NETSTAT - Examples - Revision history

Admin: Text replacement - "Category:Wiki" to "Category:Wiki '''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]''''' "

2026-01-17T08:14:55Z

Text replacement - "Category:Wiki" to "Category:Wiki '''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]''''' "

← Older revision		Revision as of 08:14, 17 January 2026
Line 1:		Line 1:
	[[Category:Wiki]]		[[Category:Wiki]]

			'''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]'''''


	== Common Netstat Commands ==		== Common Netstat Commands ==

Admin at 19:47, 12 January 2026

2026-01-12T19:47:20Z

← Older revision		Revision as of 19:47, 12 January 2026
Line 6:		Line 6:
	To display all network connections, including listening ports and established connections:		To display all network connections, including listening ports and established connections:

	<nowiki>		<nowiki>
	netstat -a		netstat -a</nowiki>
	</nowiki>

	This command shows all sockets (TCP, UDP, etc.), including listening and non-listening ones.		This command shows all sockets (TCP, UDP, etc.), including listening and non-listening ones.
Line 15:		Line 14:
	To display only the listening ports:		To display only the listening ports:

	<nowiki>		<nowiki>
	netstat -l		netstat -l</nowiki>
	</nowiki>

	This command shows only the ports that are actively listening for incoming connections.		This command shows only the ports that are actively listening for incoming connections.
Line 24:		Line 22:
	To display network statistics, including interface usage and packet statistics:		To display network statistics, including interface usage and packet statistics:

	<nowiki>		<nowiki>
	netstat -s		netstat -s</nowiki>
	</nowiki>

	This provides information about the network interfaces and protocol usage on the system.		This provides information about the network interfaces and protocol usage on the system.
Line 33:		Line 30:
	To view the system's routing table:		To view the system's routing table:

	<nowiki>		<nowiki>
	netstat -r		netstat -r</nowiki>
	</nowiki>

	This command displays the routing table that shows how packets are routed in the network.		This command displays the routing table that shows how packets are routed in the network.
Line 42:		Line 38:
	To display network interface statistics:		To display network interface statistics:

	<nowiki>		<nowiki>
	netstat -i		netstat -i</nowiki>
	</nowiki>

	This command shows statistics for each network interface on the system, including packet counts, errors, and collisions.		This command shows statistics for each network interface on the system, including packet counts, errors, and collisions.
Line 55:		Line 50:
	In BSD-based systems, the `-n` option is used to display IP addresses and port numbers in numerical format without resolving them to hostnames or service names. For example:		In BSD-based systems, the `-n` option is used to display IP addresses and port numbers in numerical format without resolving them to hostnames or service names. For example:

	<nowiki>		<nowiki>
	netstat -an		netstat -an</nowiki>
	</nowiki>

	This command prevents DNS resolution for IP addresses and port names.		This command prevents DNS resolution for IP addresses and port names.
Line 64:		Line 58:
	In Linux, `netstat` is often used with options like `-t` (TCP), `-u` (UDP), and `-p` (process) to filter the output. An example of this on Linux:		In Linux, `netstat` is often used with options like `-t` (TCP), `-u` (UDP), and `-p` (process) to filter the output. An example of this on Linux:

	<nowiki>		<nowiki>
	netstat -tuln		netstat -tuln</nowiki>
	</nowiki>

	This shows all listening TCP and UDP ports in numeric form, without resolving hostnames or service names.		This shows all listening TCP and UDP ports in numeric form, without resolving hostnames or service names.
Line 77:		Line 70:
	Look for unexpected listening ports or foreign IP addresses:		Look for unexpected listening ports or foreign IP addresses:

	<nowiki>		<nowiki>
	netstat -tuln		netstat -tuln</nowiki>
	</nowiki>

	If an unfamiliar service or port is listening on the system, investigate further.		If an unfamiliar service or port is listening on the system, investigate further.
Line 88:		Line 80:
	Identify listening ports:		Identify listening ports:

	<nowiki>		<nowiki>
	netstat -l		netstat -l</nowiki>
	</nowiki>

	Once you identify services listening on unnecessary ports, disable them in the system configuration files or firewall settings.		Once you identify services listening on unnecessary ports, disable them in the system configuration files or firewall settings.
Line 97:		Line 88:
	Use `netstat` in combination with process information to identify suspicious processes associated with network connections. For example, on Linux, use the `-p` option to show the PID associated with a connection:		Use `netstat` in combination with process information to identify suspicious processes associated with network connections. For example, on Linux, use the `-p` option to show the PID associated with a connection:

	<nowiki>		<nowiki>
	netstat -tulpn		netstat -tulpn</nowiki>
	</nowiki>

	This command shows the PID of each process, allowing you to identify which service or process is holding a particular port.		This command shows the PID of each process, allowing you to identify which service or process is holding a particular port.
Line 108:		Line 98:
	Example:		Example:

	<nowiki>		<nowiki>
	netstat -an \| grep 'LISTEN'		netstat -an \| grep 'LISTEN'</nowiki>
	</nowiki>

	This helps in confirming that the firewall is correctly blocking or allowing the right ports.		This helps in confirming that the firewall is correctly blocking or allowing the right ports.
Line 121:		Line 110:
	Check the status of interfaces:		Check the status of interfaces:

	<nowiki>		<nowiki>
	ifconfig -a		ifconfig -a</nowiki>
	</nowiki>

	This shows all interfaces, including those that are down. If the interface is up, try checking the system logs for any network-related issues.		This shows all interfaces, including those that are down. If the interface is up, try checking the system logs for any network-related issues.
Line 130:		Line 118:
	On some Linux distributions, `netstat` may not be installed by default. In such cases, install the `net-tools` package that includes `netstat`:		On some Linux distributions, `netstat` may not be installed by default. In such cases, install the `net-tools` package that includes `netstat`:

	<nowiki>		For Debian-based systems :
	sudo apt-get install net-tools
	</nowiki> ~~(for Debian-based systems)~~		<nowiki>
			sudo apt-get install net-tools</nowiki>

	Or on Red Hat-based systems:		Or on Red Hat-based systems:

	<nowiki>		<nowiki>
	sudo yum install net-tools		sudo yum install net-tools</nowiki>
	</nowiki>

	=== Inconsistent Output or Missing Data ===		=== Inconsistent Output or Missing Data ===
Line 145:		Line 133:
	For example, use `ss` to show all open sockets:		For example, use `ss` to show all open sockets:

	<nowiki>		<nowiki>
	ss -tuln		ss -tuln</nowiki>
	</nowiki>

	This command offers more advanced features and is considered faster and more reliable than `netstat` on modern Linux systems.		This command offers more advanced features and is considered faster and more reliable than `netstat` on modern Linux systems.
Line 156:		Line 143:
	Example:		Example:

	<nowiki>		<nowiki>
	netstat -tuln		netstat -tuln</nowiki>
	</nowiki>

	If a service is not listening on the expected port, verify the service's configuration and restart it.		If a service is not listening on the expected port, verify the service's configuration and restart it.

Admin: Created page with "Category:Wiki == Common Netstat Commands == === Display All Network Connections === To display all network connections, including listening ports and established connections: netstat -a This command shows all sockets (TCP, UDP, etc.), including listening and non-listening ones. === Show Listening Ports === To display only the listening ports: netstat -l This command shows only the ports that are actively listening for inco..."

2026-01-12T19:45:51Z

Created page with "Category:Wiki == Common Netstat Commands == === Display All Network Connections === To display all network connections, including listening ports and established connections: <nowiki> netstat -a </nowiki> This command shows all sockets (TCP, UDP, etc.), including listening and non-listening ones. === Show Listening Ports === To display only the listening ports: <nowiki> netstat -l </nowiki> This command shows only the ports that are actively listening for inco..."

New page

[[Category:Wiki]]

== Common Netstat Commands ==

=== Display All Network Connections ===
To display all network connections, including listening ports and established connections:

<nowiki>
netstat -a
</nowiki>

This command shows all sockets (TCP, UDP, etc.), including listening and non-listening ones.

=== Show Listening Ports ===
To display only the listening ports:

<nowiki>
netstat -l
</nowiki>

This command shows only the ports that are actively listening for incoming connections.

=== Show Network Statistics ===
To display network statistics, including interface usage and packet statistics:

<nowiki>
netstat -s
</nowiki>

This provides information about the network interfaces and protocol usage on the system.

=== Display Routing Table ===
To view the system's routing table:

<nowiki>
netstat -r
</nowiki>

This command displays the routing table that shows how packets are routed in the network.

=== Display Network Interfaces ===
To display network interface statistics:

<nowiki>
netstat -i
</nowiki>

This command shows statistics for each network interface on the system, including packet counts, errors, and collisions.

== Differences Between Linux and BSD ==

On Linux and BSD systems, `netstat` is used similarly but may differ in syntax or options. In BSD-based systems (including FreeBSD, OpenBSD, and NetBSD), `netstat` may include additional or slightly different options.

=== BSD-Specific Options ===
In BSD-based systems, the `-n` option is used to display IP addresses and port numbers in numerical format without resolving them to hostnames or service names. For example:

<nowiki>
netstat -an
</nowiki>

This command prevents DNS resolution for IP addresses and port names.

=== Linux-Specific Options ===
In Linux, `netstat` is often used with options like `-t` (TCP), `-u` (UDP), and `-p` (process) to filter the output. An example of this on Linux:

<nowiki>
netstat -tuln
</nowiki>

This shows all listening TCP and UDP ports in numeric form, without resolving hostnames or service names.

== Security Concepts ==

=== Network Monitoring for Intrusions ===
Using `netstat` can help in identifying suspicious network connections and detect possible unauthorized access to the system.

Look for unexpected listening ports or foreign IP addresses:

<nowiki>
netstat -tuln
</nowiki>

If an unfamiliar service or port is listening on the system, investigate further.

=== Preventing Unauthorized Access ===
One of the first steps to securing a system is to monitor the open ports and active connections. Disabling unused services can help reduce the attack surface.

Identify listening ports:

<nowiki>
netstat -l
</nowiki>

Once you identify services listening on unnecessary ports, disable them in the system configuration files or firewall settings.

=== Detecting Malicious Processes ===
Use `netstat` in combination with process information to identify suspicious processes associated with network connections. For example, on Linux, use the `-p` option to show the PID associated with a connection:

<nowiki>
netstat -tulpn
</nowiki>

This command shows the PID of each process, allowing you to identify which service or process is holding a particular port.

=== Firewall and Netstat ===
Using a firewall in conjunction with `netstat` helps in ensuring that only authorized services are accessible to external networks. Once a firewall is configured, `netstat` can be used to verify which ports are open and which services are running.

Example:

<nowiki>
netstat -an | grep 'LISTEN'
</nowiki>

This helps in confirming that the firewall is correctly blocking or allowing the right ports.

== Troubleshooting ==

=== No Output or Blank Response ===
If `netstat` produces no output or a blank response, there may not be any active connections or network interfaces. Confirm that the network interfaces are up and the system has active network traffic.

Check the status of interfaces:

<nowiki>
ifconfig -a
</nowiki>

This shows all interfaces, including those that are down. If the interface is up, try checking the system logs for any network-related issues.

=== Command Fails with "Command Not Found" ===
On some Linux distributions, `netstat` may not be installed by default. In such cases, install the `net-tools` package that includes `netstat`:

<nowiki>
sudo apt-get install net-tools
</nowiki> (for Debian-based systems)

Or on Red Hat-based systems:

<nowiki>
sudo yum install net-tools
</nowiki>

=== Inconsistent Output or Missing Data ===
In some cases, `netstat` might show inconsistent or incomplete data, especially on systems that use modern tools like `ss` (socket stat). If you're facing issues with missing or inaccurate data, consider switching to `ss` for a more detailed view of socket statistics.

For example, use `ss` to show all open sockets:

<nowiki>
ss -tuln
</nowiki>

This command offers more advanced features and is considered faster and more reliable than `netstat` on modern Linux systems.

=== Network Connection Issues ===
If you're troubleshooting network connectivity issues, check for processes that may be binding to incorrect or closed ports. You can use `netstat` to identify such issues and resolve them by reconfiguring the application or service.

Example:

<nowiki>
netstat -tuln
</nowiki>

If a service is not listening on the expected port, verify the service's configuration and restart it.

== Useful Links ==
* https://man7.org/linux/man-pages/man8/netstat.8.html
* https://www.freebsd.org/cgi/man.cgi?query=netstat
* https://www.openbsd.org/cgi-man.cgi?query=netstat
* https://www.netbsd.org/docs/guide/en/chap-network.html
* https://wiki.archlinux.org/title/Netstat