Notes to self from an excellent web source: http://www.thegeekstuff.com/2010/03/netstat-command-examples/
Netstat command displays various network related information such as network connections, routing tables, interface statistics, masquerade connections, multicast memberships etc.
Netstat command displays various network related information such as network connections, routing tables, interface statistics, masquerade connections, multicast memberships etc.
1. List All Ports (both listening and non listening ports)
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -a | more
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 localhost:domain *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 localhost:3350 *:* LISTEN
tcp 0 0 localhost:ipp *:* LISTEN
tcp 0 0 *:3389 *:* LISTEN
tcp 0 0 localhost:mysql *:* LISTEN
tcp 1 0 psqa-Precision-Wo:56250 mulberry.canonical:http CLOSE_WAIT
tcp 0 52 psqa-Precision-Work:ssh 10.155.1.178:65099 ESTABLISHED
tcp6 0 0 [::]:32781 [::]:* LISTEN
tcp6 0 0 [::]:http-alt [::]:* LISTEN
tcp6 0 0 [::]:ssh [::]:* LISTEN
tcp6 0 0 [::]:5910 [::]:* LISTEN
tcp6 0 0 ip6-localhost:ipp [::]:* LISTEN
tcp6 0 0 [::]:58471 [::]:* LISTEN
udp 0 0 *:58874 *:*
udp 0 0 localhost:domain *:*
udp 0 0 *:bootpc *:*
udp 0 0 *:mdns *:*
udp6 0 0 [::]:33848 [::]:*
udp6 0 0 [::]:38606 [::]:*
udp6 0 0 [::]:mdns [::]:*
udp6 0 0 [::]:mdns [::]:*
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 7832738 /tmp/.X11-unix/X0
unix 2 [ ACC ] STREAM LISTENING 13521345 /tmp/keyring-LJiqbG/control
unix 2 [ ACC ] STREAM LISTENING 13519782 /tmp/ssh-FmqICnl32734/agent.32734
unix 2 [ ACC ] STREAM LISTENING 13507507 /tmp/.ICE-unix/32734
unix 2 [ ACC ] STREAM LISTENING 7703 /var/run/dbus/system_bus_socket
unix 2 [ ACC ] STREAM LISTENING 13519818 /tmp/keyring-LJiqbG/pkcs11
unix 2 [ ACC ] STREAM LISTENING 13519819 /tmp/keyring-LJiqbG/gpg
unix 2 [ ] DGRAM 7821596 /var/run/xrdp/xrdp_chansrv_00006537_main_term
unix 2 [ ] DGRAM 7821598 /var/run/xrdp/xrdp_chansrv_00006537_thread_done
unix 2 [ ACC ] STREAM LISTENING 5430847 /tmp/.esd-1000/socket
unix 2 [ ACC ] STREAM LISTENING 5430849 /home/psqa/.pulse/dd64bbdc6e387b6ce5594de20000000c-runtime/native
2.List all tcp ports using netstat -at
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -at
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 localhost:domain *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 localhost:3350 *:* LISTEN
tcp 0 0 localhost:ipp *:* LISTEN
tcp 0 0 *:3389 *:* LISTEN
tcp 0 0 localhost:mysql *:* LISTEN
tcp 1 0 psqa-Precision-Wo:56250 mulberry.canonical:http CLOSE_WAIT
tcp 0 52 psqa-Precision-Work:ssh 10.155.1.178:65099 ESTABLISHED
tcp6 0 0 [::]:32781 [::]:* LISTEN
tcp6 0 0 [::]:http-alt [::]:* LISTEN
tcp6 0 0 [::]:ssh [::]:* LISTEN
tcp6 0 0 [::]:5910 [::]:* LISTEN
tcp6 0 0 ip6-localhost:ipp [::]:* LISTEN
tcp6 0 0 [::]:58471 [::]:* LISTEN
3.List all udp ports using netstat -au
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -au
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
udp 0 0 *:58874 *:*
udp 0 0 localhost:domain *:*
udp 0 0 *:bootpc *:*
udp 0 0 *:mdns *:*
udp6 0 0 [::]:33848 [::]:*
udp6 0 0 [::]:38606 [::]:*
udp6 0 0 [::]:mdns [::]:*
udp6 0 0 [::]:mdns [::]:*
4.List Sockets which are in Listening State
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -l
