netstat Cheatsheet
Basic Syntax
Core netstat command forms and output controls.
| Command | Description |
|---|---|
netstat |
Show active non-listening sockets |
sudo netstat -a |
Show all sockets |
sudo netstat -n |
Show numeric addresses and ports |
sudo netstat -p |
Show PID and program name where available |
sudo netstat -c |
Refresh output every second |
Listening Ports
Find services that are accepting local connections.
| Command | Description |
|---|---|
sudo netstat -tuln |
Show TCP and UDP listening sockets |
sudo netstat -tulnp |
Show listening sockets with PID and process name |
sudo netstat -tnlp |
Show listening TCP sockets only |
sudo netstat -unlp |
Show listening UDP sockets only |
sudo netstat -tulnp | grep ':80' |
Find the process listening on port 80 |
Connections and TCP States
Inspect active connections and common TCP states.
| Command | Description |
|---|---|
sudo netstat -at |
Show all TCP sockets |
sudo netstat -au |
Show all UDP sockets |
sudo netstat -ant |
Show TCP sockets with numeric addresses |
sudo netstat -ant | grep ESTABLISHED |
Show established TCP connections |
sudo netstat -ant | grep TIME_WAIT |
Show TCP connections in TIME_WAIT |
sudo netstat -atnc |
Watch TCP connection output continuously |
Counts and Filters
Use shell filters with netstat output.
| Command | Description |
|---|---|
sudo netstat -ant | wc -l |
Count TCP output rows |
sudo netstat -ant | grep ':80' | wc -l |
Count TCP connections involving port 80 |
sudo netstat -ant | grep ESTABLISHED | wc -l |
Count established TCP connections |
sudo netstat -tulnp | grep nginx |
Find sockets owned by nginx |
sudo netstat -ant | grep 203.0.113.10 |
Filter connections by remote IP address |
Routes, Interfaces, and Stats
Show routing, interface, and protocol information.
| Command | Description |
|---|---|
netstat -rn |
Show the routing table with numeric addresses |
netstat -r |
Show the routing table with name resolution |
netstat -i |
Show interface counters |
netstat -ie |
Show extended interface details |
netstat -s |
Show protocol statistics |
netstat -st |
Show TCP protocol statistics |
netstat -su |
Show UDP protocol statistics |
Modern Replacements
Use current Linux tools for new workflows and scripts.
| netstat Command | Modern Command |
|---|---|
netstat -tuln |
ss -tuln |
sudo netstat -tulnp |
sudo ss -tulnp |
netstat -rn |
ip route |
netstat -i |
ip -s link |
netstat -s |
ss -s |
Troubleshooting
Common netstat issues and quick fixes.
| Issue | Check |
|---|---|
netstat: command not found |
Install the net-tools package or use ss |
| Process column is empty | Run with sudo when using -p |
| Output is slow | Add -n to disable name resolution |
| Port lookup matches too much | Search with a colon, such as grep ':80' |
| Need listeners only | Add -l with protocol flags such as -tuln |
Related Guides
Use these guides for full walkthroughs and modern alternatives.
| Guide | Description |
|---|---|
netstat Command in Linux
|
Full netstat guide with examples |
ss Command in Linux
|
Modern socket inspection tool |
ip Command in Linux
|
Modern routes and interface management |
| How to Check Listening Ports in Linux | Compare ss, netstat, and lsof |
lsof Command in Linux
|
Tie sockets and files back to processes |
AI Assistant
