How to install netstat
netstatĀ is a useful tool for checking your network configuration and activity. It is in fact a collection of several tools lumped together.
Install “net-tools” package using yum
[root@livedvd ~]$ sudo yum install net-tools Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: centos.mirror.secureax.com * extras: centos.mirror.secureax.com * updates: centos.mirror.secureax.com Resolving Dependencies --> Running transaction check ---> Package net-tools.x86_64 0:2.0-0.17.20131004git.el7 will be installed --> Finished Dependency Resolution Dependencies Resolved =============================================================================== PackageĀ Ā Ā Ā Ā Ā Ā Ā ArchĀ Ā Ā Ā Ā Ā Ā Ā VersionĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā RepositoryĀ Size ================================================================================ Installing: net-toolsĀ Ā Ā Ā Ā Ā x86_64Ā Ā Ā Ā Ā Ā 2.0-0.17.20131004git.el7Ā Ā Ā Ā Ā Ā Ā Ā baseĀ Ā Ā Ā Ā Ā 304 k Transaction Summary ================================================================================ InstallĀ 1 Package Total download size: 304 k Installed size: 917 k Is this ok [y/d/N]: y Downloading packages: net-tools-2.0-0.17.20131004git.el7.x86_64.rpmĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā | 304 kBĀ Ā 00:00 Running transaction check Running transaction test Transaction test succeeded Running transaction Installing : net-tools-2.0-0.17.20131004git.el7.x86_64Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā 1/1 VerifyingĀ : net-tools-2.0-0.17.20131004git.el7.x86_64Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā 1/1 Installed: net-tools.x86_64 0:2.0-0.17.20131004git.el7
Complete!
The netstat Command
Displaying the Routing Table
When you invokeĀ netstatĀ with theĀ ārĀ flag, it displays the kernel routing table in the way we’ve been doing withĀ route. OnĀ vstout, it produces:
# netstat -nr Kernel IP routing table DestinationĀ Ā GatewayĀ Ā Ā Ā Ā GenmaskĀ Ā Ā Ā Ā Ā Ā Ā FlagsĀ MSS WindowĀ irtt Iface 127.0.0.1Ā Ā Ā Ā *Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā 255.255.255.255 UHĀ Ā Ā Ā Ā Ā 0 0Ā Ā Ā Ā Ā Ā Ā Ā Ā 0 lo 172.16.1.0Ā Ā Ā *Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā 255.255.255.0Ā Ā UĀ Ā Ā Ā Ā Ā Ā 0 0Ā Ā Ā Ā Ā Ā Ā Ā Ā 0 eth0 172.16.2.0Ā Ā Ā 172.16.1.1Ā Ā 255.255.255.0Ā Ā UGĀ Ā Ā Ā Ā Ā 0 0Ā Ā Ā Ā Ā Ā Ā Ā Ā 0 eth0 |
TheĀ ānĀ option makesĀ netstatĀ print addresses as dotted quad IP numbers rather than the symbolic host and network names. This option is especially useful when you want to avoid address lookups over the network (e.g., to a DNS or NIS server).
The second column ofĀ netstat‘s output shows the gateway to which the routing entry points. If no gateway is used, an asterisk is printed instead. The third column shows the āgeneralityā of the route, i.e., the network mask for this route. When given an IP address to find a suitable route for, the kernel steps through each of the routing table entries, taking the bitwise AND of the address and the genmask before comparing it to the target of the route.
