

{"id":110120,"date":"2022-07-14T12:38:26","date_gmt":"2022-07-14T07:08:26","guid":{"rendered":"https:\/\/data-flair.training\/blogs\/?p=110120"},"modified":"2022-07-14T12:40:03","modified_gmt":"2022-07-14T07:10:03","slug":"netstat-command-in-linux","status":"publish","type":"post","link":"https:\/\/data-flair.training\/blogs\/netstat-command-in-linux\/","title":{"rendered":"Netstat Command in Linux"},"content":{"rendered":"<p>In this article, you will learn all there is to the netstat command in Linux. We will be going through different topics like what netstat is, and learn about different terminologies like ports, processes, and protocols. We will also be looking into the syntax of the netstat command along with options used with the netstat command.<\/p>\n<p>Also, we shall briefly look at the different files that are used by the netstat command and also understand the output messages and what they mean. In the very end, we will also be looking at some practical examples of the netstat command in the terminal. So buckle up and pay attention, because it is going to be a hell of a ride!<\/p>\n<h3>What is netstat in Linux?<\/h3>\n<p>Netstat is a command-line-based tool in Linux-based operating systems that gives you a lot of information about networks. The command literally gives you a treasure chest of information that is extremely useful like routing tables, network connection, interface statistics, multicast memberships and so many more.<\/p>\n<p>The netstat command is a basic network service debugging tool that is very helpful to system administrators as it tells you information like what ports are open and which programs are listening on ports.<\/p>\n<p>Netstat stands for network statistics and can display all the socket connections like UDP and TCP. it also displays the sockets that are pending connections. the netstat utility is also available for Windows operating systems and Mac.<\/p>\n<h3>Understanding what happened behind the scenes<\/h3>\n<p>Before we proceed further, let us lay down some fundamentals by understanding what exactly happens behind the curtain.<\/p>\n<p>Network sockets can be in 2 stages, either connected or waiting to be connected. These connections use networking protocols like UDP (user datagram protocol) or TCP (transport control protocol).<\/p>\n<p>Connections use network ports and IP (internet protocol) addresses to create a connection successfully. Let us now take a closer look at what sockets are and how they function.<\/p>\n<p>A socket is software used to handle one end of a network data connection. Apart from the 2 stages mentioned earlier, there are other states in which a socket can be such as the state when a socket is in the middle of connecting to a remote device.<\/p>\n<p>A socket that listens is called the server, and the socket that requests the connection is the client. The netstat utility lets you see which sockets are connected, and which are listening.<\/p>\n<h3>Syntax of Linux netstat command<\/h3>\n<p>Before looking at the many options used with the netstat command, let us look at the syntax of the netstat command:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">netstat &lt;options&gt;<\/pre>\n<h3>Installing Linux netstat<\/h3>\n<p>The netstat tool does not come preinstalled in most distributions of Linux. To download on Debian based operating systems, type the following command in the terminal:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">sudo apt install net-tools<\/pre>\n<h3><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/installing-netstat.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110272\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/installing-netstat.webp\" alt=\"installing netstat\" width=\"780\" height=\"199\" \/><\/a><\/h3>\n<h3>Options used with Linux netstat command<\/h3>\n<p>In the syntax of the netstat command, we have seen that there is a field to enter the option. We can use the many available options which we can use to tinker with the way the output is printed. Let us look t the various available options of the netstat command.<\/p>\n<h4>1. -r<\/h4>\n<p>This option displays the kernel routing tables. This option can also be written as \u201c&#8211;route\u201d<\/p>\n<h4>2. -g<\/h4>\n<p>This option Display multicast group membership information for IPv4 and IPv6 addresses. You can also write this option as \u201c&#8211;groups\u201d<\/p>\n<h4>3. -i<\/h4>\n<p>This option Display a table of all the network interfaces. You can also write this option as \u201c&#8211;interfaces\u201d<\/p>\n<h4>4. -M<\/h4>\n<p>This option Display a list of masqueraded connections. You can also write this option as \u201c&#8211;masqueraded\u201d<\/p>\n<h4>5. -s<\/h4>\n<p>This option Display summary statistics for each protocol. You can also write this option as \u201c&#8211;statistics\u201d<\/p>\n<h4>6. -v<\/h4>\n<p>This option provides verbose the output to get a better understanding of what happened. You can also write this option as \u201c&#8211;verbose\u201d<\/p>\n<h4>7. -W<\/h4>\n<p>This option does not truncate the internet protocol addresses using the output as vast as needed. You can also write this option as \u201c&#8211;wide\u201d<\/p>\n<h4>8. -n<\/h4>\n<p>This option shows the numerical addresses, instead of determining the port, user names, or symbolic host. You can also write this option as \u201c&#8211;numeric\u201d<\/p>\n<h4>9. &#8211;numeric-hosts<\/h4>\n<p>This option shows the numerical host addresses and does not affect the resolution of user names or ports.