{"id":122496,"date":"2025-02-11T08:22:11","date_gmt":"2025-02-11T08:22:11","guid":{"rendered":"\/tutorials\/?p=122496"},"modified":"2025-12-18T22:43:59","modified_gmt":"2025-12-18T22:43:59","slug":"netstat-command","status":"publish","type":"post","link":"\/my\/tutorials\/sell-vintage-clothing-online-9","title":{"rendered":"The netstat command in Linux"},"content":{"rendered":"<p><strong>netstat<\/strong> (short for <strong>network statistics<\/strong>) is a command-line tool for monitoring network connections, diagnosing issues, and gathering important network-related data. Available on Linux, Windows, and macOS, it provides real-time insights into active TCP and UDP connections, listening ports, routing tables, and network interfaces.<\/p><p>While modern Linux distributions have moved on to <strong>ss<\/strong> (socket statistics) due to its faster performance and more detailed output, <strong>netstat<\/strong> is still useful for troubleshooting network problems and performing security analysis.<\/p><p>In this article, we&rsquo;ll cover everything you need to know about the <strong>netstat<\/strong> command in Linux, from syntax and options to practical examples. By the end of this guide, you&rsquo;ll understand how to use <strong>netstat<\/strong> effectively to manage network activity on your system.<\/p><p>\n\n\n\n\n\n\n<\/p><h2 class=\"wp-block-heading\" id=\"h-netstat-command-syntax\"><strong>netstat command syntax<\/strong><\/h2><p>The basic syntax of the <strong>netstat<\/strong> command is:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">netstat [options]<\/pre><p>Running <strong>netstat<\/strong> without options will display a list of active network connections and socket statistics like this:<\/p><div class=\"wp-block-image\">\n<figure data-wp-context='{\"imageId\":\"69d00a119197e\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"305\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/02\/terminal-netstat-output-1024x305.png\" alt=\"The netstat command's output shows active internet connections and UNIX domain sockets\" class=\"wp-image-122500\" srcset=\"https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-output-1024x305.png 1024w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-output-300x89.png 300w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-output-150x45.png 150w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-output-768x229.png 768w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-output-1536x458.png 1536w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-output-2048x611.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><p>The first section of the output shows active connections with six columns:<\/p><ul class=\"wp-block-list\">\n<li><strong>Proto<\/strong> &ndash; displays the protocol used (TCP or UDP).<\/li>\n\n\n\n<li><strong>Recv-Q<\/strong> &ndash; shows the number of bytes received that are waiting to be processed.<\/li>\n\n\n\n<li><strong>Send-Q<\/strong> &ndash; indicates the number of bytes in the send queue waiting for transmission.<\/li>\n\n\n\n<li><strong>Local Address<\/strong> &ndash; displays the IP address and port number of the machine.<\/li>\n\n\n\n<li><strong>Foreign Address<\/strong> &ndash; shows the remote system&rsquo;s IP address and port number connected to the machine.<\/li>\n\n\n\n<li><strong>State<\/strong> &ndash; indicates the connection status, such as <strong>LISTEN<\/strong>, <strong>ESTABLISHED<\/strong>, or <strong>TIME_WAIT<\/strong>.<\/li>\n<\/ul><p>Meanwhile, you&rsquo;ll see UNIX domain statistics in the second section, which include:<\/p><ul class=\"wp-block-list\">\n<li><strong>Proto<\/strong> &ndash; specifies the protocol in use.<\/li>\n\n\n\n<li><strong>RefCnt<\/strong> &ndash; shows the reference count of the socket.<\/li>\n\n\n\n<li><strong>Flags<\/strong> &ndash; displays the socket flags, such as <strong>ACC<\/strong> (accept) or <strong>W<\/strong> (writeable).<\/li>\n\n\n\n<li><strong>Type<\/strong> &ndash; indicates the socket type, such as <strong>STREAM<\/strong>, <strong>DGRAM<\/strong>, or <strong>SEQPACKET<\/strong>.<\/li>\n\n\n\n<li><strong>State<\/strong> &ndash; shows the current state of the socket.<\/li>\n\n\n\n<li><strong>I-Node<\/strong> &ndash; represents the inode number associated with the socket.<\/li>\n\n\n\n<li><strong>Path<\/strong> &ndash; displays the file system path for the socket, if applicable.<\/li>\n<\/ul><h2 class=\"wp-block-heading\" id=\"h-netstat-command-options\"><strong>netstat command options<\/strong><\/h2><p>Like most <a href=\"\/my\/tutorials\/linux-commands\">Linux commands<\/a>, <strong>netstat<\/strong> provides several options to customize its output. Here are some of the most commonly used options:<\/p><figure tabindex=\"0\" class=\"wp-block-table\"><table><tbody><tr><td><strong>Option<\/strong><\/td><td><strong>Description<\/strong><\/td><\/tr><tr><td><strong>-a<\/strong><\/td><td>Displays all active connections, including both listening and non-listening sockets.<\/td><\/tr><tr><td><strong>-l<\/strong><\/td><td>Lists only listening sockets.<\/td><\/tr><tr><td><strong>-t<\/strong><\/td><td>Shows only TCP connections.<\/td><\/tr><tr><td><strong>-u<\/strong><\/td><td>Displays only UDP connections.<\/td><\/tr><tr><td><strong>-r<\/strong><\/td><td>Shows the system routing table.<\/td><\/tr><tr><td><strong>-p<\/strong><\/td><td>Displays the process ID (PID) and program name associated with each connection.