The fourth column displays the following flags that describe the route:
G | The route uses a gateway. |
U | The interface to be used is up. |
H | Only a single host can be reached through the route. For example, this is the case for the loopback entryĀ 127.0.0.1. |
D | This route is dynamically created. It is set if the table entry has been generated by a routing daemon likeĀ gatedĀ or by an ICMP redirect message |
M | This route is set if the table entry was modified by an ICMP redirect message. |
! | The route is a reject route and datagrams will be dropped. |
The next three columns show the MSS, Window and irtt that will be applied to TCP connections established via this route. The MSS is the Maximum Segment Size and is the size of the largest datagram the kernel will construct for transmission via this route. The Window is the maximum amount of data the system will accept in a single burst from a remote host. The acronymĀ irttĀ stands for āinitial round trip time.ā The TCP protocol ensures that data is reliably delivered between hosts by retransmitting a datagram if it has been lost. The TCP protocol keeps a running count of how long it takes for a datagram to be delivered to the remote end, and an acknowledgement to be received so that it knows how long to wait before assuming a datagram needs to retransmitted; this process is called the round-trip time. The initial round-trip time is the value that the TCP protocol will use when a connection is first established. For most network types, the default value is okay, but for some slow networks, notably certain types of amateur packet radio networks, the time is too short and causes unnecessary retransmission. TheĀ irttĀ value can be set using theĀ routeĀ command. Values of zero in these fields mean that the default is being used.
Finally, the last field displays the network interface that this route will use.
Displaying Interface Statistics
When invoked with theĀ āiĀ flag,Ā netstatĀ displays statistics for the network interfaces currently configured. If theĀ āaĀ option is also given, it printsĀ allĀ interfaces present in the kernel, not only those that have been configured currently. OnĀ vstout, the output fromĀ netstatĀ will look like this:
# netstat -i Kernel Interface table Iface MTU MetĀ RX-OK RX-ERR RX-DRP RX-OVRĀ TX-OK TX-ERR TX-DRP TX-OVR Flags loĀ Ā Ā Ā Ā 0Ā Ā 0Ā Ā 3185Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0Ā Ā 3185Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 BLRU eth0 1500Ā Ā 0 972633Ā Ā Ā Ā 17Ā Ā Ā Ā 20Ā Ā Ā 120 628711Ā Ā Ā 217Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 BRU |
TheĀ MTUĀ andĀ MetĀ fields show the current MTU and metric values for that interface. TheĀ RXĀ andĀ TXĀ columns show how many packets have been received or transmitted error-free (RX-OK/TX-OK) or damaged (RX-ERR/TX-ERR); how many were dropped (RX-DRP/TX-DRP); and how many were lost because of an overrun (RX-OVR/TX-OVR).
The last column shows the flags that have been set for this interface. These characters are one-character versions of the long flag names that are printed when you display the interface configuration with ifconfig:
B | A broadcast address has been set. |
L | This interface is a loopback device. |
M | All packets are received (promiscuous mode). |
O | ARP is turned off for this interface. |
P | This is a point-to-point connection. |
R | Interface is running. |
U | Interface is up. |
Displaying Connections
netstatĀ supports a set of options to display active or passive sockets. The optionsĀ āt,Ā āu,Ā āw, andĀ āxĀ show active TCP, UDP, RAW, or Unix socket connections. If you provide theĀ āaĀ flag in addition, sockets that are waiting for a connection (i.e., listening) are displayed as well. This display will give you a list of all servers that are currently running on your system.
InvokingĀ netstat -taĀ onĀ vlagerĀ produces this output:
$ netstat -ta Active Internet Connections Proto Recv-Q Send-Q Local AddressĀ Ā Ā Foreign AddressĀ Ā Ā (State) tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:domainĀ Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:timeĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:smtpĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 vlager:smtpĀ Ā Ā Ā Ā vstout:1040Ā Ā Ā Ā Ā Ā Ā ESTABLISHED tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:telnetĀ Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 localhost:1046Ā Ā vbardolino:telnetĀ ESTABLISHED tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:chargenĀ Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:daytimeĀ Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:discardĀ Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:echoĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:shellĀ Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:loginĀ Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN |
This output shows most servers simply waiting for an incoming connection. However, the fourth line shows an incoming SMTP connection fromĀ vstout, and the sixth line tells you there is an outgoingĀ telnetconnection toĀ vbardolino.
