PFSENSE - NETSTAT Command
Syntax
The basic syntax of the `netstat` command is:
netstat [options]
Where `[options]` can be any of the following flags, which modify the behavior of the command.
Common Options
- `-a` : Display all sockets (both listening and non-listening).
- `-n` : Show numerical addresses instead of resolving hostnames.
- `-r` : Show the routing table.
- `-i` : Display network interfaces and their statistics.
- `-s` : Display statistics by protocol (TCP, UDP, ICMP, etc.).
- `-p` : Show the PID and program name associated with each socket.
- `-t` : Display TCP connections only.
- `-u` : Display UDP connections only.
- `-l` : Show only listening sockets.
Display All Network Connections
To display all network connections (both listening and non-listening), use the `-a` option.
netstat -a
This command will show all active connections, including TCP and UDP connections, along with the listening sockets.
Display Network Connections with Numerical Addresses
To show the numerical addresses of network connections instead of hostnames, use the `-n` option. This can be helpful for avoiding DNS resolution delays.
netstat -an
This command will show the connections using IP addresses instead of hostnames.
Show Routing Table
To display the routing table, use the `-r` option.
netstat -r
This will display the kernel routing table, showing how the system routes network traffic.
Display Interface Statistics
To view network interface statistics, use the `-i` option. This command will show the statistics for each interface.
netstat -i
The output includes information like the number of packets received and sent, errors, dropped packets, etc.
Display Protocol Statistics
Use the `-s` option to display statistics for each network protocol (e.g., TCP, UDP, ICMP, etc.).
netstat -s
This command will show protocol-specific statistics, including the number of packets received, sent, errors, and other related metrics.
Display Listening Sockets
To show only the listening sockets (ports that are waiting for incoming connections), use the `-l` option.
netstat -l
This will display all listening sockets, helping you identify which services are ready to accept connections.
Display TCP Connections
To filter and show only TCP connections, use the `-t` option.
netstat -t
This will show all active TCP connections, including both incoming and outgoing.
Display UDP Connections
To show only UDP connections, use the `-u` option.
netstat -u
This command will show all active UDP connections.
Display PID and Program Name
To display the PID (Process ID) and the associated program name with each socket, use the `-p` option.
netstat -p
This will show the process ID and the name of the program that owns each socket.
Combining Options
Multiple options can be combined to display more specific information. For example, to display all active connections with numerical addresses and associated PID/program name, use:
netstat -anp
This will show all connections with numerical addresses and the corresponding PID and program names.
Example: Show Listening TCP Ports
If you want to display all listening TCP ports, use:
netstat -lt
This will display only the TCP sockets that are in the listening state.
Example: Show Active UDP Connections with Program Info
To show active UDP connections along with the associated program names and PIDs:
netstat -up
This command will display active UDP connections and the processes associated with them.
Example: Show Routing Table with Interface Information
To display the routing table along with interface information, use:
netstat -ri
This command will show the routing table and interface statistics in a readable format.
Troubleshooting with netstat
Here are some practical troubleshooting scenarios where `netstat` can be useful:
- **Identifying open ports**: Use `netstat -an` to see which ports are open on your pfSense system.
- **Finding listening services**: Use `netstat -l` to determine which services are waiting for incoming connections.
- **Monitoring network performance**: Use `netstat -i` to check for packet errors, drops, and overall interface health.
- **Debugging connection issues**: Use `netstat -p` to find which processes are using specific network ports, helping to diagnose application-level issues.