<\/td><\/tr><tr><td><strong>-n<\/strong><\/td><td>Shows numerical addresses instead of resolving hostnames.<\/td><\/tr><tr><td><strong>-s<\/strong><\/td><td>Displays protocol statistics for TCP, UDP, and other supported protocols.<\/td><\/tr><tr><td><strong>-i<\/strong><\/td><td>Lists network interfaces and their statistics.<\/td><\/tr><tr><td><strong>&ndash;version<\/strong><\/td><td>Checks the installed <strong>netstat<\/strong> version on the system.<\/td><\/tr><\/tbody><\/table><\/figure><p>You can also combine multiple options to filter specific details. For instance, to list all listening TCP and UDP connections with numerical addresses and associated processes, type:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">netstat -tunlp<\/pre><div class=\"wp-block-image\">\n<figure data-wp-context='{\"imageId\":\"69d00a119310f\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"410\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/02\/terminal-netstat-tunlp-output-1024x410.png\" alt=\"The netstat -tunlp command's output shows all listening TCP and UDP connections with numerical addresses and related processes\" class=\"wp-image-122501\" srcset=\"https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tunlp-output-1024x410.png 1024w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tunlp-output-300x120.png 300w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tunlp-output-150x60.png 150w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tunlp-output-768x307.png 768w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tunlp-output-1536x615.png 1536w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tunlp-output-2048x820.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><h2 class=\"wp-block-heading\" id=\"h-netstat-command-examples\"><strong>netstat command examples<\/strong><\/h2><p>Unlike other network monitoring tools like <a href=\"\/my\/tutorials\/linux-telnet-command\">telnet<\/a>, which you need to install manually on Linux, <strong>netstat<\/strong> comes preinstalled on many distributions, so you can start executing commands immediately in the terminal.<\/p><p>If you want to use <strong>netstat<\/strong> on your Linux virtual private server (VPS), make sure you have SSH access to your server.<a href=\"\/my\/vps-hosting\"> Hostinger VPS<\/a> customers can find their SSH credentials in hPanel by going to <strong>VPS &rarr; Manage &rarr; SSH access<\/strong>.<\/p><div class=\"wp-block-image\">\n<figure data-wp-context='{\"imageId\":\"69d00a1194630\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"432\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/02\/hpanel-vps-overview-ssh-access-selected-1024x432.png\" alt=\"The SSH access tab in hPanel's VPS dashboard contains SSH credentials\" class=\"wp-image-122502\" srcset=\"https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/hpanel-vps-overview-ssh-access-selected-1024x432.png 1024w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/hpanel-vps-overview-ssh-access-selected-300x127.png 300w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/hpanel-vps-overview-ssh-access-selected-150x63.png 150w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/hpanel-vps-overview-ssh-access-selected-768x324.png 768w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/hpanel-vps-overview-ssh-access-selected-1536x648.png 1536w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/hpanel-vps-overview-ssh-access-selected-2048x864.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><p>We also provide a <strong>Browser terminal<\/strong> feature to run commands directly in a browser tab without additional terminal software. To access this feature, click the button in the top-right corner of your VPS dashboard.<\/p><?xml encoding=\"utf-8\" ?><figure class=\"wp-block-image size-large\"><a href=\"\/my\/vps-hosting\" target=\"_blank\" rel=\"noreferrer noopener\"><img decoding=\"async\" width=\"1024\" height=\"300\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2023\/02\/VPS-hosting-banner-1024x300.png\" alt=\"\" class=\"wp-image-77934\" srcset=\"https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2023\/02\/VPS-hosting-banner.png 1024w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2023\/02\/VPS-hosting-banner-300x88.png 300w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2023\/02\/VPS-hosting-banner-150x44.png 150w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2023\/02\/VPS-hosting-banner-768x225.png 768w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure><p>Additionally, <strong>Kodee AI Assistant<\/strong> can help you find the correct commands for specific tasks. Simply select <strong>Kodee AI Assistant<\/strong> from your VPS dashboard&rsquo;s left sidebar, type your prompt, and Kodee will suggest the appropriate command along with an explanation.<\/p><div class=\"wp-block-image\">\n<figure data-wp-context='{\"imageId\":\"69d00a1196919\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"614\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/02\/hpanel-vps-kodee-1024x614.png\" alt=\"Kodee AI Assistant in hPanel's VPS responds to a question about netstat\" class=\"wp-image-122504\" srcset=\"https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/hpanel-vps-kodee-1024x614.png 1024w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/hpanel-vps-kodee-300x180.png 300w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/hpanel-vps-kodee-150x90.png 150w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/hpanel-vps-kodee-768x461.png 768w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/hpanel-vps-kodee-1536x921.png 1536w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/hpanel-vps-kodee-2048x1228.