Using theĀ āaĀ flag by itself will display all sockets from all families.
Top 20 command netstat for network management
- Listing all the LISTENING Ports of TCP and UDP connections
Listing all ports (both TCP and UDP) usingĀ netstatĀ -a option.
# netstat -a | more Active Internet connections (servers and established) Proto Recv-Q Send-Q Local AddressĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Foreign AddressĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā State tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:sunrpcĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā 52 192.168.0.2:sshĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā 192.168.0.1:egsĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā ESTABLISHED tcpĀ Ā Ā Ā Ā Ā Ā 1Ā Ā Ā Ā Ā 0 192.168.0.2:59292Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā www.gov.com:httpĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā CLOSE_WAIT tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 localhost:smtpĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:59482Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN udpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:35036Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:* udpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:npmp-localĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:* Active UNIX domain sockets (servers and established) Proto RefCnt FlagsĀ Ā Ā Ā Ā Ā TypeĀ Ā Ā Ā Ā Ā StateĀ Ā Ā Ā Ā Ā Ā Ā I-Node Path unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 16972Ā /tmp/orbit-root/linc-76b-0-6fa08790553d6 unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 17149Ā /tmp/orbit-root/linc-794-0-7058d584166d2 unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 17161Ā /tmp/orbit-root/linc-792-0-546fe905321cc unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 15938Ā /tmp/orbit-root/linc-74b-0-415135cb6aeab
- Listing TCP Ports connections
Listing onlyĀ TCPĀ (Transmission Control Protocol) port connections usingĀ netstat -at.
# netstat -at Active Internet connections (servers and established) Proto Recv-Q Send-Q Local AddressĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Foreign AddressĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā State tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:sshĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 localhost:ippĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 localhost:smtpĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā 52 192.168.0.2:sshĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā 192.168.0.1:egsĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā ESTABLISHED tcpĀ Ā Ā Ā Ā Ā Ā 1Ā Ā Ā Ā Ā 0 192.168.0.2:59292Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā www.gov.com:httpĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā CLOSE_WAIT
- Listing UDP Ports connections
Listing onlyĀ UDPĀ (User Datagram ProtocolĀ ) port connections usingĀ netstat -au.
# netstat -au Active Internet connections (servers and established) Proto Recv-Q Send-Q Local AddressĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Foreign AddressĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā State udpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:35036Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:* udpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:npmp-localĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:* udpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:mdnsĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*
- Listing all LISTENING Connections
Listing all active listening ports connections withĀ netstat -l.
# netstat -l Active Internet connections (only servers) Proto Recv-Q Send-Q Local AddressĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Foreign AddressĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā State tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:sunrpcĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:58642Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:sshĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN udpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:35036Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:* udpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:npmp-localĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:* Active UNIX domain sockets (only servers) Proto RefCnt FlagsĀ Ā Ā Ā Ā Ā TypeĀ Ā Ā Ā Ā Ā StateĀ Ā Ā Ā Ā Ā Ā Ā I-Node Path unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 16972Ā /tmp/orbit-root/linc-76b-0-6fa08790553d6 unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 17149Ā /tmp/orbit-root/linc-794-0-7058d584166d2 unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 17161Ā /tmp/orbit-root/linc-792-0-546fe905321cc unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 15938Ā /tmp/orbit-root/linc-74b-0-415135cb6aeab
- Listing all TCP Listening Ports
Listing all active listening TCP ports by using optionĀ netstat -lt.
# netstat -lt Active Internet connections (only servers) Proto Recv-Q Send-Q Local AddressĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Foreign AddressĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā State tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:dctpĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:mysqlĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:sunrpcĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:muninĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:ftpĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 localhost.localdomain:ippĀ Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 localhost.localdomain:smtpĀ *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:httpĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:sshĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:httpsĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN
- Listing all UDP Listening Ports
Listing all active listening UDP ports by using optionĀ netstat -lu.
