Use of Netstat Commands

Netstat (network statistics) is a command-line tool that displays network connections (both incoming and outgoing), routing tables, and a number of network interface statistics. Netstat is a useful tool for checking your network configuration and activity.

Check tcp connection established on your machine using below command

1: netstat --tcp

% netstat --tcp --numeric
Active Internet connections (w/o servers)

Proto Recv-Q Send-Q Local Address           Foreign Address         State

tcp        0      0 nexubuntu:ldap          nexubuntu:38885         ESTABLISHED

tcp        0      0 nexubuntu:38885         nexubuntu:ldap          ESTABLISHED

tcp        0      0 nexubuntu:ssh           10.8.0.151:50776        ESTABLISHED

tcp        0      0 nexubuntu:microsoft-ds  nexubuntu:59000         ESTABLISHED

tcp        0      0 nexubuntu:38875         nexubuntu:ldap          ESTABLISHED

tcp        0      0 nexubuntu:ldap          nexubuntu:52342         ESTABLISHED

tcp        0      0 nexubuntu:ssh           10.8.0.151:50775        ESTABLISHED

tcp      244      0 nexubuntu:59004         nexubuntu:microsoft-ds  ESTABLISHED

tcp      244      0 nexubuntu:59000         nexubuntu:microsoft-ds  ESTABLISHED

tcp        0      0 nexubuntu:ldap          nexubuntu:38875         ESTABLISHED

tcp        0      0 nexubuntu:microsoft-ds  nexubuntu:59004         ESTABLISHED

tcp        0      0 nexubuntu:52343         nexubuntu:ldap          TIME_WAIT

tcp        0      0 nexubuntu:52342         nexubuntu:ldap          ESTABLISHED

tcp        0      0 nexubuntu:microsoft-ds  nexubuntu:58998         ESTABLISHED

tcp      244      0 nexubuntu:58998         nexubuntu:microsoft-ds  ESTABLISHED

If you want to see what (TCP) ports your machine is listening on, use netstat --tcp --listening. Another useful flag to add to this is --programs which indicates which process is listening on the specified port.

2: netstat --tcp --listening --programs

# sudo netstat --tcp --listening --programs
Active Internet connections (only servers)

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name

tcp        0      0 *:nfs                   *:*                     LISTEN      -

tcp        0      0 *:ldap                  *:*                     LISTEN      2715/slapd

tcp        0      0 *:ftp                   *:*                     LISTEN      3302/vsftpd

tcp        0      0 *:ssh                   *:*                     LISTEN      4022/sshd

tcp        0      0 nexubuntu:postgresql    *:*                     LISTEN      2680/postgres

tcp        0      0 *:smtp                  *:*                     LISTEN      3259/master

tcp        0      0 *:58777                 *:*                     LISTEN      2098/rpc.statd

tcp        0      0 *:microsoft-ds          *:*                     LISTEN      3283/smbd

tcp6       0      0 [::]:ldap               [::]:*                  LISTEN      2715/slapd

tcp6       0      0 [::]:www                [::]:*                  LISTEN      3750/apache2

Uses netstat --route to display the routing table.

3: netstat --route

% netstat --route
Kernel IP routing table

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface

10.8.0.0        *               255.255.255.0   U         0 0          0 eth0

link-local      *               255.255.0.0     U         0 0          0 eth0

default         mygateway1.ar7  0.0.0.0         UG        0 0          0 eth0

Uses the --statistics flag to display networking statistics.

Using this flag by itself displays all IP, TCP, UDP, and ICMP connection statistics.

4: netstat --statistics --route