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><h3 class=\"wp-block-heading\" id=\"h-view-all-active-connections\"><strong>View all active connections<\/strong><\/h3><p>The <strong>netstat -a<\/strong> command displays all active network connections, including listening and non-listening sockets. It helps diagnose network activity, open ports, and potential security risks by identifying unexpected connections.<\/p><p>Run the following command:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">netstat -a<\/pre><p>For example, if a connection&rsquo;s state is <strong>ESTABLISHED<\/strong>, it means an active two-way communication exists between your machine and a remote system. If it&rsquo;s <strong>LISTEN<\/strong>, the port is open and waiting for incoming connections.<\/p><div class=\"wp-block-image\">\n<figure data-wp-context='{\"imageId\":\"69d00a1197cec\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"698\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/02\/terminal-netstat-a-output-1024x698.png\" alt=\"The netstat -a command's output shows all active connections, including listening and non-listening ports\" class=\"wp-image-122505\" srcset=\"https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-a-output-1024x698.png 1024w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-a-output-300x204.png 300w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-a-output-150x102.png 150w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-a-output-768x523.png 768w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-a-output-1536x1047.png 1536w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-a-output-2048x1396.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><h3 class=\"wp-block-heading\" id=\"h-check-tcp-connections\"><strong>Check TCP connections<\/strong><\/h3><p>If you want to view only active <a href=\"\/my\/tutorials\/tcp-protocol\">Transmission Control Protocol (TCP)<\/a> connections, use <strong>netstat<\/strong> with the <strong>-a <\/strong>and <strong>-t<\/strong> options. This lets you quickly identify issues affecting TCP-based services such as web servers, SSH, and database connections.<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">netstat -at<\/pre><p>If you notice many <strong>ESTABLISHED<\/strong> connections, it may indicate a high load on a specific service or an ongoing attack. Meanwhile, multiple <strong>TIME_WAIT<\/strong> or <strong>CLOSE_WAIT<\/strong> states show that the server struggles to close connections properly, which can lead to resource exhaustion.<\/p><div class=\"wp-block-image\">\n<figure data-wp-context='{\"imageId\":\"69d00a1199218\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"421\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/02\/terminal-netstat-at-output-1024x421.png\" alt=\"The netstat -at command's output shows active TCP connections\" class=\"wp-image-122507\" srcset=\"https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-at-output-1024x421.png 1024w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-at-output-300x123.png 300w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-at-output-150x62.png 150w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-at-output-768x316.png 768w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-at-output-1536x632.png 1536w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-at-output-2048x843.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><h3 class=\"wp-block-heading\" id=\"h-list-all-udp-connections\"><strong>List all UDP connections<\/strong><\/h3><p>Monitoring User Datagram Protocol (UDP) connections helps identify packet loss, high latency, or unexpected traffic. To filter the output and display only UDP-based network activities, including both open and connected UDP ports, use this command:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">netstat -au<\/pre><p>Since UDP is a connectionless protocol, the output doesn&rsquo;t include values in the <strong>State<\/strong> column, unlike in the previous example that shows active TCP connections.<\/p><div class=\"wp-block-image\">\n<figure data-wp-context='{\"imageId\":\"69d00a119a887\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"228\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/02\/terminal-netstat-au-output-1024x228.png\" alt=\"The netstat -au command's output shows active UDP connections\" class=\"wp-image-122508\" srcset=\"https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-au-output-1024x228.png 1024w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-au-output-300x67.png 300w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-au-output-150x33.png 150w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-au-output-768x171.png 768w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-au-output-1536x343.png 1536w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-au-output-2048x457.