# netstat -lu Active Internet connections (only servers) Proto Recv-Q Send-Q Local AddressĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Foreign AddressĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā State udpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:39578Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:* udpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:meregisterĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:* udpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:vpps-quaĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:* udpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:openvpnĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:* udpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:mdnsĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:* udpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:sunrpcĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:* udpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:ippĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:* udpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:60222Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:* udpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:mdnsĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*
- Listing all UNIX Listening Ports
Listing all active UNIX listening ports usingĀ netstat -lx.
# netstat -lx Active UNIX domain sockets (only servers) Proto RefCnt FlagsĀ Ā Ā Ā Ā Ā TypeĀ Ā Ā Ā Ā Ā StateĀ Ā Ā Ā Ā Ā Ā Ā I-Node Path unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 4171Ā Ā @ISCSIADM_ABSTRACT_NAMESPACE unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 5767Ā Ā /var/run/cups/cups.sock unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 7082Ā Ā @/tmp/fam-root- unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 6157Ā Ā /dev/gpmctl unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 6215Ā Ā @/var/run/hald/dbus-IcefTIUkHm unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 6038Ā Ā /tmp/.font-unix/fs7100 unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 6175Ā Ā /var/run/avahi-daemon/socket unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 4157Ā Ā @ISCSID_UIP_ABSTRACT_NAMESPACE unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 60835836 /var/lib/mysql/mysql.sock unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 4645Ā Ā /var/run/audispd_events unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 5136Ā Ā /var/run/dbus/system_bus_socket unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 6216Ā Ā @/var/run/hald/dbus-wsUBI30V2I unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 5517Ā Ā /var/run/acpid.socket unixĀ 2Ā Ā Ā Ā Ā [ ACC ]Ā Ā Ā Ā STREAMĀ Ā Ā Ā LISTENINGĀ Ā Ā Ā 5531Ā Ā /var/run/pcscd.comm
- Showing Statistics by Protocol
Displays statistics by protocol. By default, statistics are shown for the TCP, UDP, ICMP, and IP protocols. The -s parameter can be used to specify a set of protocols.
# netstat -s Ip: 2461 total packets received 0 forwarded 0 incoming packets discarded 2431 incoming packets delivered 2049 requests sent out Icmp: 0 ICMP messages received 0 input ICMP message failed. ICMP input histogram: 1 ICMP messages sent 0 ICMP messages failed ICMP output histogram: destination unreachable: 1 Tcp: 159 active connections openings 1 passive connection openings 4 failed connection attempts 0 connection resets received 1 connections established 2191 segments received 1745 segments send out 24 segments retransmited 0 bad segments received. 4 resets sent Udp: 243 packets received 1 packets to unknown port received. 0 packet receive errors 281 packets sent
- Showing Statistics by TCP Protocol
Showing statistics of only TCP protocol by using optionĀ netstat -st.
# netstat -st Tcp: 2805201 active connections openings 1597466 passive connection openings 1522484 failed connection attempts 37806 connection resets received 1 connections established 57718706 segments received 64280042 segments send out 3135688 segments retransmited 74 bad segments received. 17580 resets sent
- Showing Statistics by UDP Protocol
# netstat -su Udp: 1774823 packets received 901848 packets to unknown port received. 0 packet receive errors 2968722 packets sent
- Displaying Service name with PID
Displaying service name with their PID number, using optionĀ netstat -tpĀ will display āPID/Program Nameā.
# netstat -tp Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local AddressĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Foreign AddressĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā StateĀ Ā Ā Ā Ā Ā PID/Program name tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 192.168.0.2:sshĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā 192.168.0.1:egsĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā ESTABLISHED 2179/sshd tcpĀ Ā Ā Ā Ā Ā Ā 1Ā Ā Ā Ā Ā 0 192.168.0.2:59292Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā www.gov.com:httpĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā CLOSE_WAITĀ 1939/clock-applet
- Displaying Promiscuous Mode
Displaying Promiscuous mode with -ac switch, netstat print the selected information or refresh screen every five second. Default screen refresh in every second.