<\/p>\n<h4>10. \u2013numeric-ports<\/h4>\n<p>This option shows the numerical port numbers and does not affect the resolution of user names or hosts.<\/p>\n<h4>11. &#8211;numeric-users<\/h4>\n<p>This option shows the numerical user IDs and does not affect the resolution of port names or hosts.<\/p>\n<h4>12. -o<\/h4>\n<p>This option includes information related to networking timers.<\/p>\n<h4>13. -c<\/h4>\n<p>This option prints the selected information every second continuously. You can also write this option as \u201c&#8211;continuos\u201d<\/p>\n<h4>14. -e<\/h4>\n<p>As the name suggests, this option displays additional information. You can also write this option as \u201c&#8211;extend\u201d<\/p>\n<h4>15. -p<\/h4>\n<p>This shows the name and PID of the program. You can also write this option as \u201c&#8211;program\u201d<\/p>\n<h4>16. -l<\/h4>\n<p>This option shows only the sockets that are listening. You can also write this option as \u201c&#8211;listening\u201d<\/p>\n<h4>17. -F<\/h4>\n<p>This option prints routing information from the FIB.<\/p>\n<h4>18. -C<\/h4>\n<p>This option prints routing information from the route cache.<\/p>\n<h4>19. -a<\/h4>\n<p>This option shows both the socket types &#8211; listening and nonlistening. You can also write this option as \u201c&#8211;all\u201d<\/p>\n<h4>20. &#8211;help<\/h4>\n<p>This option displays the help menu<\/p>\n<h3>Understanding the output of netstat command<\/h3>\n<p>Before we actually see some practical examples, we must also understand the different output messages netstat shows in the terminal for us to understand what is actually happening or happened.<\/p>\n<h4>Output regarding Internet connection<\/h4>\n<p>One kind of information netstat gives us through its output is information regarding active internet connections like UDP, raw, and TCP. let us look at some of the output netstat displays regarding internet connections.<\/p>\n<h5>1. Proto<\/h5>\n<p>This output message shows the protocol used socket. It can either be TCP, RAW or UDP.<\/p>\n<h5>2. Recv-Q<\/h5>\n<p>This output message shows the count of bytes not copied by the user program connected to this socket.<\/p>\n<h5>3. Send-Q<\/h5>\n<p>This output message shows the count of bytes not acknowledged by the remote host.<\/p>\n<h5>4. Local Address<\/h5>\n<p>This output message shows the address and port number of the local end of the socket.<\/p>\n<h5>5. Foreign Address<\/h5>\n<p>This output message shows the address Address and port number of the remote end of the socket.<\/p>\n<h5>6. User<\/h5>\n<p>This output message shows the username or UID of the owner of the socket.<\/p>\n<h5>7. PID\/name of the process<\/h5>\n<p>This output message shows the process id (PID) and process name of the process that owns the socket separated by a slash.<\/p>\n<h5>8. State<\/h5>\n<p>This output message shows the state of the socket.<\/p>\n<h4>Output regarding the active UNIX domain sockets<\/h4>\n<p>Another kind of output message that netstat prints are the information regarding the active UNIX domain sockets. Let us look at some categories of this message:<\/p>\n<h5>1. Proto<\/h5>\n<p>This output message displays the protocol used by the socket, Usually UNIX.<\/p>\n<h5>2. RefCnt<\/h5>\n<p>This output message displays the reference count.<\/p>\n<h5>3. Flags<\/h5>\n<p>This output message displays the flags.<\/p>\n<h5>4. Type<\/h5>\n<p>This output message shows the type of socket access.<\/p>\n<h5>5. State<\/h5>\n<p>This output message shows the state of the sockets<\/p>\n<h5>6. PID\/program name<\/h5>\n<p>This output message displays the PID and the name of the process separated by a slash<\/p>\n<h5>7. Path<\/h5>\n<p>This output message displays the path name as which the matching process attached to the socket.<\/p>\n<h5>8. Active IPX sockets<\/h5>\n<p>This output message displays the list of the active IPX sockets.<\/p>\n<h5>9. Active NET\/ROM sockets<\/h5>\n<p>This output message displays the list of all the active NET\/ROM sockets.<\/p>\n<h5>10. Active AX.25 sockets<\/h5>\n<p>This output message displays the list of the active AX.25 sockets.