11 Best Netstat Commands for Linux Network Management

In this article, we are going to be taking a look at netstat command and how to fully utilize it for network and system management or administration for that matter.

By the end of this article the following concepts will be cleared:

  • What is netstat?
  • What is netstat command used for?
  • What does the netstat command do?

So for those of you who have not heard of netstat or what it does or how it can be useful, netstat is essentially a command line and network utility tool used to display routing table, interface table, multicast group memberships, networking statistics, etc.

Now for those of you who used it before you can pretty much vote for this.

Any of the system/network administrators out there you know it is an essential tool for any of you to use if you are trying to monitor the active connections on a computer, trying to shift through what connections are running, what services are running, etc.

Now netstat is pre-installed on almost all Linux distributions.

If you are on a Debian-based Linux machine and don’t have netstat installed then you can install that with the help of the following command.

$ sudo apt-get install net-tools

and If you are on an RPM-based Linux machine like Redhat or CentOS then you can install this with the help of the following command.

# yum -y install net-tools

If net-tools is not installed in your system, then you will get this error when you run the netstat command.

“netstat command not found”

# netstat command not found

Using it is extremely simple and hopefully, in this guide, I can cover some of the commands that make my life a whole lot easier and will help you sort through all the networking in regards to what’s running on your computer.

I am running Ubuntu 18.04 here in a virtualized environment.

Therefore, without any further discussion, let’s learn how to use the netstat command in Linux with examples.

Now netstat command as I mentioned is a very simple command to use but can be very much confusing in regards to the results that you can enumerate.

If I am just to hit the following command to bring up the help menu.

# netstat --help

If you run this command on your system you will see there is a lot of information that you can use and of course this is all in regards to a various networking functions and information that you can gather.

When we talk about all the arguments or parameters, whatever you want to call them they can be sorted in various ways that will then give you a very different representation of the data.

So by using both or any of these parameters together you also can get a very different bits of information together.

I will be simply showing you the commands and explaining what each of them does but you can definitely check out the manual that if you want.

1. Display all your Network Interfaces

To list all your network interfaces that you currently have running use the -ie option with the netstat command.

Similar to what you would have if you ran ifconfig or ip a command.

# netstat -ie

Output:

Kernel Interface table
ens33: flags=4163  mtu 1500
        inet 192.168.85.128  netmask 255.255.255.0  broadcast 192.168.85.255
        inet6 fe80::8a24:25e6:275d:9979  prefixlen 64  scopeid 0x20
        ether 00:0c:29:a2:ac:29  txqueuelen 1000  (Ethernet)
        RX packets 61731  bytes 51132284 (48.7 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 43920  bytes 6013689 (5.7 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 3720  bytes 319364 (311.8 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 3720  bytes 319364 (311.8 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

So looking at the output above you can definitely get a better idea of what network interfaces are running on the computer.

Type the following command to display a table of all network interfaces.

# netstat -i
Kernel Interface table
Iface             MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
ens33            1500    77631      0      0 0         48780      0      0      0 BMRU
lo              65536     3724      0      0 0          3724      0      0      0 LRU

Where:

  • MTU – Stands for Maximum Transmission Unit. It refers to the size (in bytes) of the largest datagram that a given layer of a communications protocol can pass at a time.

    You can check MTU details using the ifconfig command.
  • RX-OK & TX-OK – It shows how many packets were received or transmitted without any error.
  • RX-ERR & TX-ERR – This indicates how many packets were damaged during the transmit or receive.
  • RX-DRP & TX-DRP – This indicates how many packets were dropped at the time of transmitting or receive.
  • RX-OVR & TX-OVR – This indicates how many packets were lost due to overrun at the time of transmitting or receive.

2. Display current routing table

Following command allows you to display your current IP routing table which is very important because many of you really do not understand why routing is important.

If you do want to display your current IP routing table use the -r option with the netstat.