# netstat -ac 5 | grep tcp tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:sunrpcĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:58642Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:sshĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 localhost:ippĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 localhost:smtpĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 1Ā Ā Ā Ā Ā 0 192.168.0.2:59447Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā www.gov.com:httpĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā CLOSE_WAIT tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā 52 192.168.0.2:sshĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā 192.168.0.1:egsĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā ESTABLISHED tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:sunrpcĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:sshĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 localhost:ippĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 localhost:smtpĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:59482Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTEN
- Displaying Kernel IP routing
Display Kernel IP routing table with netstat and route command.
# netstat -r Kernel IP routing table DestinationĀ Ā Ā Ā GatewayĀ Ā Ā Ā Ā Ā Ā Ā GenmaskĀ Ā Ā Ā Ā Ā Ā Ā FlagsĀ Ā MSS WindowĀ irtt Iface 192.168.0.0Ā Ā Ā Ā *Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā 255.255.255.0Ā Ā UĀ Ā Ā Ā Ā Ā Ā Ā 0 0Ā Ā Ā Ā Ā Ā Ā Ā Ā 0 eth0 link-localĀ Ā Ā Ā Ā *Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā 255.255.0.0Ā Ā Ā Ā UĀ Ā Ā Ā Ā Ā Ā Ā 0 0Ā Ā Ā Ā Ā Ā Ā Ā Ā 0 eth0 defaultĀ Ā Ā Ā Ā Ā Ā Ā 192.168.0.1Ā Ā Ā Ā 0.0.0.0Ā Ā Ā Ā Ā Ā Ā Ā UGĀ Ā Ā Ā Ā Ā Ā 0 0Ā Ā Ā Ā Ā Ā Ā Ā Ā 0 eth0
- Showing Network Interface Transactions
Showing network interface packet transactions including both transferring and receiving packets with MTU size.
# netstat -i Kernel Interface table IfaceĀ Ā Ā Ā Ā Ā MTU MetĀ Ā Ā RX-OK RX-ERR RX-DRP RX-OVRĀ Ā Ā TX-OK TX-ERR TX-DRP TX-OVR Flg eth0Ā Ā Ā Ā Ā Ā 1500Ā Ā 0Ā Ā Ā Ā 4459Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0Ā Ā Ā Ā 4057Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 BMRU loĀ Ā Ā Ā Ā Ā Ā 16436Ā Ā 0Ā Ā Ā Ā Ā Ā Ā 8Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā Ā Ā 8Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 LRU
- Showing Kernel Interface Table
Showing Kernel interface table, similar toĀ ifconfigĀ command.
# netstat -ie Kernel Interface table eth0Ā Ā Ā Ā Ā Link encap:EthernetĀ HWaddr 00:0C:29:B4:DA:21 inet addr:192.168.0.2Ā Bcast:192.168.0.255Ā Mask:255.255.255.0 inet6 addr: fe80::20c:29ff:feb4:da21/64 Scope:Link UP BROADCAST RUNNING MULTICASTĀ MTU:1500Ā Metric:1 RX packets:4486 errors:0 dropped:0 overruns:0 frame:0 TX packets:4077 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:2720253 (2.5 MiB)Ā TX bytes:1161745 (1.1 MiB) Interrupt:18 Base address:0x2000 loĀ Ā Ā Ā Ā Ā Ā Link encap:Local Loopback inet addr:127.0.0.1Ā Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNINGĀ MTU:16436Ā Metric:1 RX packets:8 errors:0 dropped:0 overruns:0 frame:0 TX packets:8 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:480 (480.0 b)Ā TX bytes:480 (480.0 b)
- Displaying IPv4 and IPv6 Information
Displays multicast group membership information for both IPv4 and IPv6.
