10 Netstat Command Examples on Linux

The netstat command is a powerful network utility that displays network connections, routing tables, interface statistics, masquerade connections, and multicast memberships on Linux systems. This command is essential for network troubleshooting and monitoring active connections on your system.

Display All Connections

To show all listening and non-listening sockets, use the -a option:

netstat -a

This displays both active connections and listening ports:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 localhost:mysql         *:*                     LISTEN
tcp        0      0 linux-desktop:domain    *:*                     LISTEN
tcp        0      0 linux-desktop:46930     ec2-54-236-207-15:https ESTABLISHED
tcp        0      0 linux-desktop:59820     maa03s22-in-f14.1:https ESTABLISHED
tcp        0      0 linux-desktop:46662     sc-in-f188.1e100.n:5228 ESTABLISHED

Show Process Information

To display the PID and program name associated with each socket, use the -p option:

netstat -p

Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 linux-desktop:46930     ec2-54-236-207-15:https ESTABLISHED 23074/chrome
tcp        0      0 linux-desktop:59820     maa03s22-in-f14.1:https ESTABLISHED 23235/chromium-brow
tcp        0      0 linux-desktop:46662     sc-in-f188.1e100.n:5228 ESTABLISHED 23074/chrome

Filter by Protocol

TCP Connections Only

netstat -t

UDP Connections Only

netstat -u

List Unix Domain Sockets

To display Unix domain sockets and listening services, use the -x option:

netstat -lx

Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node   Path
unix  2      [ ACC ]     STREAM     LISTENING     27810    @/tmp/.ICE-unix/2345
unix  2      [ ACC ]     STREAM     LISTENING     26776    @/tmp/ibus/dbus-RkYlcXlm
unix  2      [ ACC ]     STREAM     LISTENING     20175    /var/run/mysqld/mysqld.sock

Display Routing Table

To view the kernel IP routing table, use the -r option:

netstat -r

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
default         192.168.1.1     0.0.0.0         UG        0 0          0 eth0
192.168.1.0     *               255.255.255.0   U         0 0          0 eth0

Network Statistics

To display comprehensive networking statistics, use the -s option:

netstat -s

Ip:
    226777 total packets received
    99 with invalid addresses
    0 forwarded
    0 incoming packets discarded
    213036 incoming packets delivered
    126141 requests sent out
Icmp:
    420 ICMP messages received
    120 input ICMP message failed
    ICMP input histogram:
        destination unreachable: 414
        echo requests: 6

Extended Information

To display additional network information including user and inode details, use the -e option:

netstat -e

Continuous Monitoring

To continuously monitor network connections, use the -c option:

netstat -c

Common Option Combinations

Getting Help

For a complete list of options and usage information:

netstat -h

Conclusion

The netstat command is an essential tool for Linux network administration, providing detailed information about network connections, routing tables, and system statistics. These examples demonstrate the most commonly used options for network troubleshooting and monitoring.