📊 netstat Command - Network Statistics

Purpose: The netstat (network statistics) command displays network connections, routing tables, interface statistics, and protocol statistics. While considered deprecated in favor of ss, it's still widely used and available on most systems.

Basic Syntax: netstat [options]

Deprecation Notice: While netstat still works, ss (socket statistics) is the modern replacement and is faster. However, netstat remains popular due to familiarity and widespread availability. This guide covers both.

📋 10 Detailed Examples

Example 1: Display All Active Connections

Show all current network connections:

netstat -a

Sample Output:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     
tcp        0      0 localhost:3306          0.0.0.0:*               LISTEN     
tcp        0     52 server:22               client:54321            ESTABLISHED
udp        0      0 0.0.0.0:68              0.0.0.0:*                          
udp        0      0 0.0.0.0:123             0.0.0.0:*

Column meanings:

Proto: Protocol (tcp, udp, raw)
Recv-Q: Bytes not yet read by user program
Send-Q: Bytes not acknowledged by remote host
Local Address: Local IP:port
Foreign Address: Remote IP:port
State: Connection state (LISTEN, ESTABLISHED, etc.)

Tip: Add -n to show numeric addresses instead of resolving hostnames (faster): netstat -an

Example 2: Show Only Listening Ports

Display services listening for incoming connections:

netstat -l

TCP listeners only:

netstat -lt

UDP listeners only:

netstat -lu

All listeners with numeric ports:

netstat -ln

Sample Output:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN     
tcp6       0      0 :::80                   :::*                    LISTEN     
tcp6       0      0 :::443                  :::*                    LISTEN

Use cases:

Verify which services are accepting connections
Security audit (unexpected listeners?)
Troubleshoot service binding issues
Confirm firewall rules are working

Example 3: Show Listening Ports with Process Information

Identify which program is listening on which port:

sudo netstat -tlnp

All connections with process info:

sudo netstat -anp

Sample Output:

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1234/sshd          
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      5678/mysqld        
tcp6       0      0 :::80                   :::*                    LISTEN      9012/nginx         
tcp6       0      0 :::443                  :::*                    LISTEN      9012/nginx

Options explained:

-t: TCP connections only
-l: Listening sockets only
-n: Numeric addresses (no DNS lookup)
-p: Show PID and program name (requires sudo)

Perfect for:

Finding what's using port 80/443
Identifying rogue services
Troubleshooting "address already in use" errors

Example 4: Display Routing Table

Show kernel routing table:

netstat -r

Numeric format (faster):

netstat -rn

Sample Output:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG        0 0          0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 eth0
192.168.122.0   0.0.0.0         255.255.255.0   U         0 0          0 virbr0

Flag meanings:

U: Route is up
G: Use gateway
H: Target is a host
D: Dynamically installed by daemon or redirect
M: Modified by routing daemon or redirect

Modern alternative:

ip route show

Example 5: Show Network Interface Statistics

Display statistics for all network interfaces:

netstat -i

Extended information:

netstat -ie

Sample Output:

Kernel Interface table
Iface      MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0      1500  1234567      0      0      0   987654      0      0      0 BMRU
lo       65536    12345      0      0      0    12345      0      0      0 LRU

Continuous monitoring:

# Update every 2 seconds
netstat -i 2

Statistics explained:

RX-OK/TX-OK: Successfully received/transmitted packets
RX-ERR/TX-ERR: Errors during reception/transmission
RX-DRP/TX-DRP: Dropped packets
RX-OVR/TX-OVR: Overrun errors

Troubleshooting: High error or drop counts indicate network hardware or driver issues.

Example 6: Protocol Statistics

Show detailed statistics for each protocol:

netstat -s

Sample Output (truncated):

Ip:
    1234567 total packets received
    0 forwarded
    0 incoming packets discarded
    1234560 incoming packets delivered
    987654 requests sent out
Tcp:
    12345 active connections openings
    6789 passive connection openings
    123 failed connection attempts
    456 connection resets received
    78 connections established
Udp:
    54321 packets received
    12 packets to unknown port received
    0 packet receive errors

Specific protocol stats:

# TCP statistics only
netstat -st

# UDP statistics only  
netstat -su

Key metrics to monitor:

Failed connection attempts: May indicate firewall/routing issues
Connection resets: Application or network problems
Packet receive errors: Hardware or driver issues
Retransmitted segments: Network congestion

Example 7: Monitor Specific Connection States

View connections in specific TCP states:

ESTABLISHED connections only:

netstat -an | grep ESTABLISHED

Count ESTABLISHED connections:

netstat -an | grep ESTABLISHED | wc -l

TIME_WAIT connections:

netstat -an | grep TIME_WAIT

All connection states with count:

netstat -an | awk '/^tcp/ {print $6}' | sort | uniq -c | sort -rn

Sample Output:

    156 ESTABLISHED
     89 TIME_WAIT
     12 LISTEN
      5 SYN_SENT
      2 CLOSE_WAIT

TCP States explained:

LISTEN: Waiting for connection
SYN_SENT: Connection request sent
SYN_RECEIVED: Connection request received
ESTABLISHED: Connection active
FIN_WAIT: Connection closing
CLOSE_WAIT: Waiting for close from local
TIME_WAIT: Waiting to ensure remote received close

Example 8: Continuous Network Monitoring Script

Monitor network activity in real-time:

#!/bin/bash
# network-monitor.sh - Continuous network monitoring

INTERVAL=5
LOG_FILE="/tmp/network_monitor.log"

echo "Network Monitor Started: $(date)" | tee -a $LOG_FILE
echo "Monitoring every $INTERVAL seconds..." | tee -a $LOG_FILE
echo "Press Ctrl+C to stop"
echo ""

while true; do
    clear
    echo "=== Network Monitor - $(date) ==="
    echo ""
    
    # Active connections count
    echo "=== Active Connections by State ==="
    netstat -an | awk '/^tcp/ {print $6}' | sort | uniq -c | sort -rn
    echo ""
    
    # Top 10 connections by foreign address
    echo "=== Top 10 Connection Destinations ==="
    netstat -an | grep ESTABLISHED | awk '{print $5}' | cut -d: -f1 | \
        sort | uniq -c | sort -rn | head -10
    echo ""
    
    # Listening services
    echo "=== Listening Services ==="
    sudo netstat -tlnp | grep LISTEN | awk '{print $4, $7}' | column -t
    echo ""
    
    # Network interface stats
    echo "=== Interface Statistics ==="
    netstat -i | grep -v Kernel | grep -v Iface
    echo ""
    
    # Log summary
    echo "[$(date)] Connections: $(netstat -an | grep ESTABLISHED | wc -l)" >> $LOG_FILE
    
    sleep $INTERVAL
done

Usage:

bash network-monitor.sh

Example 9: Security Audit - Detect Suspicious Connections

Identify potentially malicious network activity:

#!/bin/bash
# security-netstat-audit.sh - Network security audit

REPORT="/tmp/network_security_audit_$(date +%Y%m%d).txt"

echo "Network Security Audit - $(date)" > $REPORT
echo "========================================" >> $REPORT
echo "" >> $REPORT

# 1. Unusual listening ports (high ports)
echo "=== Unusual Listening Ports (>10000) ===" >> $REPORT
sudo netstat -tlnp | awk '$4 ~ /:/ {split($4,a,":"); if(a[2]>10000) print $0}' \
    >> $REPORT || echo "None found" >> $REPORT
echo "" >> $REPORT

# 2. Connections to foreign countries (example: check for suspicious IPs)
echo "=== External ESTABLISHED Connections ===" >> $REPORT
netstat -an | grep ESTABLISHED | grep -v "127.0.0.1" | \
    awk '{print $5}' | cut -d: -f1 | sort -u >> $REPORT
echo "" >> $REPORT

# 3. Excessive connections from single IP
echo "=== IPs with >50 Connections ===" >> $REPORT
netstat -an | grep ESTABLISHED | awk '{print $5}' | cut -d: -f1 | \
    sort | uniq -c | sort -rn | awk '$1>50 {print $0}' >> $REPORT || \
    echo "None found" >> $REPORT
echo "" >> $REPORT

# 4. SYN_FLOOD detection (lots of SYN_RECV)
echo "=== Potential SYN Flood (SYN_RECV > 20) ===" >> $REPORT
SYN_COUNT=$(netstat -an | grep SYN_RECV | wc -l)
if [ $SYN_COUNT -gt 20 ]; then
    echo "WARNING: $SYN_COUNT SYN_RECV connections detected!" >> $REPORT
    netstat -an | grep SYN_RECV | head -20 >> $REPORT
else
    echo "Normal: $SYN_COUNT SYN_RECV connections" >> $REPORT
fi
echo "" >> $REPORT

# 5. Processes with unusual network activity
echo "=== Non-Standard Processes with Network Connections ===" >> $REPORT
sudo netstat -anp | grep ESTABLISHED | grep -v -E "(sshd|nginx|apache|mysql)" | \
    awk '{print $7}' | sort -u >> $REPORT || echo "None found" >> $REPORT
echo "" >> $REPORT

# 6. Check for excessive TIME_WAIT (potential DoS)
echo "=== TIME_WAIT Connection Count ===" >> $REPORT
TIMEWAIT=$(netstat -an | grep TIME_WAIT | wc -l)
echo "TIME_WAIT connections: $TIMEWAIT" >> $REPORT
if [ $TIMEWAIT -gt 1000 ]; then
    echo "WARNING: Excessive TIME_WAIT connections!" >> $REPORT
fi
echo "" >> $REPORT

echo "Audit complete. Report: $REPORT"
cat $REPORT

Example 10: Comprehensive Network Health Dashboard

Complete network health monitoring script:

