{"id":13177,"date":"2019-04-01T05:04:57","date_gmt":"2019-04-01T05:04:57","guid":{"rendered":"http:\/\/www.appservgrid.com\/paw92\/?p=13177"},"modified":"2019-04-01T05:04:57","modified_gmt":"2019-04-01T05:04:57","slug":"20-netstat-commands-for-linux-network-management","status":"publish","type":"post","link":"https:\/\/www.appservgrid.com\/paw92\/index.php\/2019\/04\/01\/20-netstat-commands-for-linux-network-management\/","title":{"rendered":"20 Netstat Commands for Linux Network Management"},"content":{"rendered":"

netstat<\/strong>\u00a0(network statistics<\/strong>) is a command line tool for monitoring network connections both incoming and outgoing as well as viewing routing tables, interface statistics etc.\u00a0netstat<\/strong>\u00a0is available on all Unix-like Operating Systems and also available on\u00a0Windows OS<\/strong>\u00a0as well. It is very useful in terms of network troubleshooting and performance measurement.\u00a0netstat<\/strong>\u00a0is one of the most basic network service debugging tools, telling you what ports are open and whether any programs are listening on ports.<\/p>\n

\n

\"Linux<\/a><\/p>\n

Linux Netstat Command<\/p>\n<\/div>\n

This tool is very important and much useful for Linux network administrators as well as system administrators to monitor and troubleshoot their network related problems and determine network traffic performance. This article shows usages of\u00a0netstat<\/strong>\u00a0command with their examples which may be useful in daily operation.
\n<\/span>
\nYou might also be interested in following article<\/strong><\/p>\n

    \n
  1. 35 Practical Examples of Linux Find Command<\/a><\/li>\n<\/ol>\n

    1. Listing all the LISTENING Ports of TCP and UDP connections<\/h4>\n

    Listing all ports (both TCP and UDP) using\u00a0netstat<\/strong>\u00a0-a option.<\/p>\n