# netstat -r
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
default         _gateway        0.0.0.0         UG        0 0          0 ens33
192.168.85.0    0.0.0.0         255.255.255.0   U         0 0          0 ens33

3. Print continuous output of information

To print continuous output of information in regards to your current active connections whether it be TCP, UDP regardless of their state use the -c option with the netstat command.

The state could be LISTENING, ESTABLISHED, CONNECTED etc.

# netstat -c

Output:

Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
udp        0      0 localhost.locald:bootpc 192.168.85.254:bootps   ESTABLISHED
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags       Type       State         I-Node   Path
unix  24     [ ]         DGRAM                    12813    /run/systemd/journal/dev-log
unix  2      [ ]         DGRAM                    44838    /run/user/0/systemd/notify
unix  2      [ ]         DGRAM                    29507    /var/run/chrony/chronyd.sock
unix  2      [ ]         DGRAM                    36275    /run/user/42/systemd/notify
unix  3      [ ]         DGRAM                    12752    /run/systemd/notify
unix  2      [ ]         DGRAM                    12754    /run/systemd/cgroups-agent
unix  8      [ ]         DGRAM                    12770    /run/systemd/journal/socket
unix  3      [ ]         STREAM     CONNECTED     51960    @/tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     48740    /run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     47194    
unix  3      [ ]         STREAM     CONNECTED     46837    
unix  3      [ ]         STREAM     CONNECTED     32493    
unix  3      [ ]         STREAM     CONNECTED     51458    @/tmp/dbus-uzBIQxv3Sp

As you can see from the output above it’s just simply print out all the output information’s that is currently available and it’s not going to stop there.

Sorting out the output of netstat is very simple to understand and it’s very intuitive.

You can press CTRL+c to terminate the output.

By default, this information is refreshed every second but if you want, you can set a specific refresh time.

Let’s take an example.

The following command will refresh the information every 5 seconds.

# netstat -ac 5 | grep udp

4. Display both listening and non-listening sockets

Now if you want to list all connections/sockets(listening and non-listening) that are currently connected, you can do that by passing the -a option to netstat.

This command will list all available connections related to both TCP and UDP.

# netstat -a

Output:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN     
tcp        0      0 localhost:ipp           0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:sunrpc          0.0.0.0:*               LISTEN     
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN     
tcp6       0      0 localhost:ipp           [::]:*                  LISTEN     
tcp6       0      0 [::]:sunrpc             [::]:*                  LISTEN     
udp        0      0 localhost:323           0.0.0.0:*                          
udp        0      0 0.0.0.0:54715           0.0.0.0:*                          
udp        0      0 0.0.0.0:bootps          0.0.0.0:*                          
udp        0      0 localhost.locald:bootpc 192.168.85.254:bootps   ESTABLISHED
udp        0      0 0.0.0.0:sunrpc          0.0.0.0:*                          
udp        0      0 0.0.0.0:mdns            0.0.0.0:*                

The output of this command can be very large, which will not come in one screen.

So by adding more command through the pipe(|), you can show one screenful at a time.

# netstat -a | more
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN     
tcp        0      0 localhost:ipp           0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:sunrpc          0.0.0.0:*               LISTEN     
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN     
tcp6       0      0 localhost:ipp           [::]:*                  LISTEN     
tcp6       0      0 [::]:sunrpc             [::]:*                  LISTEN     
udp        0      0 localhost:323           0.0.0.0:*                          
udp        0      0 0.0.0.0:54715           0.0.0.0:*                          
udp        0      0 0.0.0.0:bootps          0.0.0.0:*                          
udp        0      0 localhost.locald:bootpc 192.168.85.254:bootps   ESTABLISHED
udp        0      0 0.0.0.0:sunrpc          0.0.0.0:*                          
udp        0      0 0.0.0.0:mdns            0.0.0.0:*                          
udp6       0      0 localhost:323           [::]:*                             
udp6       0      0 [::]:sunrpc             [::]:*                             
udp6       0      0 [::]:40067              [::]:*                             
udp6       0      0 [::]:mdns               [::]:*                             
raw6       0      0 [::]:ipv6-icmp          [::]:*                  7          
--More--

5. Displaying of data via protocol(TCP/UDP)

Now when you talk about displaying of data via a protocol that can be either TCP or UDP.