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><p>\n\n<div class=\"protip\">\n                    <h4 class=\"title\">The difference between TCP and UDP<\/h4>\n                    <p> TCP establishes a connection before transmitting data for reliable and error-free communication, which is ideal for web browsing, file transfers, and email. In contrast, UDP sends packets without requiring a handshake, making it faster but less reliable, which suits low-latency applications like DNS lookups and VoIP.<\/p>\n                <\/div>\n\n\n\n<\/p><h3 class=\"wp-block-heading\" id=\"h-show-numerical-addresses\"><strong>Show numerical addresses<\/strong><\/h3><p>By default, <strong>netstat<\/strong> resolves hostnames into human-readable domain names, which can slow down command execution on networks with numerous connections. To disable hostname resolution and display numerical IP addresses, add the <strong>-n<\/strong> option:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">netstat -n<\/pre><p>When executed, <strong>netstat<\/strong> displays connections in numerical form, such as <strong>192.168.1.100:443<\/strong> instead of <strong>example.tld:443<\/strong>. This is useful when analyzing local and foreign addresses in active connections, as it provides a faster and clearer view of network activity.<\/p><div class=\"wp-block-image\">\n<figure data-wp-context='{\"imageId\":\"69d00a119be2d\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"463\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/02\/terminal-netstat-n-output-1024x463.png\" alt=\"The netstat -n command's output shows connections in numerical form\" class=\"wp-image-122509\" srcset=\"https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-n-output-1024x463.png 1024w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-n-output-300x136.png 300w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-n-output-150x68.png 150w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-n-output-768x347.png 768w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-n-output-1536x695.png 1536w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-n-output-2048x926.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><h3 class=\"wp-block-heading\" id=\"h-display-listening-ports\"><strong>Display listening ports<\/strong><\/h3><p>You can identify which services are actively listening for incoming connections on all open ports by executing:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">netstat -l<\/pre><p>The output displays only sockets in the <strong>LISTEN<\/strong> state, meaning they are actively waiting for incoming connections.<\/p><div class=\"wp-block-image\">\n<figure data-wp-context='{\"imageId\":\"69d00a119d2c5\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"641\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/02\/terminal-netstat-l-output-1024x641.png\" alt=\"The netstat -l command's output shows sockets in the LISTEN state\" class=\"wp-image-122510\" srcset=\"https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-l-output-1024x641.png 1024w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-l-output-300x188.png 300w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-l-output-150x94.png 150w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-l-output-768x481.png 768w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-l-output-1536x962.png 1536w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-l-output-2048x1282.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><p>For more filtered results, combine the <strong>-l <\/strong>option with <strong>-t<\/strong> for TCP or <strong>-u<\/strong> for UDP-only connections:<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">netstat -lt&nbsp; # Show only listening TCP ports<\/pre><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">netstat -lu&nbsp; # Show only listening UDP ports<\/pre><h3 class=\"wp-block-heading\" id=\"h-analyze-routing-tables\"><strong>Analyze routing tables<\/strong><\/h3><p>The <strong>netstat -r<\/strong> command examines how your system routes network traffic.<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">netstat -r<\/pre><p>It provides details such as destination networks, gateways, and interface information.<\/p><div class=\"wp-block-image\">\n<figure data-wp-context='{\"imageId\":\"69d00a119e84c\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"158\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/02\/terminal-netstat-r-output-1024x158.png\" alt=\"The netstat -r command's output shows an IP routing table\" class=\"wp-image-122511\" srcset=\"https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-r-output-1024x158.png 1024w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-r-output-300x46.png 300w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-r-output-150x23.png 150w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-r-output-768x118.png 768w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-r-output-1536x237.png 1536w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-r-output-2048x316.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><p>Here&rsquo;s what each column in the output represents:<\/p><ul class=\"wp-block-list\">\n<li><strong>Destination<\/strong> &ndash; the target network or IP address.<\/li>\n\n\n\n<li><strong>Gateway<\/strong> &ndash; the next hop for reaching the destination.<\/li>\n\n\n\n<li><strong>Genmask<\/strong> &ndash; the subnet mask defining the network range.