# netstat -g IPv6/IPv4 Group Memberships InterfaceĀ Ā Ā Ā Ā Ā RefCnt Group --------------- ------ --------------------- loĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā 1Ā Ā Ā Ā Ā all-systems.mcast.net eth0Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā 1Ā Ā Ā Ā Ā 224.0.0.251 eth0Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā 1Ā Ā Ā Ā Ā all-systems.mcast.net loĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā 1Ā Ā Ā Ā Ā ff02::1 eth0Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā 1Ā Ā Ā Ā Ā ff02::202 eth0Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā 1Ā Ā Ā Ā Ā ff02::1:ffb4:da21 eth0Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā 1Ā Ā Ā Ā Ā ff02::1
- Print Netstat Information Continuously
To get netstat information every few second, then use the following command, it will print netstat information continuously, say every few seconds.
# netstat -c Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local AddressĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Foreign AddressĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā State tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 tecmint.com:httpĀ Ā sg2nlhg007.shr.prod.s:36944 TIME_WAIT tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 tecmint.com:httpĀ Ā sg2nlhg010.shr.prod.s:42110 TIME_WAIT tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā 132 tecmint.com:sshĀ Ā Ā 115.113.134.3.static-:64662 ESTABLISHED tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 tecmint.com:httpĀ Ā crawl-66-249-71-240.g:41166 TIME_WAIT tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 localhost.localdomain:54823 localhost.localdomain:smtpĀ TIME_WAIT tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 localhost.localdomain:54822 localhost.localdomain:smtpĀ TIME_WAIT tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 tecmint.com:httpĀ Ā sg2nlhg010.shr.prod.s:42091 TIME_WAIT tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 tecmint.com:httpĀ Ā sg2nlhg007.shr.prod.s:36998 TIME_WAIT
- Finding non supportive Address
Finding un-configured address families with some useful information.
# netstat --verbose netstat: no support for `AF IPX' on this system. netstat: no support for `AF AX25' on this system. netstat: no support for `AF X25' on this system. netstat: no support for `AF NETROM' on this system.
- Finding Listening Programs
Find out how many listening programs running on a port.
# netstat -ap | grep http tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:httpĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTENĀ Ā Ā Ā Ā 9056/httpd tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 *:httpsĀ Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā *:*Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā LISTENĀ Ā Ā Ā Ā 9056/httpd tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 tecmint.com:httpĀ Ā sg2nlhg008.shr.prod.s:35248 TIME_WAITĀ Ā - tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 tecmint.com:httpĀ Ā sg2nlhg007.shr.prod.s:57783 TIME_WAITĀ Ā - tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 tecmint.com:httpĀ Ā sg2nlhg007.shr.prod.s:57769 TIME_WAITĀ Ā - tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 tecmint.com:httpĀ Ā sg2nlhg008.shr.prod.s:35270 TIME_WAITĀ Ā - tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 tecmint.com:httpĀ Ā sg2nlhg009.shr.prod.s:41637 TIME_WAITĀ Ā - tcpĀ Ā Ā Ā Ā Ā Ā 0Ā Ā Ā Ā Ā 0 tecmint.com:httpĀ Ā sg2nlhg009.shr.prod.s:41614 TIME_WAITĀ Ā - unixĀ 2Ā Ā Ā Ā Ā [ ]Ā Ā Ā Ā Ā Ā Ā Ā STREAMĀ Ā Ā Ā CONNECTEDĀ Ā Ā Ā 88586726 10394/httpd
- Displaying RAW Network Statistics
# netstat --statistics --raw Ip: 62175683 total packets received 52970 with invalid addresses 0 forwarded Icmp: 875519 ICMP messages received destination unreachable: 901671 echo request: 8 echo replies: 16253 IcmpMsg: InType0: 83 IpExt: InMcastPkts: 117