That can be done again very simply.

5.1 Displaying of data via TCP protocol

So to list out all the current active TCP connections pass the -at option to the netstat command.

# netstat -at

Output:

you can confirm the active TCP connections by looking at the protocol right on the below output.

So regardless of the other bits of information or regardless of the state all we are focusing on now is the TCP protocol.

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN     
tcp        0      0 localhost:ipp           0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:sunrpc          0.0.0.0:*               LISTEN     
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN     
tcp6       0      0 localhost:ipp           [::]:*                  LISTEN     
tcp6       0      0 [::]:sunrpc             [::]:*                  LISTEN     

5.2 Displaying of data via UDP protocol

So if we can do that for TCP, we can definitely do it for UDP. Let’s do that right now.

Similarly to list out all the current active UDP connections pass the -au option to the netstat.

# netstat -au

Output:

you can confirm the active UDP connections by looking at the protocol right on the below output and of course, the state is non-existent because UDP is a connectionless protocol.

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
udp        0      0 localhost:323           0.0.0.0:*                          
udp        0      0 0.0.0.0:54715           0.0.0.0:*                          
udp        0      0 0.0.0.0:bootps          0.0.0.0:*                          
udp        0      0 localhost.locald:bootpc 192.168.85.254:bootps   ESTABLISHED
udp        0      0 0.0.0.0:sunrpc          0.0.0.0:*                          
udp        0      0 0.0.0.0:mdns            0.0.0.0:*                          
udp6       0      0 localhost:323           [::]:*                             
udp6       0      0 [::]:sunrpc             [::]:*                             
udp6       0      0 [::]:40067              [::]:*                             
udp6       0      0 [::]:mdns               [::]:*                             

Now that I have explained how the data is sorted in regards to the various columns. You have an understanding of how you can display the type of data you looking for.

6. Display listening server sockets

Now we will focus on a very interesting topic and that is the state.

If you are trying to look for various ports that could be open then you really need to know what ports have their state set to LISTEN.

This means they do not have an ESTABLISHED connection and they are simply listening.

To display only listening sockets pass the -l option to the netstat.

# netstat -l

6.1 Display listening server sockets for TCP ports

So If you want to do that for TCP ports then all we need to do is, use the -lt option with netstat command.

This will essentially be for all listening TCP ports.

# netstat -lt

Output:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN     
tcp        0      0 localhost:ipp           0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:sunrpc          0.0.0.0:*               LISTEN     
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN     
tcp6       0      0 localhost:ipp           [::]:*                  LISTEN     
tcp6       0      0 [::]:sunrpc             [::]:*                  LISTEN

As you can see from the output above these are all the ports whose state is set to LISTEN.

Now if you have noticed this output, all the names in the local address column have been resolved.

Local Address name resolved
Local Address name resolved

But if you want the name not to resolve and show only the IP address, then you can use an additional option and that is -n. Here is an example.

# netstat -tnl

Output:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN     
tcp6       0      0 :::22                   :::*                    LISTEN     
tcp6       0      0 ::1:631                 :::*                    LISTEN     
tcp6       0      0 :::111                  :::*                    LISTEN     
Name not resolved
Name not resolved

6.2 Display listening server sockets for UDP ports

Now if you want to display the listening UDP ports that are again can be done by passing the -lu option to the netstat command.

# netstat -lu

Output:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
udp        0      0 localhost:323           0.0.0.0:*                          
udp        0      0 0.0.0.0:54715           0.0.0.0:*                          
udp        0      0 0.0.0.0:bootps          0.0.0.0:*                          
udp        0      0 0.0.0.0:sunrpc          0.0.0.0:*                          
udp        0      0 0.0.0.0:mdns            0.0.0.0:*                          
udp6       0      0 localhost:323           [::]:*                             
udp6       0      0 [::]:sunrpc             [::]:*                             
udp6       0      0 [::]:40067              [::]:*                             
udp6       0      0 [::]:mdns               [::]:*               

So looking at the output above you can definitely get a better idea of what UDP services are listening as well but as I mentioned this is not held to high regard because UDP is a connectionless protocol.