<\/p>\n<p>Now that we have laid down the fundamentals, let us look at some practical examples of the netstat command in the terminal<\/p>\n<h3>Listing all ports of TCP and UDP connections<\/h3>\n<p>To list all the listening ports of the connections UDP and TCP, use the option \u201c-a\u201d as follows:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">netstat -a<\/pre>\n<h3><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/listing-all-ports-of-tcp-and-udp-connections.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110273\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/listing-all-ports-of-tcp-and-udp-connections.webp\" alt=\"listing all ports of tcp and udp connections\" width=\"780\" height=\"551\" \/><\/a><\/h3>\n<h3>Listing TCP port connections<\/h3>\n<p>If you wish to list only the TCP (Transmission Control Protocol) port connections, use the option \u201ct\u201d as follows:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">netstat -at<\/pre>\n<h3><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/listing-tcp-port-connections.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110274\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/listing-tcp-port-connections.webp\" alt=\"listing tcp port connections\" width=\"780\" height=\"252\" \/><\/a><\/h3>\n<h3>Listing the connections that are listening<\/h3>\n<p>To list all the listening connections use the option \u201c-l\u201d as follows:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">netstat -l<\/pre>\n<h3><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/listing-the-connections-that-are-listening.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110275\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/listing-the-connections-that-are-listening.webp\" alt=\"listing the connections that are listening\" width=\"780\" height=\"595\" \/><\/a><\/h3>\n<h3>Listing the TCP listening ports<\/h3>\n<p>If you wish to list all the active TCP listening ports, you can pair the options \u201c-l\u201d and \u201c-t\u201d as follows:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">netstat -lt<\/pre>\n<h3><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/listing-the-tcp-listening-ports.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110276\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/listing-the-tcp-listening-ports.webp\" alt=\"listing the tcp listening ports\" width=\"780\" height=\"257\" \/><\/a><\/h3>\n<h3>Listing the UDP listening ports<\/h3>\n<p>If you wish to list all the active UDP listening ports, you can pair the options \u201c-l\u201d and \u201c-u\u201d as follows:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">netstat -lu<\/pre>\n<h3><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/listing-the-udp-listening-ports.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110277\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/listing-the-udp-listening-ports.webp\" alt=\"listing the udp listening ports\" width=\"780\" height=\"218\" \/><\/a><\/h3>\n<h3>Listing the UNIX listening ports<\/h3>\n<p>If you wish to list all the active TCP listening ports, you can pair the options \u201c-l\u201d and \u201c-x\u201d as follows:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">netstat -lx<\/pre>\n<h3><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/listing-the-unix-listening-ports.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110278\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/listing-the-unix-listening-ports.webp\" alt=\"listing the unix listening ports\" width=\"780\" height=\"269\" \/><\/a><\/h3>\n<h3>Showing statistics<\/h3>\n<p>If you want to show statistics by the protocol on the terminal, use the option \u201c-s\u201d as follows: netstat -s, by default, the command shows statistics for the protocols TCP, UDP, ICMP, and IP.<\/p>\n<p><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/showing-statistics.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110279\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/showing-statistics.webp\" alt=\"showing statistics\" width=\"410\" height=\"894\" \/><\/a><\/p>\n<h3>Showing statistics of the TCP protocol<\/h3>\n<p>To show statistics of the TCP protocol, combine the option \u201c-s\u201d with the option \u201c-t\u201d as follows:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">netstat -st<\/pre>\n<h3><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/showing-statistics-of-the-tcp-protocol.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110280\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/showing-statistics-of-the-tcp-protocol.webp\" alt=\"showing statistics of the tcp protocol\" width=\"432\" height=\"355\" \/><\/a><\/h3>\n<h3>Showing statistics of the UDP protocol<\/h3>\n<p>To show statistics of the UDP protocol, combine the option \u201c-s\u201d with the option \u201c-u\u201d as follows:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">netstat -su<\/pre>\n<h3><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/showing-statistics-of-the-udp-protocol.