<\/li>\n\n\n\n<li><strong>Flags<\/strong> &ndash; indicators such as <strong>UG<\/strong> (Up, Gateway) or <strong>U<\/strong> (Up, direct route).<\/li>\n\n\n\n<li><strong>MSS <\/strong>&ndash; the maximum segment size (MSS) for TCP connections on the route.<\/li>\n\n\n\n<li><strong>Window <\/strong>&ndash; the maximum TCP window size for the route.<\/li>\n\n\n\n<li><strong>irtt <\/strong>&ndash; the initial round-trip time (RTT) for TCP connections, measured in milliseconds.<\/li>\n\n\n\n<li><strong>Iface<\/strong> &ndash; the network interface handling the route.<\/li>\n<\/ul><h3 class=\"wp-block-heading\" id=\"h-identify-protocol-statistics\"><strong>Identify protocol statistics<\/strong><\/h3><p>Using <strong>netstat<\/strong> with the <strong>-s<\/strong> option, you can find detailed statistics for different network protocols, including TCP, UDP, ICMP, and IP. This is beneficial for identifying packet loss, transmission errors, and dropped connections.<\/p><pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">netstat -s<\/pre><p>The output organizes statistics by protocol. For instance, TCP stats include values for active connections, retransmissions, and dropped packets, while UDP stats show details on datagrams received, sent, or discarded.<\/p><div class=\"wp-block-image\">\n<figure data-wp-context='{\"imageId\":\"69d00a119fd2f\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" width=\"784\" height=\"1024\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/02\/terminal-netstat-s-output-784x1024.png\" alt=\"The netstat -s command's output shows statistics for different protocols\" class=\"wp-image-122512\" srcset=\"https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-s-output-784x1024.png 784w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-s-output-230x300.png 230w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-s-output-115x150.png 115w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-s-output-768x1002.png 768w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-s-output.png 1166w\" sizes=\"(max-width: 784px) 100vw, 784px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div><p><div class=\"protip\">\n                    <h4 class=\"title\">Pro tip<\/h4>\n                    <p>When troubleshooting network issues with <strong>netstat -s<\/strong>, look for:<\/p><li><strong>High retransmissions<\/strong> &ndash; indicates network congestion or unstable connections.\n<\/li><li><strong>Packet loss in UDP<\/strong> &ndash; suggests network interference or insufficient bandwidth.\n<\/li><li><strong>ICMP errors<\/strong> &ndash; signals routing issues or firewall restrictions.<\/p>\n                <\/div><br>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-find-connections-associated-with-a-specific-program\"><strong>Find connections associated with a specific program<\/strong><\/h3>\n\n\n\n<p>To identify which program owns a network connection, use the <strong>netstat -pt<\/strong> command. This displays active TCP connections along with the process ID (PID) and associated program name, helping you monitor running applications and detect suspicious activity.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">netstat -pt<\/pre>\n\n\n\n<p>You should see the <strong>PID\/Program name<\/strong> column on the far right of the output, as shown below:<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context='{\"imageId\":\"69d00a11a1151\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"104\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/02\/terminal-netstat-pt-output-1024x104.png\" alt=\"The netstat -pt command's output shows the programs associated with each network connection\" class=\"wp-image-122514\" srcset=\"https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-pt-output-1024x104.png 1024w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-pt-output-300x31.png 300w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-pt-output-150x15.png 150w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-pt-output-768x78.png 768w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-pt-output-1536x157.png 1536w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-pt-output-2048x209.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div>\n\n\n<p>Here, <strong>318706<\/strong> is the PID, while <strong>sshd<\/strong> is the program associated with the connection.<\/p>\n\n\n\n<p>If multiple connections share the same PID, a single application handles more than one session. Additionally, a dash (<strong>&ndash;<\/strong>) in the column indicates <strong>netstat<\/strong> couldn&rsquo;t retrieve the program name, usually due to permission restrictions.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-filter-output-with-options\"><strong>Filter output with options<\/strong><\/h3>\n\n\n\n<p>As previously explained, you can refine <strong>netstat<\/strong> output and focus on specific details by combining multiple options. Filtering out unnecessary data makes troubleshooting more efficient and helps pinpoint network issues faster.