So this state really does not matter for that.

Now if you have noticed this output, all the names in the local address column have been resolved.

But if you want the name not to resolve and show only the IP address, then you can use an additional option and that is -n. Here is an example.

# netstat -unl

Output:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
udp        0      0 127.0.0.1:323           0.0.0.0:*                          
udp        0      0 0.0.0.0:54715           0.0.0.0:*                          
udp        0      0 0.0.0.0:67              0.0.0.0:*                          
udp        0      0 0.0.0.0:111             0.0.0.0:*                          
udp        0      0 0.0.0.0:5353            0.0.0.0:*                          
udp6       0      0 ::1:323                 :::*                               
udp6       0      0 :::111                  :::*                               
udp6       0      0 :::40067                :::*                               
udp6       0      0 :::5353                 :::*                 

6.3 Display listening server sockets for UNIX ports

if you want to display the listening Unix ports that can be done by passing the -lx option to the netstat.

# netstat -lx

Output:

Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node   Path
unix  2      [ ACC ]     STREAM     LISTENING     514130   @/tmp/dbus-exsPxNPA
unix  2      [ ACC ]     STREAM     LISTENING     514129   @/tmp/dbus-jjQ0c2fp
unix  2      [ ACC ]     STREAM     LISTENING     22156    @/org/kernel/linux/storage/multipathd
unix  2      [ ACC ]     STREAM     LISTENING     37145    @/tmp/.ICE-unix/1591
unix  2      [ ACC ]     STREAM     LISTENING     29721    /var/run/vmware/guestServicePipe
unix  2      [ ACC ]     STREAM     LISTENING     45681    @/tmp/.ICE-unix/2208
unix  2      [ ACC ]     STREAM     LISTENING     46451    @/tmp/.X11-unix/X0
unix  2      [ ACC ]     STREAM     LISTENING     44842    /run/user/0/systemd/private
unix  2      [ ACC ]     STREAM     LISTENING     44853    /run/user/0/bus

7. Display PID/Program name for sockets

So let’s talk about process identification(PID).

To display PID/Program name for sockets pass the -p option to netstat command.

# netstat -p

Output:

Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
udp        0      0 localhost.locald:bootpc 192.168.85.254:bootps   ESTABLISHED 1133/NetworkManager 
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags       Type       State         I-Node   PID/Program name     Path
unix  25     [ ]         DGRAM                    12813    1/systemd            /run/systemd/journal/dev-log
unix  2      [ ]         DGRAM                    44838    2159/systemd         /run/user/0/systemd/notify
unix  2      [ ]         DGRAM                    29507    983/chronyd          /var/run/chrony/chronyd.sock
unix  2      [ ]         DGRAM                    36275    1493/systemd         /run/user/42/systemd/notify
unix  3      [ ]         DGRAM                    12752    1/systemd            /run/systemd/notify
unix  2      [ ]         DGRAM                    12754    1/systemd            /run/systemd/cgroups-agent
unix  8      [ ]         DGRAM                    12770    1/systemd            /run/systemd/journal/socket
unix  3      [ ]         STREAM     CONNECTED     51960    2301/Xwayland        @/tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     48740    945/dbus-daemon      /run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     47194    2351/dconf-service   
unix  3      [ ]         STREAM     CONNECTED     46837    2333/ibus-portal     
unix  3      [ ]         STREAM     CONNECTED     32493    1068/platform-pytho  
unix  3      [ ]         STREAM     CONNECTED     51458    2309/dbus-daemon     @/tmp/dbus-uzBIQxv3Sp
unix  3      [ ]         STREAM     CONNECTED     45679    2208/gnome-session-  
unix  3      [ ]         STREAM     CONNECTED     40533    1938/gsd-xsettings   

As you can see from the output above It shows you the current process which is very important.