    # netstat -a | more<\/strong>\r\n\r\nActive Internet connections (servers and established)\r\nProto Recv-Q Send-Q Local Address               Foreign Address             State\r\ntcp        0      0 *:sunrpc                    *:*                         LISTEN\r\ntcp        0     52 192.168.0.2:ssh             192.168.0.1:egs             ESTABLISHED\r\ntcp        1      0 192.168.0.2:59292           www.gov.com:http            CLOSE_WAIT\r\ntcp        0      0 localhost:smtp              *:*                         LISTEN\r\ntcp        0      0 *:59482                     *:*                         LISTEN\r\nudp        0      0 *:35036                     *:*\r\nudp        0      0 *:npmp-local                *:*\r\n\r\nActive UNIX domain sockets (servers and established)\r\nProto RefCnt Flags       Type       State         I-Node Path\r\nunix  2      [ ACC ]     STREAM     LISTENING     16972  \/tmp\/orbit-root\/linc-76b-0-6fa08790553d6\r\nunix  2      [ ACC ]     STREAM     LISTENING     17149  \/tmp\/orbit-root\/linc-794-0-7058d584166d2\r\nunix  2      [ ACC ]     STREAM     LISTENING     17161  \/tmp\/orbit-root\/linc-792-0-546fe905321cc\r\nunix  2      [ ACC ]     STREAM     LISTENING     15938  \/tmp\/orbit-root\/linc-74b-0-415135cb6aeab<\/pre>\n
    2. Listing TCP Ports connections<\/h4>\n
    Listing only\u00a0TCP<\/strong>\u00a0(Transmission Control Protocol<\/strong>) port connections using\u00a0netstat -at<\/strong>.<\/p>\n
    # netstat -at<\/strong>\r\n\r\nActive Internet connections (servers and established)\r\nProto Recv-Q Send-Q Local Address               Foreign Address             State\r\ntcp        0      0 *:ssh                       *:*                         LISTEN\r\ntcp        0      0 localhost:ipp               *:*                         LISTEN\r\ntcp        0      0 localhost:smtp              *:*                         LISTEN\r\ntcp        0     52 192.168.0.2:ssh             192.168.0.1:egs             ESTABLISHED\r\ntcp        1      0 192.168.0.2:59292           www.gov.com:http            CLOSE_WAIT<\/pre>\n
    3. Listing UDP Ports connections<\/h4>\n
    Listing only\u00a0UDP<\/strong>\u00a0(User Datagram Protocol\u00a0<\/strong>) port connections using\u00a0netstat -au<\/strong>.<\/p>\n
    # netstat -au<\/strong>\r\n\r\nActive Internet connections (servers and established)\r\nProto Recv-Q Send-Q Local Address               Foreign Address             State\r\nudp        0      0 *:35036                     *:*\r\nudp        0      0 *:npmp-local                *:*\r\nudp        0      0 *:mdns                      *:*<\/pre>\n
    4. Listing all LISTENING Connections<\/h4>\n
    Listing all active listening ports connections with\u00a0netstat -l<\/strong>.<\/p>\n
    # netstat -l<\/strong>\r\n\r\nActive Internet connections (only servers)\r\nProto Recv-Q Send-Q Local Address               Foreign Address             State\r\ntcp        0      0 *:sunrpc                    *:*                         LISTEN\r\ntcp        0      0 *:58642                     *:*                         LISTEN\r\ntcp        0      0 *:ssh                       *:*                         LISTEN\r\nudp        0      0 *:35036                     *:*\r\nudp        0      0 *:npmp-local                *:*\r\n\r\nActive UNIX domain sockets (only servers)\r\nProto RefCnt Flags       Type       State         I-Node Path\r\nunix  2      [ ACC ]     STREAM     LISTENING     16972  \/tmp\/orbit-root\/linc-76b-0-6fa08790553d6\r\nunix  2      [ ACC ]     STREAM     LISTENING     17149  \/tmp\/orbit-root\/linc-794-0-7058d584166d2\r\nunix  2      [ ACC ]     STREAM     LISTENING     17161  \/tmp\/orbit-root\/linc-792-0-546fe905321cc\r\nunix  2      [ ACC ]     STREAM     LISTENING     15938  \/tmp\/orbit-root\/linc-74b-0-415135cb6aeab<\/pre>\n
    5. Listing all TCP Listening Ports<\/h4>\n
    Listing all active listening TCP ports by using option\u00a0netstat -lt<\/strong>.<\/p>\n
    # netstat -lt<\/strong>\r\n\r\nActive Internet connections (only servers)\r\nProto Recv-Q Send-Q Local Address               Foreign Address             State\r\ntcp        0      0 *:dctp                      *:*                         LISTEN\r\ntcp        0      0 *:mysql                     *:*                         LISTEN\r\ntcp        0      0 *:sunrpc                    *:*                         LISTEN\r\ntcp        0      0 *:munin                     *:*                         LISTEN\r\ntcp        0      0 *:ftp                       *:*                         LISTEN\r\ntcp        0      0 localhost.localdomain:ipp   *:*                         LISTEN\r\ntcp        0      0 localhost.localdomain:smtp  *:*                         LISTEN\r\ntcp        0      0 *:http                      *:*                         LISTEN\r\ntcp        0      0 *:ssh                       *:*                         LISTEN\r\ntcp        0      0 *:https                     *:*                         LISTEN<\/pre>\n