<\/p>\n\n\n\n<p>Here are a few useful combinations:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>List all listening TCP and UDP ports with numerical addresses:<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">netstat -tunl<\/pre>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context='{\"imageId\":\"69d00a11a27ab\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"562\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/02\/terminal-netstat-tunl-output-1024x562.png\" alt=\"The netstat -tunl command's output shows all listening TCP and UDP ports with numerical addresses\" class=\"wp-image-122517\" srcset=\"https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tunl-output-1024x562.png 1024w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tunl-output-300x165.png 300w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tunl-output-150x82.png 150w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tunl-output-768x421.png 768w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tunl-output-1536x842.png 1536w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tunl-output-2048x1123.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div>\n\n\n<ul class=\"wp-block-list\">\n<li>Display all active connections along with PIDs:<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">netstat -tapn<\/pre>\n\n\n\n<figure data-wp-context='{\"imageId\":\"69d00a11a3c9b\"}' data-wp-interactive=\"core\/image\" class=\"wp-block-image aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"329\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/02\/terminal-netstat-tapn-output-1024x329.png\" alt=\"The netstat -tapn command's output shows active connections with their PIDs\n\" class=\"wp-image-122518\" srcset=\"https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tapn-output-1024x329.png 1024w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tapn-output-300x96.png 300w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tapn-output-150x48.png 150w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tapn-output-768x247.png 768w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tapn-output-1536x494.png 1536w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tapn-output-2048x658.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Analyze routing tables with numerical addresses:<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">netstat -rn<\/pre>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context='{\"imageId\":\"69d00a11a5361\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"156\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/02\/terminal-netstat-rn-output-1024x156.png\" alt=\"The netstat -rn command's output shows an IP routing table with numerical addresses\" class=\"wp-image-122520\" srcset=\"https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-rn-output-1024x156.png 1024w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-rn-output-300x46.png 300w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-rn-output-150x23.png 150w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-rn-output-768x117.png 768w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-rn-output-1536x234.png 1536w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-rn-output-2048x312.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div>\n\n\n<ul class=\"wp-block-list\">\n<li>Monitor network interfaces and their statistics:<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">netstat -ie<\/pre>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context='{\"imageId\":\"69d00a11a6cc6\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"541\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/02\/terminal-netstat-ie-output-1024x541.png\" alt=\"The netstat -ie command's output shows network interfaces and their statistics\" class=\"wp-image-122521\" srcset=\"https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-ie-output-1024x541.png 1024w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-ie-output-300x158.png 300w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-ie-output-150x79.png 150w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-ie-output-768x406.png 768w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-ie-output-1536x811.png 1536w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-ie-output-2048x1082.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div>\n\n\n<h3 class=\"wp-block-heading\" id=\"h-use-netstat-with-other-commands\"><strong>Use netstat with other commands<\/strong><\/h3>\n\n\n\n<p>Besides combining multiple options to filter specific details, you can pipe <strong>netstat<\/strong> output to other command-line tools like <strong>grep<\/strong>, <strong>awk<\/strong>, and <strong>wc<\/strong>. This helps extract relevant network data and present it in a more readable format.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Filter connections by port number:<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">netstat -an | grep \":80\"<\/pre>\n\n\n\n<p>Here, <a href=\"\/my\/tutorials\/grep-command-in-linux\">grep<\/a> filters and displays only connections related to port <strong>80<\/strong> (HTTP).<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context='{\"imageId\":\"69d00a11a91d2\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"113\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/02\/terminal-netstat-an-grep-80-output-1024x113.png\" alt=\"The netstat -an | grep &quot;:80&quot; command's output shows connections related to port 80\" class=\"wp-image-122522\" srcset=\"https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-an-grep-80-output-1024x113.png 1024w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-an-grep-80-output-300x33.png 300w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-an-grep-80-output-150x17.png 150w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-an-grep-80-output-768x85.png 768w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-an-grep-80-output-1536x170.png 1536w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-an-grep-80-output-2048x227.