Netstat Command Explained: How to Check Network Connections

The Netstat command is a network troubleshooting tool that lets you view active connections, listening ports, routing information, network interfaces, and protocol statistics on a computer or server.

If you need to find out which ports are open, whether a server has active connections, or which application is using a particular port, Netstat can quickly provide the answer.

Although newer Linux systems often use the ss command instead, Netstat remains useful for troubleshooting, working with older systems, and understanding how network connections work.

What Is the Netstat Command?

Netstat stands for network statistics. It is a command-line utility that displays information about a system’s network activity.

You can use Netstat to check:

• Active TCP and UDP connections
• Listening ports
• IP addresses and port numbers
• Programs using network connections
• Routing tables
• Network interface statistics
• TCP, UDP, and other protocol statistics

Netstat belongs to the net-tools package on Linux.

On some modern Linux distributions, it may not be installed by default because newer tools such as ss and ip provide similar functionality.

Basic Netstat Command Syntax

The basic syntax is:

netstat [options]

Running Netstat without options:

netstat

Displays active network connections.

The output usually contains information such as:

• Proto – the protocol, such as TCP or UDP
• Recv-Q – data received but not yet processed
• Send-Q – data waiting to be sent
• Local Address – your system’s IP address and port
• Foreign Address – the remote system’s IP address and port
• State – the current connection state

You can combine several Netstat options to get more useful results.

How to Check All Network Connections

Use the -a option to display both active connections and listening sockets:

netstat -a

Because the output can become quite long, you will usually combine -a with other options.

For example:

netstat -at

shows TCP connections, while:

netstat -au

shows UDP connections.

How to Check Listening Ports

A listening port is waiting for incoming network connections.

To display listening sockets, use:

netstat -l

For TCP listening ports:

netstat -lt

For UDP:

netstat -lu

Checking listening ports is useful when troubleshooting a web server, DNS server, mail server, database, or another network service.

For example, a web server may listen on TCP port 80 for HTTP or port 443 for HTTPS.

Display IP Addresses and Port Numbers

By default, Netstat may try to translate IP addresses and port numbers into hostnames and service names.

Use the -n option to show numeric values instead:

netstat -n

For example, instead of displaying a service name such as https, Netstat can show port 443.

Numeric output is often easier to use when troubleshooting and can also return results faster because Netstat does not need to perform name resolution.

Find Which Program Is Using a Port

One of the most useful Netstat commands is:

netstat -tulpn

This combines several options:

• -t – TCP
• -u – UDP
• -l – listening sockets
• -p – process or program
• -n – numeric addresses and ports

It can help you identify which application is listening on a specific port.

For example, you might find that Nginx is listening on port 80 or that an SSH server is listening on port 22.

Depending on your system and permissions, you may need elevated privileges to see process information:

sudo netstat -tulpn

Check a Specific Port With Netstat Command

You can combine Netstat with grep to search for a specific port.

For example, to check port 53:

netstat -tulpn | grep :53

Port 53 is commonly used for DNS traffic, so this command can help determine whether a DNS service is listening on the system.

To check HTTPS port 443:

netstat -tulpn | grep :443

If no result appears, no matching listening socket may exist under the selected options.

Check Established Connections

TCP connections can have different states.

To find active connections that have successfully been established, run:

netstat -ant | grep ESTABLISHED

Common TCP states include:

LISTEN – the system is waiting for incoming connections.

ESTABLISHED – two systems have an active TCP connection.

TIME_WAIT – the connection has closed, but the system temporarily keeps information about it.

Seeing multiple TIME_WAIT connections does not automatically indicate a problem. TCP uses this state as part of normal connection handling.

Display the Routing Table

Netstat can also display the system’s routing table:

netstat -r

A particularly useful version is:

netstat -rn

The -n option prevents hostname resolution and displays addresses numerically.

The routing table shows how the system decides where to send network traffic, including its default gateway and available network routes.

Check Network Interface Statistics

To view information about network interfaces, use:

netstat -i

This can show interfaces such as Ethernet, loopback, or other network adapters, along with packet and error statistics.

It can be useful when investigating packet errors or checking whether an interface is actively sending and receiving traffic.

View Network Protocol Statistics

To display statistics for network protocols, run:

netstat -s

The output can include statistics for TCP, UDP, IP, and ICMP.

This command is particularly useful when diagnosing network problems because it can reveal failed connections, packet errors, retransmissions, and other activity.

Useful Netstat Commands at a Glance

Here are some of the most useful commands to remember:

netstat -a

Show all connections and listening sockets.

netstat -t

Show TCP connections.

netstat -u

Show UDP connections.

netstat -l

Show listening sockets.

netstat -tulpn

Show listening TCP and UDP ports with process information.

netstat -rn

Show the routing table numerically.

netstat -s

Show protocol statistics.

Netstat vs SS: Which Should You Use?

Netstat is still useful, but Linux documentation describes it as a mostly obsolete tool. Modern Linux systems generally recommend ss for inspecting sockets and ip for networking and routing tasks.

For example:

netstat -tulpn

has a similar use case to:

ss -tulpn

The ss command is generally faster on systems with many connections and can provide more detailed TCP information.

However, Netstat remains common in documentation, older Linux environments, troubleshooting guides, and scripts. Knowing how it works can therefore still be valuable.

Conclusion

The Netstat command provides a simple way to see what is happening on a system’s network.

You can use it to check active connections, find listening ports, identify applications using specific ports, inspect routing information, and review network statistics.

For modern Linux systems, learning ss alongside Netstat is a good idea. But if you are troubleshooting an older server or following existing network documentation, Netstat remains a useful command to have in your toolbox.