In addition to this state, we now have the Process ID(PID) or the program that’s running.

7.1 Display all TCP connections with the Process ID(PID)

So now we can combine these various pieces of data by saying If you are looking for all TCP connections but also wanted to display the Process ID(PID).

You can do that by combining multiple options that is pass the -atp option to the netstat.

# netstat -atp

Output:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN      1150/sshd           
tcp        0      0 localhost:ipp           0.0.0.0:*               LISTEN      1152/cupsd          
tcp        0      0 0.0.0.0:sunrpc          0.0.0.0:*               LISTEN      1/systemd           
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN      1150/sshd           
tcp6       0      0 localhost:ipp           [::]:*                  LISTEN      1152/cupsd          
tcp6       0      0 [::]:sunrpc             [::]:*                  LISTEN      1/systemd           

As you can see from the output above its displaying all the processes and of course you can get a better idea of these services that are running.

7.2 Display all UDP connections with the Process ID(PID).

Similarly, If you are looking for all UDP connections but also wanted to display the Process ID(PID).

You can do that by passing the -aup option to the netstat.

# netstat -aup

Output:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
udp        0      0 localhost:323           0.0.0.0:*                           983/chronyd         
udp        0      0 0.0.0.0:54715           0.0.0.0:*                           963/avahi-daemon: r 
udp        0      0 0.0.0.0:bootps          0.0.0.0:*                           1742/dnsmasq        
udp        0      0 localhost.locald:bootpc 192.168.85.254:bootps   ESTABLISHED 1133/NetworkManager 
udp        0      0 0.0.0.0:sunrpc          0.0.0.0:*                           1/systemd           
udp        0      0 0.0.0.0:mdns            0.0.0.0:*                           963/avahi-daemon: r 
udp6       0      0 localhost:323           [::]:*                              983/chronyd         
udp6       0      0 [::]:sunrpc             [::]:*                              1/systemd           
udp6       0      0 [::]:40067              [::]:*                              963/avahi-daemon: r 
udp6       0      0 [::]:mdns               [::]:*                              963/avahi-daemon: r 

To check which port the service is running on, type the following command.

# netstat -ap | grep ssh | more
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN      61945/sshd          
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN      61945/sshd          
unix  2      [ ACC ]     STREAM     LISTENING     45782    2186/gnome-keyring-  /run/user/0/keyring/ssh
unix  3      [ ]         STREAM     CONNECTED     913099   61945/sshd           
unix  2      [ ]         STREAM     CONNECTED     913108   61945/sshd            

8. Display active connections for a particular port

Some of the other commands or essentially as I have mentioned before you can actually look for a specific port or service and this can be sorted out very simply.

Now when you are talking about lists essentially looking for a custom port that can be done by using grep command and that’s exactly what we are going to do.

Let’s say I was looking for SSH(Port: 22) only instead of running that command I can write a simple command here.

# netstat -nlp | grep :22
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1150/sshd           
tcp6       0      0 :::22                   :::*                    LISTEN      1150/sshd           

There you are. So it does show you all the various services that are running SSH.

That is excellent. So we can pretty much sort the data. Again I can do this for systemd(port: 111).

# netstat -nlp | grep :111
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      1/systemd           
tcp6       0      0 :::111                  :::*                    LISTEN      1/systemd           
udp        0      0 0.0.0.0:111             0.0.0.0:*                           1/systemd           
udp6       0      0 :::111                  :::*                                1/systemd        

There we are. It does give us the result that we are looking for. So that is how to list connections that are active for a particular port.

You can again see the power of netstat command. It can be used you know to understand what’s currently running on your computer.

You can also use another way of doing it which is what I also like using.

The reason I am telling you all these other ways is so that you have a variety of options that you can use whatever you feel comfortable with, whatever is intuitive for you.

So you can also run the following command to get a similar output like above.