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110281\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/showing-statistics-of-the-udp-protocol.webp\" alt=\"showing statistics of the udp protocol\" width=\"468\" height=\"325\" \/><\/a><\/h3>\n<h3>Showing PID and process name<\/h3>\n<p>If you want to show the service name along with their PID number, you can use the command as below:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">netstat -tp<\/pre>\n<h3><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/showing-pid-and-process-name.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110282\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/showing-pid-and-process-name.webp\" alt=\"showing pid and process name\" width=\"780\" height=\"442\" \/><\/a><\/h3>\n<h3>Promiscuous mode<\/h3>\n<p>To display the promiscuous mode, use the command:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">netstat -ac<\/pre>\n<h3><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/promiscuous-mode.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110283\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/promiscuous-mode.webp\" alt=\"promiscuous mode\" width=\"780\" height=\"803\" \/><\/a><\/h3>\n<h3>Displaying the IP routing of kernel<\/h3>\n<p>To display the kernel IP routing table, use the option \u201c-r\u201d as follows:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">netstat -r<\/pre>\n<h3><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/displaying-the-ip-routing-of-kernel.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110284\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/displaying-the-ip-routing-of-kernel.webp\" alt=\"displaying the ip routing of kernel\" width=\"780\" height=\"142\" \/><\/a><\/h3>\n<h3>Displaying the transactions of network interfaces<\/h3>\n<p>To show the transactions of the network interface transactions (both receiving and transferring), use the option \u201c-i\u201d.<\/p>\n<p><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/displaying-the-transactions-of-network-interfaces.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110285\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/displaying-the-transactions-of-network-interfaces.webp\" alt=\"displaying the transactions of network interfaces\" width=\"780\" height=\"122\" \/><\/a><\/p>\n<h3>Providing verbose to the output<\/h3>\n<p>To provide verbose to the output to provide a better understanding of what is happening, use the option \u201c-v\u201d or \u201c&#8211;verbose\u201d along with the netstat command as follows :<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">netstat -v\r\nnetstat --verbose<\/pre>\n<h3><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/providing-verbose-to-the-output.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110286\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/providing-verbose-to-the-output.webp\" alt=\"providing verbose to the output\" width=\"780\" height=\"520\" \/><\/a><\/h3>\n<h3>Displaying information regarding IPV4 and IPv6 addresses<\/h3>\n<p>To show multicast group membership information for both IPv4 and IPv6 addresses, use the option \u201c-g\u201d as follows:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">netstat -g<\/pre>\n<h3><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/displaying-information-regarding-ipv4-and-ipv6-addresses.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110287\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/displaying-information-regarding-ipv4-and-ipv6-addresses.webp\" alt=\"displaying information regarding ipv4 and ipv6 addresses\" width=\"474\" height=\"331\" \/><\/a><\/h3>\n<h3>Showing the kernel interface table<\/h3>\n<p>To show the kernel interface table, combine the option \u201c-i\u201d and \u201c-e\u201d with the netstat command as follows:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">netstat -ie<\/pre>\n<h3><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/showing-the-kernel-interface-table.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110288\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/showing-the-kernel-interface-table.webp\" alt=\"showing the kernel interface table\" width=\"780\" height=\"449\" \/><\/a><\/h3>\n<h3>Finding programs that are listening<\/h3>\n<p>If you want to find a specific listening program, you can combine the netstat command with the grep, by piping both of them as follows:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">netstat -ap | grep http<\/pre>\n<p>The above command will search all the listening programs and send the list as the input to the grep command, which will filter out only the programs with the phrase \u201chttp\u201d in them.<\/p>\n<h3>Printing information continuously<\/h3>\n<p>To print information from netstat continuously, use the option \u201c-c\u201d as follows:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">netstat -c<\/pre>\n<h3><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/printing-information-continuously.