Netstat command on Linux (network statistics) [Basic Guide]

The Netstat Command in Linux is part of the old Net-Tools legacy package and displays network connections, route tables, interface statistics, etc. It has been elegantly replaced by the command ”ss”.

Examples:

# netstat -anp 
Active Internet connections (servers and established) 
ProtoRecv-QSend-QLocal AddressForeign AddressState PID/Program name 
tcp00 0.0.0. 0:3306 0.0.0.0: *LISTEN 981/mysqld 
tcp 0 0 0.0.0. 0:8080 0.0.0.0: *Listen24929/mini-Apache: 
tcp00 0.0.0. 0:8888 0.0.0.0: *LISTEN 2160/httpd

tcp00 0.0.0. 0:3128 0.0.0.0: *LISTEN1994/ (squid)
tcp00 127.0.0. 1:953 0.0.0.0: *LISTEN 935/named

In this example, the netstat command lists all open connections and processes that are listening for connections and which process they belong to. The “-p” option only shows the programs that “own” the root connections.

The -i option provides a statistics on the volume of data traveled on each interface:

$ netstat -i
Kernel Interface Table
Iface MTU RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0 9001 34849988 0 0 0 30552900 0 0 0 BMRU
lo 65536 4407543 0 0 0 4407543 0 0 0 LRU

The “-r” option shows the route table, much like the route command:

$ netstat -rn 
Kernel IP Routing Table 
Destination Router MascarGen. MSS Options Window Irtt Iface 
0.0.0.0 172.30.0.1 0.0.0.0 UG 0 0 0 eth0 
10.8.0.0 10.8.0.2 & nbsp; 255.255.255.0 UG 0 0 0 tun0 
10.8.0.2 0.0.0.0 255.255.255 UH 0 0 0 tun0 
169.254.169.254 0.0.0.0 & nbsp; 255.255.255.255 UH 0 0 0 eth0
172.30.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

Netstat also provides statistics of network interfaces with the “-s” option:

$ netstat -s Ip: 8871 total packets received 0 forwarded 0 incoming packets discarded 7997 incoming packets delivered 5023 requests sent out (...)