Understanding the Netstat Command

The netstat command is a powerful command-line utility used to display network connections, routing tables, interface statistics, masquerade connections, and multicast memberships. It is an essential tool for network administrators and developers to diagnose and troubleshoot network-related issues. While it is considered deprecated in favor of the ss command on newer Linux systems, netstat remains widely used and available on many platforms, including Windows.

Common Netstat Usage Examples

Here are some of the most common and useful ways to employ the netstat command:

Display All Active Internet Connections

To see all active TCP and UDP connections and listening ports, use the -a flag:

netstat -a

Show Only Listening Ports

If you want to identify which applications are listening for incoming connections, use the -l flag:

netstat -l

Display Statistics for Each Protocol

To get a summary of network statistics for each protocol (like IP, ICMP, TCP, UDP), use the -s flag:

netstat -s

Show the Routing Table

View the kernel's IP routing table by using the -r flag:

netstat -r

Display Addresses in Numeric Form

To prevent netstat from trying to resolve hostnames, port numbers, or usernames, use the -n flag. This can speed up the output and is often useful for clarity:

netstat -n

Display Only TCP Connections

Filter the output to show only TCP connections with the -t flag:

netstat -t

Display Only UDP Connections

Similarly, to display only UDP connections, use the -u flag:

netstat -u

Display PID and Program Name

To see the Process ID (PID) and the name of the program associated with each connection, use the -p flag (often requires root/administrator privileges):

netstat -p

Continuous Output

To continuously refresh the netstat output at a specified interval (e.g., every 1 second), use the -c flag:

netstat -c

Display Multicast Group Memberships

To show the multicast group memberships for active network interfaces, use the -g flag:

netstat -g

Further Resources

• MDN Web Docs - MIME types (Related to network protocols)
• RFC 793 - Transmission Control Protocol (Defines TCP)
• RFC 768 - User Datagram Protocol (Defines UDP)
• Wireshark Wiki - Netstat (External resource for network analysis)