    6. Listing all UDP Listening Ports<\/h4>\n
    Listing all active listening UDP ports by using option\u00a0netstat -lu<\/strong>.<\/p>\n
    # netstat -lu<\/strong>\r\n\r\nActive Internet connections (only servers)\r\nProto Recv-Q Send-Q Local Address               Foreign Address             State\r\nudp        0      0 *:39578                     *:*\r\nudp        0      0 *:meregister                *:*\r\nudp        0      0 *:vpps-qua                  *:*\r\nudp        0      0 *:openvpn                   *:*\r\nudp        0      0 *:mdns                      *:*\r\nudp        0      0 *:sunrpc                    *:*\r\nudp        0      0 *:ipp                       *:*\r\nudp        0      0 *:60222                     *:*\r\nudp        0      0 *:mdns                      *:*<\/pre>\n
    7. Listing all UNIX Listening Ports<\/h4>\n
    Listing all active UNIX listening ports using\u00a0netstat -lx<\/strong>.<\/p>\n
    # netstat -lx<\/strong>\r\n\r\nActive UNIX domain sockets (only servers)\r\nProto RefCnt Flags       Type       State         I-Node Path\r\nunix  2      [ ACC ]     STREAM     LISTENING     4171   @ISCSIADM_ABSTRACT_NAMESPACE\r\nunix  2      [ ACC ]     STREAM     LISTENING     5767   \/var\/run\/cups\/cups.sock\r\nunix  2      [ ACC ]     STREAM     LISTENING     7082   @\/tmp\/fam-root-\r\nunix  2      [ ACC ]     STREAM     LISTENING     6157   \/dev\/gpmctl\r\nunix  2      [ ACC ]     STREAM     LISTENING     6215   @\/var\/run\/hald\/dbus-IcefTIUkHm\r\nunix  2      [ ACC ]     STREAM     LISTENING     6038   \/tmp\/.font-unix\/fs7100\r\nunix  2      [ ACC ]     STREAM     LISTENING     6175   \/var\/run\/avahi-daemon\/socket\r\nunix  2      [ ACC ]     STREAM     LISTENING     4157   @ISCSID_UIP_ABSTRACT_NAMESPACE\r\nunix  2      [ ACC ]     STREAM     LISTENING     60835836 \/var\/lib\/mysql\/mysql.sock\r\nunix  2      [ ACC ]     STREAM     LISTENING     4645   \/var\/run\/audispd_events\r\nunix  2      [ ACC ]     STREAM     LISTENING     5136   \/var\/run\/dbus\/system_bus_socket\r\nunix  2      [ ACC ]     STREAM     LISTENING     6216   @\/var\/run\/hald\/dbus-wsUBI30V2I\r\nunix  2      [ ACC ]     STREAM     LISTENING     5517   \/var\/run\/acpid.socket\r\nunix  2      [ ACC ]     STREAM     LISTENING     5531   \/var\/run\/pcscd.comm<\/pre>\n
    8. Showing Statistics by Protocol<\/h4>\n
    Displays statistics by protocol. By default, statistics are shown for the TCP, UDP, ICMP, and IP protocols. The -s parameter can be used to specify a set of protocols.<\/p>\n
    # netstat -s<\/strong>\r\n\r\nIp:\r\n    2461 total packets received\r\n    0 forwarded\r\n    0 incoming packets discarded\r\n    2431 incoming packets delivered\r\n    2049 requests sent out\r\nIcmp:\r\n    0 ICMP messages received\r\n    0 input ICMP message failed.\r\n    ICMP input histogram:\r\n    1 ICMP messages sent\r\n    0 ICMP messages failed\r\n    ICMP output histogram:\r\n        destination unreachable: 1\r\nTcp:\r\n    159 active connections openings\r\n    1 passive connection openings\r\n    4 failed connection attempts\r\n    0 connection resets received\r\n    1 connections established\r\n    2191 segments received\r\n    1745 segments send out\r\n    24 segments retransmited\r\n    0 bad segments received.\r\n    4 resets sent\r\nUdp:\r\n    243 packets received\r\n    1 packets to unknown port received.\r\n    0 packet receive errors\r\n    281 packets sent<\/pre>\n
    9. Showing Statistics by TCP Protocol<\/h4>\n
    Showing statistics of only TCP protocol by using option\u00a0netstat -st<\/strong>.<\/p>\n
    # netstat -st<\/strong>\r\n\r\nTcp:\r\n    2805201 active connections openings\r\n    1597466 passive connection openings\r\n    1522484 failed connection attempts\r\n    37806 connection resets received\r\n    1 connections established\r\n    57718706 segments received\r\n    64280042 segments send out\r\n    3135688 segments retransmited\r\n    74 bad segments received.\r\n    17580 resets sent<\/pre>\n
    10. Showing Statistics by UDP Protocol<\/h4>\n
    # netstat -su<\/strong>\r\n\r\nUdp:\r\n    1774823 packets received\r\n    901848 packets to unknown port received.\r\n    0 packet receive errors\r\n    2968722 packets sent<\/pre>\n