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110289\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/printing-information-continuously.webp\" alt=\"printing information continuously\" width=\"780\" height=\"680\" \/><\/a><\/h3>\n<h3>Printing raw network statistics<\/h3>\n<p>If you want to print raw network statisticls pass the first argument of netstat as \u201c&#8211;statisctics\u201d and the second argument as \u201c&#8211;raw\u201d as follows:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">netstat --statistics --raw<\/pre>\n<h3><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/printing-raw-network-statistics.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110290\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/printing-raw-network-statistics.webp\" alt=\"printing raw network statistics\" width=\"494\" height=\"845\" \/><\/a><\/h3>\n<h3>Listing UDP port connections<\/h3>\n<p>If you wish to list only the UDP (User Datagram Protocol) port connections, use the option \u201cu\u201d as follows:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">netstat -au<\/pre>\n<h3><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/listing-udp-port-connections.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110291\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/listing-udp-port-connections.webp\" alt=\"listing udp port connections\" width=\"780\" height=\"220\" \/><\/a><\/h3>\n<h3>Displaying kernel routine information<\/h3>\n<p>To display the kernel routing information pair the netstat command with the option \u201c-r\u201d a shown below:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">netstat -r<\/pre>\n<h3><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/displaying-kernel-routing-information.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110292\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/displaying-kernel-routing-information.webp\" alt=\"displaying kernel routing information\" width=\"780\" height=\"144\" \/><\/a><\/h3>\n<h3>Listing network interfaces<\/h3>\n<p>To list all the network interfaces, pair the netstat command along with the option \u201c-i\u201d as follows:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">netstat -i<\/pre>\n<h3><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/listing-network-interfaces.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110293\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/listing-network-interfaces.webp\" alt=\"listing network interfaces\" width=\"780\" height=\"127\" \/><\/a><\/h3>\n<h3>Disabling reverse DNS Lookup for faster output<\/h3>\n<p>By default, netstat finds out the hostname for each IP address by a reverse DNS lookup. This feature causes slowdowns in the output. If at all you don\u2019t want to to know the hostname and want to disable the reverse DNS lookup by using the option &#8216;n&#8217; as shown in the output below:<\/p>\n<p><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/disabling-reverse-dns-lookup-for-faster-output.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110294\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/disabling-reverse-dns-lookup-for-faster-output.webp\" alt=\"disabling reverse dns lookup for faster output\" width=\"780\" height=\"307\" \/><\/a><\/p>\n<h3>Displaying the PID and UID<\/h3>\n<p>While checking network statistics, if you want to print the PID and UID, pair the netstat command with the option \u201c-p\u201d. You will have to use the option \u201c-p\u201d with sudo privileges, otherwise, it will not display the PID.<\/p>\n<p><a href=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/displaying-the-pid-and-uid.webp\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-110295\" src=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/07\/displaying-the-pid-and-uid.webp\" alt=\"displaying the pid and uid\" width=\"780\" height=\"224\" \/><\/a><\/p>\n<h3>Files used by netstat<\/h3>\n<p>Now that we have covered pretty much everything, there is one little thing left to discuss &#8211; the files used by netstat. Let us look at the different files netstat uses.<\/p>\n<h4>1. \/etc\/services<\/h4>\n<p>This file is the services translation file.<\/p>\n<h4>2. \/proc\/net\/raw<\/h4>\n<p>This file contains device information<\/p>\n<h4>3. \/proc\/net\/raw<\/h4>\n<p>This file contains raw socket information.