Linux netstat Command
Linux netstat command stands for Network statistics. It displays information about different interface statistics, including open sockets, routing tables, and connection information. Further, it can be used to displays all the socket connections (including TCP, UDP). Apart from connected sockets, it also displays the sockets that are pending for connections. It is a handy tool for network and system administrators.
Syntax:
The netstat command supports various command-line options. The basic syntax of the netstat command is as follows:
Options:
It supports multiple command-line options to print information about the Linux networking subsystem. The output is controlled by the first argument. Let’s see the list of the first arguments:
(none): If no option is specified, it will execute the default command that displays a list of open sockets of all configured address families.
–route, -r: It is used to print the kernel routing tables. The “netstat -r” command and “route -e” command will produce the same output.
–groups, -g: It is used to display multicast group membership information different IP versions (Ipv4 and IPV6).
–interfaces, -i: It is used to display all network interfaces.
–masquerade, -M: It displays masqueraded connections.
–statistics, -s: This option displays the summary statistics for each protocol.
Other options:
–verbose, -v: It is used to display the detailed output. It is a handy tool for displaying the details about unconfigured address families.
–wide, -W: It is used as an output not to reduce the IP address as necessary. It is still optional not to break existing scripts.
–numeric, -n: It is used to display numeric addresses alternatively defining symbolic hosts, ports, or usernames.
–numeric-hosts: It is used to display numerical host addresses; it does not affect the resolution of port or user names.
–numeric-ports: It is used to display numerical port numbers, it does not affect the properties and objects of host or user names.
–numeric-users: It is used to display numeric user Ids, it does not affect the resolution of host or port names.
–protocol=family, -A: It is used to specify the address families for which connections are to be displayed. The address families are a comma (‘,’) separated like Inet, inet6, Unix, ax25, Netrom, Econet, Ipx, DDP, and Bluetooth.
-c, –continuous: It is used to display the selected information continuously for every second.
-e, –extend: It is used for extended output. This option can be used twice for maximum detail.
-o, –timers: It is used to include networking timers related information.
-p, –program: It is used to display the PID and name of the process to the corresponding sockets.
-l, –listening: It is used to display only listening sockets.
-a, –all: It is used to display both sockets (i.e., listening and non-listening). By specifying the ‘–interfaces’ option, we can list the interfaces that are not up.
-F: It is used to display the routing information from the FIB.
-C: It is used to display the routing information from the route cache.
Installation of the netstat command
If the netstat command is not installed on your machine, it will display the traditional Linux installation error message “Command ‘netstat’ not found.”
To install it, execute the below command:
The above command will ask for the administration password to install the command. If it is successfully installed, it will produce the output as follows:
Examples of the netstat command
Let’ see the following examples of the netstat command:
- Display All Connections
- Display only TCP or UDP connections
- Disable reverse DNS lookup for faster output
- Display only listening connections
- Display Pid and Uid
- Display Statistics
- Display kernel routing information
- Display network interfaces
- Display netstat output continuously
- Display multicast group information
Display All Connections
The ‘-a’ option is used to display all the existing connections. Execute the netstat command as follows:
The above command will list all the existing connections. Consider the below output:
Display only TCP or UDP Connections
We can list only the TCP or UDP connections. To display only the TCP connection, execute the command with the ‘t’ option as follows:
The above command will list all the TCP connections. Consider the below output:
To display only UDP connection, execute it with ‘u’ option as follows:
The above command will list all the UDP connections. Consider the below output:
Disable Reverse DNS Lookup for Faster Output
The default behavior of the netstat command finds out the hostname for each IP address by a reverse DNS lookup. It causes the slowdowns in output. If we don’t want to know the hostname, then disable the reverse DNS lookup by suppressing the ‘n’ option with it: Consider the below command:
The above command will disable the reverse DNS lookup and display all the TCP connections. Consider the below output:
Display only Listening Connections
The listening connections are such connections that are available for connection requests. Any network process keeps an open port for the listening incoming connection requests. These connections can be listed by executing the below command:
The above command will list all the listening connection for TCP connections. Consider the below output:
Display Pid and Uid
While checking the network statistics, it is sometimes vital to know the Pid and Uid for a particular connection or user. The Pid and Uid can be listed by executing the ‘p’ option. Execute the below command:
The above command will list all the Pid for the TCP connections. It is necessary to execute this command with sudo privilege. Otherwise, it will not display the Pid. Consider the below output:
Display Statistics
netstat command is also a handy tool for displaying the network statistics such as no packets transmitted and received by a protocol. To display the network statistics, execute the command with the ‘-s’ option as follows:
The above command will display the network statistics. Consider the below output:
Display kernel Routing Information
The ‘r’ option is used to display the kernel routing information. It will display the same output as route command. To display the routing information, execute the command as follows:
The above command will display the routing information. The ‘n’ option will disable the hostname lookup. Consider the below output:
Display Network Interfaces
We can also display information about the network interfaces by using the netstat command. To display the network interfaces, execute the command with ‘i’ option as follows:
The above command will list the network interfaces and related information. Consider the below output:
Display netstat Output Continuously
To display the netstat output continuously, execute the command with the ‘c’ option as follows:
The above command will display the TCP connections continuously. Consider the below output:
Display Multicast Group Information
The ‘g’ option is used to display the multicast group information. To print the details for Ipv4 and Ipv6, execute the command as follows:
The above command will display the multicast group information. Consider the below output:
