View source for PFSENSE - NETSTAT Command

[[Category:Wiki]]

== Syntax ==

The basic syntax of the `netstat` command is:

 <nowiki>
netstat [options]
</nowiki>

Where `[options]` can be any of the following flags, which modify the behavior of the command.

== Common Options ==

* `-a` : Display all sockets (both listening and non-listening).
* `-n` : Show numerical addresses instead of resolving hostnames.
* `-r` : Show the routing table.
* `-i` : Display network interfaces and their statistics.
* `-s` : Display statistics by protocol (TCP, UDP, ICMP, etc.).
* `-p` : Show the PID and program name associated with each socket.
* `-t` : Display TCP connections only.
* `-u` : Display UDP connections only.
* `-l` : Show only listening sockets.


== Display All Network Connections ==

To display all network connections (both listening and non-listening), use the `-a` option.

 <nowiki>
netstat -a</nowiki>

This command will show all active connections, including TCP and UDP connections, along with the listening sockets.

== Display Network Connections with Numerical Addresses ==

To show the numerical addresses of network connections instead of hostnames, use the `-n` option. This can be helpful for avoiding DNS resolution delays.

 <nowiki>
netstat -an</nowiki>

This command will show the connections using IP addresses instead of hostnames.

== Show Routing Table ==

To display the routing table, use the `-r` option.

 <nowiki>
netstat -r</nowiki>

This will display the kernel routing table, showing how the system routes network traffic.

== Display Interface Statistics ==

To view network interface statistics, use the `-i` option. This command will show the statistics for each interface.

 <nowiki>
netstat -i</nowiki>

The output includes information like the number of packets received and sent, errors, dropped packets, etc.

== Display Protocol Statistics ==

Use the `-s` option to display statistics for each network protocol (e.g., TCP, UDP, ICMP, etc.).

 <nowiki>
netstat -s</nowiki>

This command will show protocol-specific statistics, including the number of packets received, sent, errors, and other related metrics.

== Display Listening Sockets ==

To show only the listening sockets (ports that are waiting for incoming connections), use the `-l` option.

 <nowiki>
netstat -l</nowiki>

This will display all listening sockets, helping you identify which services are ready to accept connections.

== Display TCP Connections ==

To filter and show only TCP connections, use the `-t` option.

 <nowiki>
netstat -t</nowiki>

This will show all active TCP connections, including both incoming and outgoing.

== Display UDP Connections ==

To show only UDP connections, use the `-u` option.

 <nowiki>
netstat -u</nowiki>

This command will show all active UDP connections.

== Display PID and Program Name ==

To display the PID (Process ID) and the associated program name with each socket, use the `-p` option.

 <nowiki>
netstat -p</nowiki>

This will show the process ID and the name of the program that owns each socket.

== Combining Options ==

Multiple options can be combined to display more specific information. For example, to display all active connections with numerical addresses and associated PID/program name, use:

 <nowiki>
netstat -anp</nowiki>

This will show all connections with numerical addresses and the corresponding PID and program names.

== Example: Show Listening TCP Ports ==

If you want to display all listening TCP ports, use:

 <nowiki>
netstat -lt</nowiki>

This will display only the TCP sockets that are in the listening state.

== Example: Show Active UDP Connections with Program Info ==

To show active UDP connections along with the associated program names and PIDs:

 <nowiki>
netstat -up</nowiki>

This command will display active UDP connections and the processes associated with them.

== Example: Show Routing Table with Interface Information ==

To display the routing table along with interface information, use:

 <nowiki>
netstat -ri</nowiki>

This command will show the routing table and interface statistics in a readable format.

== Troubleshooting with netstat ==

Here are some practical troubleshooting scenarios where `netstat` can be useful:

* **Identifying open ports**: Use `netstat -an` to see which ports are open on your pfSense system.
* **Finding listening services**: Use `netstat -l` to determine which services are waiting for incoming connections.
* **Monitoring network performance**: Use `netstat -i` to check for packet errors, drops, and overall interface health.
* **Debugging connection issues**: Use `netstat -p` to find which processes are using specific network ports, helping to diagnose application-level issues.