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div>\n\n\n<ul class=\"wp-block-list\">\n<li>List only listening connections:<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">netstat -an | grep LISTEN<\/pre>\n\n\n\n<p>This filters the results to show only ports in the <strong>LISTEN<\/strong> state.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context='{\"imageId\":\"69d00a11aa880\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"536\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/02\/terminal-netstat-an-grep-listen-output-1024x536.png\" alt=\"The netstat -an | grep LISTEN shows ports in the LISTEN state\" class=\"wp-image-122523\" srcset=\"https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-an-grep-listen-output-1024x536.png 1024w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-an-grep-listen-output-300x157.png 300w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-an-grep-listen-output-150x79.png 150w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-an-grep-listen-output-768x402.png 768w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-an-grep-listen-output-1536x805.png 1536w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-an-grep-listen-output-2048x1073.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div>\n\n\n<ul class=\"wp-block-list\">\n<li>Extract PIDs associated with connections:<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">netstat -tpn | awk '{print $7}'<\/pre>\n\n\n\n<p>In this command, awk extracts the <strong>7th<\/strong> column containing PIDs and program names.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context='{\"imageId\":\"69d00a11abd65\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"174\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/02\/terminal-netstat-tpn-awk-print-7-output-1024x174.png\" alt=\"The netstat -tpn | awk '{print }' command's output shows PIDs and program names\" class=\"wp-image-122524\" srcset=\"https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tpn-awk-print-7-output-1024x174.png 1024w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tpn-awk-print-7-output-300x51.png 300w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tpn-awk-print-7-output-150x25.png 150w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tpn-awk-print-7-output-768x130.png 768w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tpn-awk-print-7-output-1536x261.png 1536w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-tpn-awk-print-7-output.png 1660w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div>\n\n\n<ul class=\"wp-block-list\">\n<li>Count the number of active connections:<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">netstat -an | wc -l<\/pre>\n\n\n\n<p><strong>wc -l <\/strong>counts the total number of currently active connections.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context='{\"imageId\":\"69d00a11ad1e1\"}' data-wp-interactive=\"core\/image\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"121\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-on-async--load=\"callbacks.setButtonStyles\" data-wp-on-async-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2025\/02\/terminal-netstat-an-wc-l-output-1024x121.png\" alt=\"The netstat -an | wc -l command's output shows the total active connections\" class=\"wp-image-122525\" srcset=\"https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-an-wc-l-output-1024x121.png 1024w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-an-wc-l-output-300x35.png 300w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-an-wc-l-output-150x18.png 150w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-an-wc-l-output-768x91.png 768w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-an-wc-l-output-1536x181.png 1536w, https:\/\/www.hostinger.com\/my\/tutorials\/wp-content\/uploads\/sites\/45\/2025\/02\/terminal-netstat-an-wc-l-output.png 1542w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button class=\"lightbox-trigger\" type=\"button\" aria-haspopup=\"dialog\" aria-label=\"Enlarge\" data-wp-init=\"callbacks.initTriggerButton\" data-wp-on-async--click=\"actions.showLightbox\" data-wp-style--right=\"state.imageButtonRight\" data-wp-style--top=\"state.imageButtonTop\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\"><\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div>\n\n\n<h2 class=\"wp-block-heading\" id=\"h-conclusion\"><strong>Conclusion<\/strong><\/h2>\n\n\n\n<p>The <strong>netstat<\/strong> command is a powerful tool for monitoring network-related information on various operating systems, including Linux. In this article, we&rsquo;ve explored its syntax, common options, and real-world use cases, such as displaying protocol statistics, listing active connections, and analyzing routing tables.<\/p>\n\n\n\n<p>By experimenting with different options and combining netstat with other commands like <strong>grep<\/strong> and <strong>awk<\/strong>, you can gain deeper insights into network activity and diagnose issues more effectively.