VMware ESXi and vSphere Cluster Management

Linux netstat Command: Network Connections, Listening Ports, Routes, and Interface Statistics

Learn how to use Linux netstat to inspect sockets, listening ports, processes, routes, protocol counters, and interface statistics, plus modern ss equivalents.

netstat is a legacy Linux command for inspecting information reported by the operating system's networking stack. It can show active sockets, listening ports, protocol counters, network-interface statistics, and routing tables.

This makes it useful when you need to find which service owns a port, confirm a client connection, investigate queues or TCP states, or check whether the kernel has a route to a remote network.

What netstat reports

• Active sockets: network endpoints currently used by local processes.
• Listening sockets: server endpoints waiting for incoming traffic.
• Protocol-specific views: TCP-only, UDP-only, or combined socket listings.
• Protocol statistics: kernel counters such as packets, errors, retransmissions, and failures.
• Interface statistics: packets, bytes, errors, and drops for network interfaces.
• Routing tables: the destinations, gateways, metrics, and interfaces used to forward traffic.

A socket is a networking endpoint used by a process. A port is a transport-layer number identifying an application endpoint on a host. TCP is connection-oriented and has lifecycle states; UDP is connectionless and does not use the same TCP state model.

Availability and the modern replacement

On many distributions, netstat is installed by the net-tools package. If the shell reports that the command cannot be found, use your distribution's normal package manager to install that package if legacy compatibility is required. For new work, use ss for sockets, ip route for routes, and ip -s link for interface counters.

Basic socket listing

Run netstat without options for a basic report:

netstat

The default output normally focuses on active, connected sockets rather than every possible socket. A connected TCP entry has a local endpoint and a foreign endpoint. A listening server socket is waiting for clients and is usually included only when you request all entries with -a.

Process ownership may be hidden for sockets belonging to other users. Use sudo when you need complete process and PID information:

sudo netstat -tunap

Important netstat options

Short options can be combined. For example, -tu selects TCP and UDP, -tua adds all entries, and -tulpn combines protocol filters with listening, numeric, and process output. Filtering to one or two protocols makes large reports easier to interpret.

Finding listening ports

To list numeric TCP and UDP listeners and identify their processes, use:

sudo netstat -tulpn

For TCP, a row with state LISTEN represents a server socket ready to accept connections. A local address such as 0.0.0.0:8080 means the service is bound to all IPv4 interfaces on port 8080. The IPv6 wildcard :: has a similar meaning for IPv6. A listener bound to 127.0.0.1 or ::1 accepts traffic only from the local machine.

UDP does not establish TCP-style connections, so do not expect a UDP listener to have a TCP state such as LISTEN. Look for the local address and port, and interpret the row as a datagram endpoint.

Numeric output and name resolution

The -n option prevents netstat from resolving IP addresses into host names and port numbers into service names:

sudo netstat -tunap

Without -n, an address might appear as a host name and port 443 might appear as https. Numeric mode is usually better during troubleshooting because DNS or service-name lookups can be slow, fail, or make repeated output ambiguous.

Reading socket-list output

An endpoint uses a host-and-port format such as 192.0.2.10:443 or [2001:db8::10]:443. The local address belongs to this machine; the foreign address identifies the remote peer. A wildcard such as 0.0.0.0, ::, or sometimes * represents an unspecified address. In a local listener, it commonly means the socket accepts traffic through multiple interfaces. An asterisk in a foreign port can mean that the row has no established peer port, which is common for listeners or unconnected endpoints.

Recv-Q is data waiting for the local application. Send-Q is outbound data that has not completed delivery processing. Exact queue semantics vary by protocol and implementation. A nonzero value is not automatically an error; investigate values that remain high or grow across repeated samples.

TCP state guide

Continuous monitoring

Use -c to print repeated snapshots:

sudo netstat -tunapc

This is useful while testing a client, watching connections appear and disappear, or observing transient states such as SYN_SENT and TIME_WAIT. Stop continuous output with Ctrl+C.

