On Unix-like operating systems, the netstat command prints information about network connections, routing tables, interface statistics, masquerade connections, and multicast memberships.

This page covers the Linux version of netstat.

Description

netstat (“network statistics”) is a command-line tool that displays network connections (both incoming and outgoing), routing tables, and many network interface (network interface controller or software-defined network interface) and network protocol statistics. It is available on Unix-like operating systems, including OS X, Linux, Solaris, and BSD, and on Windows NT-based operating systems, including Windows XP, Windows Vista, Windows 7 and Windows 8.

  • Description
  • Syntax
  • Output: Internet connections
  • Output: Unix domain sockets
  • Files
  • Examples
  • Related commands
  • Linux commands help

It is used for finding problems in the network and to determine the amount of traffic on the network as a performance measurement.

Syntax

netstat [address_family_options] [–tcp|-t] [–udp|-u] [–raw|-w] [–listening|-l] [–all|-a] [–numeric|-n] [–numeric-hosts] [–numeric-ports] [–numeric-users] [–symbolic|-N] [–extend|-e[–extend|-e]] [–timers|-o] [–program|-p] [–verbose|-v] [–continuous|-c]

netstat {–route|-r} [address_family_options] [–extend|-e[–extend|-e]] [–verbose|-v] [–numeric|-n] [–numeric-hosts] [–numeric-ports] [–numeric-users] [–continuous|-c]

netstat {–interfaces|-i} [–all|-a] [–extend|-e[–extend|-e]] [–verbose|-v] [–program|-p] [–numeric|-n] [–numeric-hosts] [–numeric-ports] [–numeric-users] [–continuous|-c]

netstat {–groups|-g} [–numeric|-n] [–numeric-hosts] [–numeric-ports] [–numeric-users] [–continuous|-c]

netstat {–masquerade|-M} [–extend|-e] [–numeric|-n] [–numeric-hosts] [–numeric-ports] [–numeric-users] [–continuous|-c]

netstat {–statistics|-s} [–tcp|-t] [–udp|-u] [–raw|-w]

netstat {–version|-V}

netstat {–help|-h}

In the syntax above, address_family_options may be any combination of the following options:

[-4] [-6] [–protocol={inet,unix,ipx,ax25,netrom,ddp}[,…]] [–unix|-x] [–inet|–ip] [–ax25] [–ipx] [–netrom] [–ddp]

Options

The type of information printed by netstat is controlled by the first argument, which is one of the following:

After the first argument, the following options specify the reporting behavior of netstat:

Output: Internet connections

Information about Active Internet Connections (TCP, UDP, raw) falls under the following categories:

Output: Unix domain sockets

Information about Active Unix Domain Sockets falls under the following categories:

Files

netstat makes use of the following files:

Examples

netstat

Displays generic statistics about the network activity of the local system.

netstat -an

Shows information about all active connections to the server, including the source and destination IP addresses and ports, if you have proper permissions.

netstat -rn

Displays the routing table for all IP addresses bound to the server.

netstat -an |grep :80 | wc -l

Collects statistics about the amount of active connections on port 80, and pipes this data to the wc command, which displays the number of connections by counting the lines of the original netstat output.

netstat -natp

Display statistics about active Internet connections.

ac — Print statistics about the amount of time users were connected.arp — Manipulate the system ARP cache.ifconfig — View or modify the configuration of network interfaces.ip — Display and manipulate information about routing, devices, policy routing and tunnels.route — Display and manipulate the IP routing table.rpcinfo — Report information about remote procedure calls.