<\/p>\n<h4>4. \/proc\/net\/tcp<\/h4>\n<p>This file contains information about the TCP socket<\/p>\n<h4>5. \/proc\/net\/udp<\/h4>\n<p>This file contains information about the UDP socket<\/p>\n<h4>6. \/proc\/net\/igmp<\/h4>\n<p>This file contains information regarding IGMP multicast<\/p>\n<h4>7. \/proc\/net\/unix<\/h4>\n<p>This file contains information about the UNIX domain socket<\/p>\n<h4>8. \/proc\/net\/ipx<\/h4>\n<p>This file contains information about the IPX socket<\/p>\n<h4>9. \/proc\/net\/ax25<\/h4>\n<p>This file contains information about the AX25 socket<\/p>\n<h4>10. \/proc\/net\/ipx_route<\/h4>\n<p>This file contains information about IPX routing<\/p>\n<h4>11. \/proc\/net\/nr_nodes<\/h4>\n<p>This file contains information about the NET\/ROM nodelist<\/p>\n<h4>12. \/proc\/net\/nr_neigh<\/h4>\n<p>This file contains information about the neighbors of NET\/ROM<\/p>\n<h4>13. \/proc\/net\/ip_masquera<\/h4>\n<p>This file contains information about the masqueraded connections<\/p>\n<h3>Summary<\/h3>\n<p>As you have seen, linux netstat command is a really helpful tool (mostly for system admins) that displays various information about networks. You have now learned what netstat is, what sockets are and how they work, the syntax of the netstat command along with options used with the netstat command, and various practical commands of the netstat command<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this article, you will learn all there is to the netstat command in Linux. We will be going through different topics like what netstat is, and learn about different terminologies like ports, processes,&#46;&#46;&#46;<\/p>\n","protected":false},"author":5,"featured_media":110196,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[35],"tags":[27026,27027,27028],"class_list":["post-110120","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","tag-netstat-command-in-linux","tag-options-with-netstat-command-in-linux","tag-syntax-of-linux-netstat-command"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Netstat Command in Linux - DataFlair<\/title>\n<meta name=\"description\" content=\"Learn about netstat command in Linux with syntax and examples. See its different terminologies like ports, processes, &amp; protocols.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/data-flair.training\/blogs\/netstat-command-in-linux\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Netstat Command in Linux - DataFlair\" \/>\n<meta property=\"og:description\" content=\"Learn about netstat command in Linux with syntax and examples. See its different terminologies like ports, processes, &amp; protocols.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/data-flair.training\/blogs\/netstat-command-in-linux\/\" \/>\n<meta property=\"og:site_name\" content=\"DataFlair\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/DataFlairWS\/\" \/>\n<meta property=\"article:published_time\" content=\"2022-07-14T07:08:26+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-07-14T07:10:03+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/05\/netstat-command-in-linux.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"628\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"DataFlair Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@DataFlairWS\" \/>\n<meta name=\"twitter:site\" content=\"@DataFlairWS\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"DataFlair Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"15 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Netstat Command in Linux - DataFlair","description":"Learn about netstat command in Linux with syntax and examples. See its different terminologies like ports, processes, & protocols.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/data-flair.training\/blogs\/netstat-command-in-linux\/","og_locale":"en_US","og_type":"article","og_title":"Netstat Command in Linux - DataFlair","og_description":"Learn about netstat command in Linux with syntax and examples. See its different terminologies like ports, processes, & protocols.","og_url":"https:\/\/data-flair.training\/blogs\/netstat-command-in-linux\/","og_site_name":"DataFlair","article_publisher":"https:\/\/www.facebook.com\/DataFlairWS\/","article_published_time":"2022-07-14T07:08:26+00:00","article_modified_time":"2022-07-14T07:10:03+00:00","og_image":[{"width":1200,"height":628,"url":"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/05\/netstat-command-in-linux.webp","type":"image\/webp"}],"author":"DataFlair Team","twitter_card":"summary_large_image","twitter_creator":"@DataFlairWS","twitter_site":"@DataFlairWS","twitter_misc":{"Written by":"DataFlair Team","Est. reading time":"15 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/data-flair.training\/blogs\/netstat-command-in-linux\/#article","isPartOf":{"@id":"https:\/\/data-flair.training\/blogs\/netstat-command-in-linux\/"},"author":{"name":"DataFlair Team","@id":"https:\/\/data-flair.training\/blogs\/#\/schema\/person\/7f83c342f5d1632d6f7b4b0b0f447823"},"headline":"Netstat Command in Linux","datePublished":"2022-07-14T07:08:26+00:00","dateModified":"2022-07-14T07:10:03+00:00","mainEntityOfPage":{"@id":"https:\/\/data-flair.training\/blogs\/netstat-command-in-linux\/"},"wordCount":2157,"commentCount":0,"publisher":{"@id":"https:\/\/data-flair.training\/blogs\/#organization"},"image":{"@id":"https:\/\/data-flair.training\/blogs\/netstat-command-in-linux\/#primaryimage"},"thumbnailUrl":"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/05\/netstat-command-in-linux.webp","keywords":["Netstat