#!/bin/bash
# network-health-dashboard.sh - Complete network status overview

print_header() {
    echo ""
    echo "=========================================="
    echo "$1"
    echo "=========================================="
}

print_header "NETWORK HEALTH DASHBOARD - $(hostname)"
echo "Generated: $(date)"

print_header "1. LISTENING SERVICES"
echo "Active Listeners:"
sudo netstat -tlnp | grep LISTEN | awk '{print $4, $7}' | \
    sed 's/.*:/Port: /' | column -t | head -20

print_header "2. CONNECTION SUMMARY"
echo "Total Connections by Protocol:"
netstat -an | awk '/^tcp/ {tcp++} /^udp/ {udp++} END {print "TCP:", tcp; print "UDP:", udp}'
echo ""
echo "TCP Connection States:"
netstat -an | awk '/^tcp/ {print $6}' | sort | uniq -c | sort -rn

print_header "3. TOP 10 REMOTE CONNECTIONS"
netstat -an | grep ESTABLISHED | awk '{print $5}' | cut -d: -f1 | \
    sort | uniq -c | sort -rn | head -10

print_header "4. NETWORK INTERFACE STATISTICS"
netstat -i

print_header "5. ROUTING TABLE"
netstat -rn

print_header "6. PROTOCOL STATISTICS (Summary)"
echo "TCP Statistics:"
netstat -st | grep -E "connections|segments|retransmitted" | head -10
echo ""
echo "UDP Statistics:"
netstat -su | grep -E "packets|errors" | head -5

print_header "7. POTENTIAL ISSUES"
echo "Checking for common problems..."

# Check for port conflicts
LISTENING=$(sudo netstat -tlnp | grep LISTEN | wc -l)
echo "- Listening services: $LISTENING"

# Check for excessive connections
ESTABLISHED=$(netstat -an | grep ESTABLISHED | wc -l)
echo "- Established connections: $ESTABLISHED"
if [ $ESTABLISHED -gt 1000 ]; then
    echo "  ⚠️  WARNING: High connection count!"
fi

# Check for excessive TIME_WAIT
TIMEWAIT=$(netstat -an | grep TIME_WAIT | wc -l)
echo "- TIME_WAIT connections: $TIMEWAIT"
if [ $TIMEWAIT -gt 500 ]; then
    echo "  ⚠️  WARNING: High TIME_WAIT count!"
fi

# Check interface errors
echo "- Interface errors:"
netstat -i | awk 'NR>2 {if($3>0 || $4>0 || $5>0) print "  ⚠️ ", $1, "has errors"}'

print_header "8. BANDWIDTH ESTIMATION"
echo "Interface throughput (approximate):"
netstat -i | awk 'NR>2 {printf "%-10s RX: %10d packets  TX: %10d packets\n", $1, $3, $7}'

print_header "Dashboard Complete"

Usage:

bash network-health-dashboard.sh
bash network-health-dashboard.sh > network_report.txt

📊 Complete Options Reference

Option	Description	Example
`-a`	Show all sockets (listening and non-listening)	`netstat -a`
`-t`	TCP connections only	`netstat -t`
`-u`	UDP connections only	`netstat -u`
`-l`	Show only listening sockets	`netstat -l`
`-n`	Show numeric addresses (no DNS)	`netstat -n`
`-p`	Show process ID and program name	`netstat -p`
`-r`	Show routing table	`netstat -r`
`-i`	Show network interface statistics	`netstat -i`
`-s`	Show protocol statistics	`netstat -s`
`-c`	Continuous output	`netstat -c`

🆚 netstat vs ss Comparison

Task	netstat	ss (modern replacement)
All connections	`netstat -a`	`ss -a`
Listening ports	`netstat -l`	`ss -l`
TCP with PIDs	`netstat -tlnp`	`ss -tlnp`
Established only	`netstat -an \| grep ESTAB`	`ss -o state established`

Pro Tip: While netstat is deprecated, it's often still installed by default. Learn ss for new work, but know netstat for legacy systems.

🎯 Common Troubleshooting Commands

Problem	Command
What's using port 80?	`sudo netstat -tlnp \| grep :80`
How many connections do I have?	`netstat -an \| grep ESTABLISHED \| wc -l`
What's my default gateway?	`netstat -rn \| grep ^0.0.0.0`
Any interface errors?	`netstat -i`
Check for SYN flood	`netstat -an \| grep SYN_RECV \| wc -l`

📚 Quick Reference Card

Task	Command
Show all connections	`netstat -a`
Show listening ports	`netstat -l`
Show with process info	`sudo netstat -anp`
TCP listeners only	`netstat -tln`
Show routing table	`netstat -rn`
Interface statistics	`netstat -i`
Protocol statistics	`netstat -s`
Continuous monitoring	`netstat -c`