat -an (Windows)

This is one of the most common and useful commands. The output typically includes columns like:

• Proto: The protocol (TCP, UDP).

• Recv-Q: The number of bytes in the receive queue (data received but not yet processed by the application).

• Send-Q: The number of bytes in the send queue (data ready to be sent but not yet acknowledged).

• Local Address: The local IP address and port number.

• Foreign Address: The remote IP address and port number (for established connections).

• State: The state of the TCP connection (e.g., ESTABLISHED, LISTEN, TIME_WAIT, CLOSE_WAIT, SYN_SENT). UDP connections don’t have states as they are connectionless.

2. List only listening TCP ports (numeric, with PID and program name – Linux): sudo netstat -tulpn

• t: TCP

• u: UDP (often included to see both, but can remove u for only TCP)

• l: Listening

• p: Process ID/Program name

• n: Numeric

• sudo: Often required to see process information for all running processes.

Example Output (Linux):

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:* LISTEN      1234/sshd
tcp        0      0 127.0.0.1:631           0.0.0.0:* LISTEN      5678/cupsd
tcp6       0      0 :::80                   :::* LISTEN      9101/apache2

This shows that sshd is listening on port 22 (for SSH), cupsd is listening on port 631 (for printing services locally), and apache2 is listening on port 80 (for web traffic, IPv6).

3. Show routing table: netstat -r

4. Show network interface statistics: netstat -i

5. Show protocol statistics: netstat -s

netstat vs. ss (Linux):

On modern Linux systems, netstat is considered somewhat deprecated in favor of the newer and often faster ss (socket statistics) utility. ss can provide more detailed information about sockets and is generally preferred for its performance and enhanced features, especially in scripts. However, netstat remains widely available and understood, making it a valuable tool for quick checks across various systems.

In summary, netstat is a powerful command-line utility for gaining insights into your system’s network activity, connections, listening ports, and routing. It’s an indispensable tool for network troubleshooting, security analysis, and understanding network behavior.