<\/p>\n\n\n\n<p>However, <strong>netstat<\/strong> has been deprecated in some recent Linux distributions. While it&rsquo;s still useful for simple tasks, we recommend using <strong>ss<\/strong> (for socket statistics) and <strong>ip route<\/strong> (for routing analysis) as modern alternatives, as they offer faster performance and more detailed output.<\/p>\n\n\n\n<p>If you have any questions about <strong>netstat<\/strong> or want to share your experience using it &ndash; or switching to alternative tools &ndash; let us know in the comments below.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-netstat-command-faq\"><strong>netstat command FAQ<\/strong><\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-question-694483af6062c\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><strong>What does the netstat command do?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>The <strong>netstat<\/strong> command monitors network connections, displays routing tables, and provides protocol statistics. System administrators use it to diagnose connectivity problems, find open ports, and analyze traffic flow on Linux, Windows, and macOS.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-694483af6062e\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><strong>How do I use the netstat command?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>To use the netstat command, open a terminal window and type <strong>netstat<\/strong>. This displays active connections and socket statistics. You can add options for more detailed output, such as <strong>-t <\/strong>to list TCP connections and <strong>-l <\/strong>to show only listening ports.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-694483af6062f\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><strong>How is netstat different from the ss command?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>The <strong>ss<\/strong> command is a faster alternative to <strong>netstat<\/strong>, providing more detailed socket statistics with lower resource usage. Unlike <strong>netstat<\/strong>, <strong>ss<\/strong> retrieves real-time data directly from the kernel. Many modern Linux distributions have deprecated <strong>netstat<\/strong> in favor of <strong>ss<\/strong> for better performance and accuracy.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div><\/li>\n","protected":false},"excerpt":{"rendered":"<p>netstat (short for network statistics) is a command-line tool for monitoring network connections, diagnosing issues, and gathering important network-related data. Available on Linux, Windows, and macOS, it provides real-time insights into active TCP and UDP connections, listening ports, routing tables, and network interfaces. While modern Linux distributions have moved on to ss (socket statistics) due [&#8230;]<\/p>\n<p><a class=\"btn btn-secondary understrap-read-more-link\" href=\"\/my\/tutorials\/sell-vintage-clothing-online-9\">Read More&#8230;<\/a><\/p>\n","protected":false},"author":411,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"rank_math_title":"How to use the netstat command in Linux","rank_math_description":"The netstat command in Linux displays network-related information to run analysis and troubleshoot issues. Read this article to learn how to use it!","rank_math_focus_keyword":"netstat command","footnotes":""},"categories":[22643,22639],"tags":[],"class_list":["post-122496","post","type-post","status-publish","format-standard","hentry","category-managing-monitoring-and-security","category-vps"],"hreflangs":[{"locale":"en-US","link":"https:\/\/www.hostinger.com\/tutorials\/netstat-command","default":0},{"locale":"en-UK","link":"https:\/\/www.hostinger.com\/uk\/tutorials\/netstat-command","default":0},{"locale":"en-MY","link":"https:\/\/www.hostinger.com\/my\/tutorials\/netstat-command","default":0},{"locale":"en-PH","link":"https:\/\/www.hostinger.com\/ph\/tutorials\/netstat-command","default":0},{"locale":"en-IN","link":"https:\/\/www.hostinger.com\/in\/tutorials\/netstat-command","default":0},{"locale":"en-CA","link":"https:\/\/www.hostinger.com\/ca\/tutorials\/netstat-command","default":0},{"locale":"en-AU","link":"https:\/\/www.hostinger.com\/au\/tutorials\/netstat-command","default":0},{"locale":"en-NG","link":"https:\/\/www.hostinger.com\/ng\/tutorials\/netstat-command","default":0}],"_links":{"self":[{"href":"https:\/\/www.hostinger.com\/my\/tutorials\/wp-json\/wp\/v2\/posts\/122496","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hostinger.com\/my\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hostinger.com\/my\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hostinger.com\/my\/tutorials\/wp-json\/wp\/v2\/users\/411"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hostinger.com\/my\/tutorials\/wp-json\/wp\/v2\/comments?post=122496"}],"version-history":[{"count":11,"href":"https:\/\/www.hostinger.com\/my\/tutorials\/wp-json\/wp\/v2\/posts\/122496\/revisions"}],"predecessor-version":[{"id":125992,"href":"https:\/\/www.hostinger.com\/my\/tutorials\/wp-json\/wp\/v2\/posts\/122496\/revisions\/125992"}],"wp:attachment":[{"href":"https:\/\/www.hostinger.com\/my\/tutorials\/wp-json\/wp\/v2\/media?parent=122496"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hostinger.com\/my\/tutorials\/wp-json\/wp\/v2\/categories?post=122496"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hostinger.com\/my\/tutorials\/wp-json\/wp\/v2\/tags?post=122496"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}