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 localhost:domain *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 localhost:3350 *:* LISTEN
tcp 0 0 localhost:ipp *:* LISTEN
tcp 0 0 *:3389 *:* LISTEN
tcp 0 0 localhost:mysql *:* LISTEN
tcp 1 0 psqa-Precision-Wo:56250 mulberry.canonical:http CLOSE_WAIT
5.List only listening TCP Ports using netstat -lt
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -lt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 localhost:domain *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 localhost:3350 *:* LISTEN
tcp 0 0 localhost:ipp *:* LISTEN
tcp 0 0 *:3389 *:* LISTEN
tcp 0 0 localhost:mysql *:* LISTEN
6.List only listening UDP Ports using netstat -lu
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -lu
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
udp 0 0 *:58874 *:*
udp 0 0 localhost:domain *:*
udp 0 0 *:bootpc *:*
udp 0 0 *:mdns *:*
udp6 0 0 [::]:33848 [::]:*
udp6 0 0 [::]:38606 [::]:*
udp6 0 0 [::]:mdns [::]:*
udp6 0 0 [::]:mdns [::]:*
7.List only the listening UNIX Ports using netstat -lx
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -lx
Active UNIX domain sockets (only servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 7832738 /tmp/.X11-unix/X0
unix 2 [ ACC ] STREAM LISTENING 13521345 /tmp/keyring-LJiqbG/control
unix 2 [ ACC ] STREAM LISTENING 13519782 /tmp/ssh-FmqICnl32734/agent.32734
unix 2 [ ACC ] STREAM LISTENING 13507507 /tmp/.ICE-unix/32734
unix 2 [ ACC ] STREAM LISTENING 7703 /var/run/dbus/system_bus_socket
unix 2 [ ACC ] STREAM LISTENING 13519818 /tmp/keyring-LJiqbG/pkcs11
unix 2 [ ACC ] STREAM LISTENING 13519819 /tmp/keyring-LJiqbG/gpg
unix 2 [ ACC ] STREAM LISTENING 5430847 /tmp/.esd-1000/socket
unix 2 [ ACC ] STREAM LISTENING 5430849 /home/psqa/.pulse/dd64bbdc6e387b6ce5594de20000000c-runtime/native
unix 2 [ ACC ] STREAM LISTENING 13519820 /tmp/keyring-LJiqbG/ssh
8.Show the statistics for each protocol
Show statistics for all ports using netstat -s
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -s
Ip:
19245274 total packets received
33255 with invalid addresses
0 forwarded
0 incoming packets discarded
19212008 incoming packets delivered
6367978 requests sent out
Icmp:
430 ICMP messages received
0 input ICMP message failed.
ICMP input histogram:
destination unreachable: 10
echo requests: 409
echo replies: 11
80290 ICMP messages sent
0 ICMP messages failed
ICMP output histogram:
destination unreachable: 79867
echo request: 14
echo replies: 409
IcmpMsg:
InType0: 11
InType3: 10
InType8: 409
OutType0: 409
OutType3: 79867
OutType8: 14
Tcp:
279678 active connections openings
5867 passive connection openings
4701 failed connection attempts
2700 connection resets received
1 connections established
12037981 segments received
5816889 segments send out
42226 segments retransmited
5 bad segments received.
13883 resets sent
Udp:
3583428 packets received
79867 packets to unknown port received.
0 packet receive errors
438883 packets sent
9.Show statistics for TCP (or) UDP ports using netstat -st (or) netstat -su
10. Display PID and program names in netstat output using netstat -p
netstat -p option can be combined with any other netstat option. This will add the “PID/Program Name” to the netstat output. This is very useful while debugging to identify which program is running on a particular port.
