netstat Cheatsheet
Quick reference for listing network connections, listening ports, routes, interface counters, and protocol statistics with netstat
The `netstat` command shows network connections, listening ports, routing tables, interface counters, and protocol statistics on Linux. This cheatsheet covers the most useful `netstat` flags and common troubleshooting patterns.
Basic Syntax
Core netstat command forms and output controls.
| Command | Description |
|---|---|
netstat | Show active non-listening sockets |
sudo netstat -a | Show all sockets |
sudo netstat -n | Show numeric addresses and ports |
sudo netstat -p | Show PID and program name where available |
sudo netstat -c | Refresh output every second |
Listening Ports
Find services that are accepting local connections.
| Command | Description |
|---|---|
sudo netstat -tuln | Show TCP and UDP listening sockets |
sudo netstat -tulnp | Show listening sockets with PID and process name |
sudo netstat -tnlp | Show listening TCP sockets only |
sudo netstat -unlp | Show listening UDP sockets only |
sudo netstat -tulnp | grep ':80' | Find the process listening on port 80 |
Connections and TCP States
Inspect active connections and common TCP states.
| Command | Description |
|---|---|
sudo netstat -at | Show all TCP sockets |
sudo netstat -au | Show all UDP sockets |
sudo netstat -ant | Show TCP sockets with numeric addresses |
sudo netstat -ant | grep ESTABLISHED | Show established TCP connections |
sudo netstat -ant | grep TIME_WAIT | Show TCP connections in TIME_WAIT |
sudo netstat -atnc | Watch TCP connection output continuously |
Counts and Filters
Use shell filters with netstat output.
| Command | Description |
|---|---|
sudo netstat -ant | wc -l | Count TCP output rows |
sudo netstat -ant | grep ':80' | wc -l | Count TCP connections involving port 80 |
sudo netstat -ant | grep ESTABLISHED | wc -l | Count established TCP connections |
sudo netstat -tulnp | grep nginx | Find sockets owned by nginx |
sudo netstat -ant | grep 203.0.113.10 | Filter connections by remote IP address |
Routes, Interfaces, and Stats
Show routing, interface, and protocol information.
| Command | Description |
|---|---|
netstat -rn | Show the routing table with numeric addresses |
netstat -r | Show the routing table with name resolution |
netstat -i | Show interface counters |
netstat -ie | Show extended interface details |
netstat -s | Show protocol statistics |
netstat -st | Show TCP protocol statistics |
netstat -su | Show UDP protocol statistics |
Modern Replacements
Use current Linux tools for new workflows and scripts.
| netstat Command | Modern Command |
|---|---|
netstat -tuln | ss -tuln |
sudo netstat -tulnp | sudo ss -tulnp |
netstat -rn | ip route |
netstat -i | ip -s link |
netstat -s | ss -s |
Troubleshooting
Common netstat issues and quick fixes.
| Issue | Check |
|---|---|
netstat: command not found | Install the net-tools package or use ss |
| Process column is empty | Run with sudo when using -p |
| Output is slow | Add -n to disable name resolution |
| Port lookup matches too much | Search with a colon, such as grep ':80' |
| Need listeners only | Add -l with protocol flags such as -tuln |
Related Guides
Use these guides for full walkthroughs and modern alternatives.
| Guide | Description |
|---|---|
netstat Command in Linux | Full netstat guide with examples |
ss Command in Linux | Modern socket inspection tool |
ip Command in Linux | Modern routes and interface management |
| How to Check Listening Ports in Linux | Compare ss, netstat, and lsof |
lsof Command in Linux | Tie sockets and files back to processes |