    11. Displaying Service name with PID<\/h4>\n
    Displaying service name with their PID number, using option\u00a0netstat -tp<\/strong>\u00a0will display \u201cPID\/Program Name\u201d.<\/p>\n
    # netstat -tp<\/strong>\r\n\r\nActive Internet connections (w\/o servers)\r\nProto Recv-Q Send-Q Local Address               Foreign Address             State       PID\/Program name\r\ntcp        0      0 192.168.0.2:ssh             192.168.0.1:egs             ESTABLISHED 2179\/sshd\r\ntcp        1      0 192.168.0.2:59292           www.gov.com:http            CLOSE_WAIT  1939\/clock-applet<\/pre>\n
    12. Displaying Promiscuous Mode<\/h4>\n
    Displaying Promiscuous mode with -ac switch, netstat print the selected information or refresh screen every five second. Default screen refresh in every second.<\/p>\n
    # netstat -ac 5 | grep tcp<\/strong>\r\n\r\ntcp        0      0 *:sunrpc                    *:*                         LISTEN\r\ntcp        0      0 *:58642                     *:*                         LISTEN\r\ntcp        0      0 *:ssh                       *:*                         LISTEN\r\ntcp        0      0 localhost:ipp               *:*                         LISTEN\r\ntcp        0      0 localhost:smtp              *:*                         LISTEN\r\ntcp        1      0 192.168.0.2:59447           www.gov.com:http            CLOSE_WAIT\r\ntcp        0     52 192.168.0.2:ssh             192.168.0.1:egs             ESTABLISHED\r\ntcp        0      0 *:sunrpc                    *:*                         LISTEN\r\ntcp        0      0 *:ssh                       *:*                         LISTEN\r\ntcp        0      0 localhost:ipp               *:*                         LISTEN\r\ntcp        0      0 localhost:smtp              *:*                         LISTEN\r\ntcp        0      0 *:59482                     *:*                         LISTEN<\/pre>\n
    13. Displaying Kernel IP routing<\/h4>\n
    Display Kernel IP routing table with netstat and route command.<\/p>\n
    # netstat -r<\/strong>\r\n\r\nKernel IP routing table\r\nDestination     Gateway         Genmask         Flags   MSS Window  irtt Iface\r\n192.168.0.0     *               255.255.255.0   U         0 0          0 eth0\r\nlink-local      *               255.255.0.0     U         0 0          0 eth0\r\ndefault         192.168.0.1     0.0.0.0         UG        0 0          0 eth0<\/pre>\n
    14. Showing Network Interface Transactions<\/h4>\n
    Showing network interface packet transactions including both transferring and receiving packets with MTU size.<\/p>\n
    # netstat -i<\/strong>\r\n\r\nKernel Interface table\r\nIface       MTU Met    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg\r\neth0       1500   0     4459      0      0      0     4057      0      0      0 BMRU\r\nlo        16436   0        8      0      0      0        8      0      0      0 LRU<\/pre>\n
    15. Showing Kernel Interface Table<\/h4>\n
    Showing Kernel interface table, similar to\u00a0ifconfig<\/strong>\u00a0command.<\/p>\n
    # netstat -ie<\/strong>\r\n\r\nKernel Interface table\r\neth0      Link encap:Ethernet  HWaddr 00:0C:29:B4:DA:21\r\n          inet addr:192.168.0.2  Bcast:192.168.0.255  Mask:255.255.255.0\r\n          inet6 addr: fe80::20c:29ff:feb4:da21\/64 Scope:Link\r\n          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1\r\n          RX packets:4486 errors:0 dropped:0 overruns:0 frame:0\r\n          TX packets:4077 errors:0 dropped:0 overruns:0 carrier:0\r\n          collisions:0 txqueuelen:1000\r\n          RX bytes:2720253 (2.5 MiB)  TX bytes:1161745 (1.1 MiB)\r\n          Interrupt:18 Base address:0x2000\r\n\r\nlo        Link encap:Local Loopback\r\n          inet addr:127.0.0.1  Mask:255.0.0.0\r\n          inet6 addr: ::1\/128 Scope:Host\r\n          UP LOOPBACK RUNNING  MTU:16436  Metric:1\r\n          RX packets:8 errors:0 dropped:0 overruns:0 frame:0\r\n          TX packets:8 errors:0 dropped:0 overruns:0 carrier:0\r\n          collisions:0 txqueuelen:0\r\n          RX bytes:480 (480.0 b)  TX bytes:480 (480.0 b)<\/pre>\n
    16. Displaying IPv4 and IPv6 Information<\/h4>\n
    Displays multicast group membership information for both IPv4 and IPv6.<\/p>\n
    # netstat -g<\/strong>\r\n\r\nIPv6\/IPv4 Group Memberships\r\nInterface       RefCnt Group\r\n--------------- ------ ---------------------\r\nlo              1      all-systems.mcast.net\r\neth0            1      224.0.0.251\r\neth0            1      all-systems.mcast.net\r\nlo              1      ff02::1\r\neth0            1      ff02::202\r\neth0            1      ff02::1:ffb4:da21\r\neth0            1      ff02::1<\/pre>\n
    17. Print Netstat Information Continuously<\/h4>\n
    To get netstat information every few second, then use the following command, it will print netstat information continuously, say every few seconds.<\/p>\n
    # netstat -c<\/strong>\r\n\r\nActive Internet connections (w\/o servers)\r\nProto Recv-Q Send-Q Local Address               Foreign Address             State\r\ntcp        0      0 tecmint.com:http   sg2nlhg007.shr.prod.s:36944 TIME_WAIT\r\ntcp        0      0 tecmint.com:http   sg2nlhg010.shr.prod.s:42110 TIME_WAIT\r\ntcp        0    132 tecmint.com:ssh    115.113.134.3.static-:64662 ESTABLISHED\r\ntcp        0      0 tecmint.com:http   crawl-66-249-71-240.g:41166 TIME_WAIT\r\ntcp        0      0 localhost.localdomain:54823 localhost.localdomain:smtp  TIME_WAIT\r\ntcp        0      0 localhost.localdomain:54822 localhost.localdomain:smtp  TIME_WAIT\r\ntcp        0      0 tecmint.com:http   sg2nlhg010.shr.prod.s:42091 TIME_WAIT\r\ntcp        0      0 tecmint.com:http   sg2nlhg007.shr.prod.s:36998 TIME_WAIT<\/pre>\n
    18. Finding non supportive Address<\/h4>\n
    Finding un-configured address families with some useful information.<\/p>\n
    # netstat --verbose<\/strong>\r\n\r\nnetstat: no support for `AF IPX' on this system.\r\nnetstat: no support for `AF AX25' on this system.\r\nnetstat: no support for `AF X25' on this system.\r\nnetstat: no support for `AF NETROM' on this system.<\/pre>\n
    19. Finding Listening Programs<\/h4>\n
    Find out how many listening programs running on a port.<\/p>\n
    # netstat -ap | grep http<\/strong>\r\n\r\ntcp        0      0 *:http                      *:*                         LISTEN      9056\/httpd\r\ntcp        0      0 *:https                     *:*                         LISTEN      9056\/httpd\r\ntcp        0      0 tecmint.com:http   sg2nlhg008.shr.prod.s:35248 TIME_WAIT   -\r\ntcp        0      0 tecmint.com:http   sg2nlhg007.shr.prod.s:57783 TIME_WAIT   -\r\ntcp        0      0 tecmint.com:http   sg2nlhg007.shr.prod.s:57769 TIME_WAIT   -\r\ntcp        0      0 tecmint.com:http   sg2nlhg008.shr.prod.s:35270 TIME_WAIT   -\r\ntcp        0      0 tecmint.com:http   sg2nlhg009.shr.prod.s:41637 TIME_WAIT   -\r\ntcp        0      0 tecmint.com:http   sg2nlhg009.shr.prod.s:41614 TIME_WAIT   -\r\nunix  2      [ ]         STREAM     CONNECTED     88586726 10394\/httpd<\/pre>\n
    20. Displaying RAW Network Statistics<\/h4>\n
    # netstat --statistics --raw<\/strong>\r\n\r\nIp:\r\n    62175683 total packets received\r\n    52970 with invalid addresses\r\n    0 forwarded\r\nIcmp:\r\n    875519 ICMP messages received\r\n        destination unreachable: 901671\r\n        echo request: 8\r\n        echo replies: 16253\r\nIcmpMsg:\r\n        InType0: 83\r\nIpExt:\r\n    InMcastPkts: 117<\/pre>\n
    That\u2019s it, If you are looking for more information and options about netstat command, refer netstat manual docs or use\u00a0man netstat<\/strong>\u00a0command to know all the information. If we\u2019ve missed anything in the list, please inform us using our comment section below. So, we could keep updating this list based on your comments.<\/p>\n
    Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
    netstat\u00a0(network statistics) is a command line tool for monitoring network connections both incoming and outgoing as well as viewing routing tables, interface statistics etc.\u00a0netstat\u00a0is available on all Unix-like Operating Systems and also available on\u00a0Windows OS\u00a0as well. It is very useful in terms of network troubleshooting and performance measurement.\u00a0netstat\u00a0is one of the most basic network service … <\/p>\n
    Continue reading “20 Netstat Commands for Linux Network Management”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-13177","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/13177","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/comments?post=13177"}],"version-history":[{"count":1,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/13177\/revisions"}],"predecessor-version":[{"id":13178,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/13177\/revisions\/13178"}],"wp:attachment":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/media?parent=13177"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/categories?post=13177"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/tags?post=13177"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}