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -pt
(Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.)
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 1 0 psqa-Precision-Wo:56250 mulberry.canonical:http CLOSE_WAIT 482/ubuntu-geoip-pr
tcp 0 412 psqa-Precision-Work:ssh 10.155.1.178:65099 ESTABLISHED -
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -pu
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
psqa@psqa-Precision-WorkStation-T3500:~$
11.Print netstat information continuously
netstat will print information continuously every few seconds.
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -c
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 1 0 psqa-Precision-Wo:56250 mulberry.canonical:http CLOSE_WAIT
12.Find the non supportive Address families in your system
netstat -v
netstat: no support for `AF IPX' on this system.
netstat: no support for `AF AX25' on this system.
netstat: no support for `AF X25' on this system.
netstat: no support for `AF NETROM' on this system.
13. Display the kernel routing information using netstat -r
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -r
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
default 10.20.10.1 0.0.0.0 UG 0 0 0 eth0
10.20.10.0 * 255.255.254.0 U 0 0 0 eth0
link-local * 255.255.0.0 U 0 0 0 eth0
14.Don’t resolve host, port and user name in netstat output
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -r
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
default 10.20.10.1 0.0.0.0 UG 0 0 0 eth0
10.20.10.0 * 255.255.254.0 U 0 0 0 eth0
link-local * 255.255.0.0 U 0 0 0 eth0
14.Don’t resolve host, port and user name in netstat output
When you don’t want the name of the host, port or user to be displayed, use netstat -n option. This speeds up the output, as netstat is not performing any look-up.
netstat -an
15. Find out on which port a program is running
psqa@psqa-Precision-WorkStation-T3500:~$ sudo netstat -ap | grep ssh
tcp 0 0 *:ssh *:* LISTEN 2197/sshd
tcp 0 52 psqa-Precision-Work:ssh 10.155.1.178:65099 ESTABLISHED 31357/sshd: psqa [p
tcp6 0 0 [::]:ssh [::]:* LISTEN 2197/sshd
psqa@psqa-Precision-WorkStation-T3500:~$ sudo netstat -ap | grep ssh
tcp 0 0 *:ssh *:* LISTEN 2197/sshd
tcp 0 52 psqa-Precision-Work:ssh 10.155.1.178:65099 ESTABLISHED 31357/sshd: psqa [p
tcp6 0 0 [::]:ssh [::]:* LISTEN 2197/sshd
16.Find out which process is using a particular port:
-bash-4.1# netstat -ap | grep ':80'
tcp 0 0 *:8009 *:* LIST EN 5792/java
-bash-4.1# netstat -ap | grep ':8080'
-bash-4.1# netstat -ap | grep ':80'
tcp 0 0 *:8009 *:* LISTEN 5792/java
17.Show the list of network interfaces
17.Show the list of network interfaces
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -i
Kernel Interface table
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0 1500 0 26476172 0 0 0 6186673 0 0 0 BMRU
eth1 1500 0 0 0 0 0 0 0 0 0 BMU
lo 16436 0 222432 0 0 0 222432 0 0 0 LRU
psqa@psqa-Precision-WorkStation-T3500:~$
18.Display extended information on the interfaces
psqa@psqa-Precision-WorkStation-T3500:~$ netstat -ie
Kernel Interface table
eth0 Link encap:Ethernet HWaddr 00:10:18:77:6b:c0
inet addr:10.20.10.150 Bcast:10.20.11.255 Mask:255.255.254.0
inet6 addr: fe80::210:18ff:fe77:6bc0/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:26476601 errors:0 dropped:0 overruns:0 frame:0
TX packets:6186707 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:16880934683 (16.8 GB) TX bytes:691922199 (691.9 MB)
Interrupt:28
eth1 Link encap:Ethernet HWaddr b8:ac:6f:95:fc:4d
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
Interrupt:17
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:222432 errors:0 dropped:0 overruns:0 frame:0
TX packets:222432 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:41913247 (41.9 MB) TX bytes:41913247 (41.9 MB)