# netstat -an | grep :22
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     
tcp6       0      0 :::22                   :::*                    LISTEN     

9. Display networking statistics

To display summary statistics for each protocol pass the -s option to the netstat command.

# netstat -s
Ip:
    Forwarding: 1
    36571 total packets received
    1 with invalid addresses
    0 forwarded
    0 incoming packets discarded
    26268 incoming packets delivered
    22694 requests sent out
    864 outgoing packets dropped
    2433 dropped because of missing route
Icmp:
    1886 ICMP messages received
    2 input ICMP message failed
    ICMP input histogram:
        destination unreachable: 1886
    1901 ICMP messages sent
    0 ICMP messages failed
    ICMP output histogram:
        destination unreachable: 1901
IcmpMsg:
        InType3: 1886
        OutType3: 1901
Tcp:
    163 active connection openings
    0 passive connection openings
    0 failed connection attempts
    11 connection resets received
    0 connections established
    19725 segments received
    15273 segments sent out
    17 segments retransmitted
    0 bad segments received
    46 resets sent
Udp:
    2775 packets received
    1882 packets to unknown port received
    0 packet receive errors
    5377 packets sent
    0 receive buffer errors
    0 send buffer errors

But if you want to show the summary network statistics for a particular protocol, then you can use appropriate options.

9.1 Display summary statistics for TCP

# netstat -st
Tcp:
    163 active connection openings
    0 passive connection openings
    0 failed connection attempts
    11 connection resets received
    0 connections established
    19725 segments received
    15273 segments sent out
    17 segments retransmitted
    0 bad segments received
    46 resets sent

9.2 Display summary statistics for UDP

# netstat -su
Udp:
    2778 packets received
    1882 packets to unknown port received
    0 packet receive errors
    5380 packets sent
    0 receive buffer errors
    0 send buffer errors

10. Display multicast group memberships

To display multicast group memberships use the -g option with the netstat command.

# netstat -g
IPv6/IPv4 Group Memberships
Interface       RefCnt Group
--------------- ------ ---------------------
lo              1      all-systems.mcast.net
ens33           1      224.0.0.251
ens33           1      all-systems.mcast.net
lo              1      ff02::1
lo              1      ff01::1
ens33           1      ff02::1:ff5d:9979
ens33           1      ff02::fb
ens33           1      ff02::1
ens33           1      ff01::1
virbr0          1      ff02::1
virbr0          1      ff01::1
virbr0-nic      1      ff02::1
virbr0-nic      1      ff01::1

11. Display non-supportive address families

Print useful information about unconfigured address families, type the following command.

# netstat --verbose | more

Output:

netstat: no support for `AF INET (sctp)' on this system.
netstat: no support for `AF INET (sctp)' on this system.
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
udp        0      0 localhost.locald:bootpc 192.168.85.254:bootps   ESTABLISHED
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags       Type       State         I-Node   Path
unix  25     [ ]         DGRAM                    12813    /run/systemd/journal/dev-log
unix  2      [ ]         DGRAM                    44838    /run/user/0/systemd/notify
unix  2      [ ]         DGRAM                    29507    /var/run/chrony/chronyd.sock
unix  2      [ ]         DGRAM                    36275    /run/user/42/systemd/notify
unix  3      [ ]         DGRAM                    12752    /run/systemd/notify
unix  2      [ ]         DGRAM                    12754    /run/systemd/cgroups-agent
unix  8      [ ]         DGRAM                    12770    /run/systemd/journal/socket
--More--

12. netstat Command Help/Manual page access

Use the following commands to access the Manual Page/Help Page of netstat command.

# man netstat

You can visit at following websites to get more information on netstat.

Conclusion

So that is How to essentially use netstat command.

I hope that now you have a good understanding of how the netstat command works and you have some ideas for how you can use this within your workflow.

If anyone does have any questions about what we covered in this guide then feel free to ask in the comment section below and I will do my best to answer those.

If you like our content, please consider buying us a coffee.

Buy Me A Coffee

We are thankful for your never ending support.

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.