Command in Linux","Options with Netstat Command in Linux","syntax of linux netstat command"],"articleSection":["Linux Tutorials"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/data-flair.training\/blogs\/netstat-command-in-linux\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/data-flair.training\/blogs\/netstat-command-in-linux\/","url":"https:\/\/data-flair.training\/blogs\/netstat-command-in-linux\/","name":"Netstat Command in Linux - DataFlair","isPartOf":{"@id":"https:\/\/data-flair.training\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/data-flair.training\/blogs\/netstat-command-in-linux\/#primaryimage"},"image":{"@id":"https:\/\/data-flair.training\/blogs\/netstat-command-in-linux\/#primaryimage"},"thumbnailUrl":"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/05\/netstat-command-in-linux.webp","datePublished":"2022-07-14T07:08:26+00:00","dateModified":"2022-07-14T07:10:03+00:00","description":"Learn about netstat command in Linux with syntax and examples. See its different terminologies like ports, processes, & protocols.","breadcrumb":{"@id":"https:\/\/data-flair.training\/blogs\/netstat-command-in-linux\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/data-flair.training\/blogs\/netstat-command-in-linux\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/data-flair.training\/blogs\/netstat-command-in-linux\/#primaryimage","url":"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/05\/netstat-command-in-linux.webp","contentUrl":"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/05\/netstat-command-in-linux.webp","width":1200,"height":628,"caption":"netstat command in linux"},{"@type":"BreadcrumbList","@id":"https:\/\/data-flair.training\/blogs\/netstat-command-in-linux\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog Home","item":"https:\/\/data-flair.training\/blogs\/"},{"@type":"ListItem","position":2,"name":"Linux Tutorials","item":"https:\/\/data-flair.training\/blogs\/category\/linux\/"},{"@type":"ListItem","position":3,"name":"Netstat Command in Linux"}]},{"@type":"WebSite","@id":"https:\/\/data-flair.training\/blogs\/#website","url":"https:\/\/data-flair.training\/blogs\/","name":"DataFlair","description":"Learn Today. Lead Tomorrow.","publisher":{"@id":"https:\/\/data-flair.training\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/data-flair.training\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/data-flair.training\/blogs\/#organization","name":"DataFlair","url":"https:\/\/data-flair.training\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/data-flair.training\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2016\/07\/Data-Flair.png","contentUrl":"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2016\/07\/Data-Flair.png","width":106,"height":48,"caption":"DataFlair"},"image":{"@id":"https:\/\/data-flair.training\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/DataFlairWS\/","https:\/\/x.com\/DataFlairWS","https:\/\/www.linkedin.com\/company\/dataflair-web-services-pvt-ltd\/","https:\/\/www.youtube.com\/user\/DataFlairWS"]},{"@type":"Person","@id":"https:\/\/data-flair.training\/blogs\/#\/schema\/person\/7f83c342f5d1632d6f7b4b0b0f447823","name":"DataFlair Team","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/4cf3a74600d131330b8c481d519afd1574093ed89f6d3396a95393ad223eb7cd?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/4cf3a74600d131330b8c481d519afd1574093ed89f6d3396a95393ad223eb7cd?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4cf3a74600d131330b8c481d519afd1574093ed89f6d3396a95393ad223eb7cd?s=96&d=mm&r=g","caption":"DataFlair Team"},"description":"DataFlair Team creates expert-level guides on programming, Java, Python, C++, DSA, AI, ML, data Science, Android, Flutter, MERN, Web Development, and technology. Our goal is to empower learners with easy-to-understand content. Explore our resources for career growth and practical learning.","url":"https:\/\/data-flair.training\/blogs\/author\/dfteam1\/"}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/posts\/110120","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/comments?post=110120"}],"version-history":[{"count":5,"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/posts\/110120\/revisions"}],"predecessor-version":[{"id":110296,"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/posts\/110120\/revisions\/110296"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/media\/110196"}],"wp:attachment":[{"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/media?parent=110120"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/categories?post=110120"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/data-flair.training\/blogs\/wp-json\/wp\/v2\/tags?post=110120"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}