Protocol statistics

The -s option displays protocol-specific kernel counters:

netstat -s
netstat -st

The second command filters statistics to TCP. Other protocol filters can be combined similarly where supported. Counters may reveal retransmissions, receive or transmit errors, dropped packets, failed connection attempts, and other symptoms. These are clues, not complete diagnoses: compare values over time and correlate them with application logs, interface counters, or packet captures.

Network interface statistics

netstat -i

The interface report summarizes each interface, including its name, received and transmitted packets, received and transmitted bytes where supported, errors, and drops. Interface names might include a physical device, a virtual interface, a bridge, or a loopback device.

Use ip -s link for the preferred modern summary. Use ethtool when you need deeper driver or physical-link information.

Routing table display

netstat -r

A routing table is the kernel's set of rules for selecting a next hop and outgoing interface. Its columns commonly describe:

• Destination: the network or host that can be reached.
• Gateway: the next router, when traffic is not directly connected.
• Genmask or prefix: the size of the destination network.
• Flags: properties such as whether a route is up or uses a gateway.
• Metric: a preference value used when routes compete.
• Iface: the outgoing network interface.

The default route is used when no more-specific destination route matches. It is commonly shown with a destination such as 0.0.0.0 or default. If an external network is unreachable, check for an appropriate destination route, a valid gateway, and the expected interface:

ip route

Safe troubleshooting workflow

1. Check for a listener. Run sudo netstat -tulpn and verify that the expected TCP or UDP port appears.
2. Check the bind address. A service listening only on loopback cannot normally accept connections arriving through a remote interface.
3. Identify the owner. Use -p with sudo to associate the port with a PID and program name.
4. Inspect active sessions. Use sudo netstat -tunap and look for the expected foreign address and ESTABLISHED state.
5. Inspect states and queues. Repeated SYN_SENT, SYN_RECV, CLOSE_WAIT, or unusually large queues can identify the direction of further investigation. High TIME_WAIT counts can be normal for short-lived workloads.
6. Check protocol counters. Use netstat -s or netstat -st for retransmissions and errors.
7. Check interfaces and routes. Use netstat -i and netstat -r, or the modern ip equivalents.
8. Remove name-resolution ambiguity. Add -n during diagnosis.

Common troubleshooting examples

A service returns “connection refused”

First inspect the expected port:

sudo netstat -tlnp

If no listener exists, investigate the service's status and startup configuration. If a listener exists, check whether it is bound to 127.0.0.1 rather than an address reachable by clients, and verify that the PID and program are the intended service.

A local port is already in use

sudo netstat -tulpn

Find the existing listener, record its PID and program name, and then decide whether to stop the conflicting program or configure the new service to use another port.

Connections appear stuck or slow

sudo netstat -tunapc

Look for repeated SYN_SENT, SYN_RECV, or CLOSE_WAIT entries, unusually high queues, and changes between samples. Review TCP counters for retransmissions or errors. If socket output is inconclusive, continue with application logs or packet capture.

An external network is unreachable

netstat -r
netstat -i

Confirm a matching route or default route, the expected gateway, and the correct outbound interface. Then check interface errors and drops. If routing appears correct, investigate DNS and firewall policy separately.

Program names are missing

Process reporting commonly requires privileges:

sudo netstat -tunap

If names remain unavailable, operating-system process-visibility restrictions may apply. The modern alternative is sudo ss -tunap.

Exam-relevant notes

• -a includes listening sockets; without it, a listener may not appear in the basic report.
• -t means TCP, -u means UDP, -n means numeric output, and -p requests PID/program information.
• LISTEN is a TCP server state. UDP does not use TCP connection states.
• ESTABLISHED indicates an active TCP session.
• TIME_WAIT can be normal after short-lived TCP connections.
• Persistent CLOSE_WAIT often suggests that the local application has not closed sockets after the peer disconnected.
• Recv-Q and Send-Q should be interpreted over time; a nonzero value is not automatically an error.
• -r shows routes, while ip route is the preferred modern route command.