It is used for finding problems in the network and to determine the amount of traffic on the network as a performance measurement.[1] On Linux this program is mostly obsolete, although still included in many distributions.
On Linux, netstat (part of "net-tools") is superseded by ss (part of iproute2). The replacement for netstat -r is ip route, the replacement for netstat -i is ip -s link, and the replacement for netstat -g is ip maddr, all of which are recommended instead.[2][3][4][5]
Local Address – The IP address of the local computer and the port number being used. The name of the local computer that corresponds to the IP address and the name of the port is shown unless the -n parameter is specified. An asterisk (*) is shown for the host if the server is listening on all interfaces. If the port is not yet established, the port number is shown as an asterisk.
Foreign Address – The IP address and port number of the remote computer to which the socket is connected. The names that corresponds to the IP address and the port are shown unless the -n parameter is specified. If the port is not yet established, the port number is shown as an asterisk (*).
State – Indicates the state of a TCP connection. The possible states are as follows: CLOSE_WAIT, CLOSED, ESTABLISHED, FIN_WAIT_1, FIN_WAIT_2, LAST_ACK, LISTEN, SYN_RECEIVED, SYN_SEND, and TIME_WAIT. For more information about the states of a TCP connection, see RFC 793.
Parameters
Parameters used with this command must be prefixed with a hyphen (-) rather than a slash (/). Some parameters are not supported on all platforms.
Displays all active connections and the TCP and UDP ports on which the computer is listening.
Yes
Yes
Yes
-b
Displays the binary (executable) program's name involved in creating each connection or listening port. (Windows XP, Windows Server 2003 and newer Windows operating systems; not Microsoft Windows 2000 or older).
Yes
No
No
-b
Causes -i to report the total number of bytes of traffic.
No
Yes
Yes
No
-e
Displays ethernet statistics, such as the number of bytes and packets sent and received. This parameter can be combined with -s.
Yes
Yes
No
-f
Displays fully qualified domain names <FQDN> for foreign addresses (only available on Windows Vista and newer operating systems).
Yes
No
No
-fAddress Family
Limits display to a particular socket address family, unix, inet, inet6
No
Yes
No
-g
Displays multicast group membership information for both IPv4 and IPv6 (may only be available on newer operating systems)
No
No
Yes
-i
Displays network interfaces and their statistics
No
No
Yes
-m
Displays the memory statistics for the networking code (STREAMS statistics on Solaris).
No
No
-n
Displays active TCP connections, however, addresses and port numbers are expressed numerically and no attempt is made to determine names.
Yes
Yes
Yes
-o
Displays active TCP connections and includes the process id (PID) for each connection. You can find the application based on the PID in the Processes tab in Windows Task Manager. This parameter can be combined with -a, -n, and -p. This parameter is available on Microsoft Windows XP, Windows Server 2003, and Windows 2000 if a hotfix is applied.[6]
Yes
No
No
-pprotocol
Shows connections for the protocol specified by protocol. In this case, protocol can be tcp, udp, tcpv6, or udpv6. If this parameter is used with -s to display statistics by protocol, protocol can be tcp, udp, icmp, ip, tcpv6, udpv6, icmpv6, or ipv6.
Yes
Yes
Yes
-p
Show which processes are using which sockets (similar to -b under Windows) (you must be root to do this)
No
No
Yes
-Pprotocol
Shows connections for the protocol specified by protocol. In this case, protocol can be ip, ipv6, icmp, icmpv6, igmp, udp, tcp, or rawip.
No
No
Yes
-r
Displays the contents of the IP routing table. (This is equivalent to the route print command under Windows.)
Yes
Yes
Yes
Yes
-s
Displays statistics by protocol. By default, statistics are shown for the TCP, UDP, ICMP, and IP protocols. If the IPv6 protocol for Windows XP is installed, statistics are shown for the TCP over IPv6, UDP over IPv6, ICMPv6, and IPv6 protocols. The -p parameter can be used to specify a set of protocols.
Yes
Yes
Yes
-t
Display only TCP connections.
No
Yes
Yes
-u
Display only UDP connections.
No
No
Yes
Yes
-W
Display wide output - doesn't truncate hostnames or IPv6 addresses
No
No
Yes
No
-x
Displays NetworkDirect connections, listeners, and shared endpoints.
Yes
-y
Displays the TCP connection template for all connections.Cannot be combined with the other options.
Yes
-v
When used in conjunction with -b it will display the sequence of components involved in creating the connection or listening port for all executables.
Yes
No
No
Interval
Redisplays the selected information every Interval seconds. Press CTRL+C to stop the redisplay. If this parameter is omitted, netstat prints the selected information only once.
Yes
Yes
No
-h
Displays help at the command prompt.
Yes
No
Yes
Yes
Yes
Yes
Yes
Yes
No
-?
Displays help at the command prompt.
Yes
No
No
No
No
No
No
No
Yes
/?
Displays help at the command prompt.
Yes
Yes
No
No
No
No
No
No
No
Examples
Cross platform
On macOS, BSD systems, Linux distributions, and Microsoft Windows:
To display the statistics for only the TCP or UDP protocols, type one of the following commands:
netstat -sp tcp
netstat -sp udp
Unix-like
On Unix-like systems:
To display all ports open by a process with id pid:
netstat -aop | grep "pid"
To continuously display open TCP and UDP connections numerically and also which program is using them on Linux:
netstat -nutpacw
Windows
On Microsoft Windows:
To display active TCP connections and the process IDs every 5 seconds, type the following command (works on NT based systems only, or Windows 2000 with hotfix):
netstat -o 5
To display active TCP connections and the process IDs using numerical form, type the following command (works on NT based systems only, or Windows 2000 with hotfix):
netstat -no
*nix
Command
Explanation
netstat -a
Shows all sockets , both listening and non-listening, all protocols like TCP, UDP etc.
netstat -at
Shows only TCP connections (-au shows only UDP connections)
netstat -ant
Shows all TCP connections with no DNS resolution (show IP addresses instead).
netstat -al
Shows only listening sockets.
netstat -aep
Also show PID and to which program each socket belongs, e adds extra info like the user. Run as root to see all PIDs.
netstat -s > file2.txt
Shows network statistics.
netstat -r
Shows kernel routing information. This is the same output as route -e.
netstat -i
Displays a table of all network interfaces. Add -e to get output similar to ifconfig.
netstat -ct
Displays TCP connections continuously.
netstat -g
Display multicast group membership information for IPv4 and IPv6.
netstat -lntu
Display all services listening for TCP and UDP, all free open ports on the local machine.
netstat -atnp | grep ESTA
Displays all currently "established" TCP connections.
Wildcards
Netstat uses an asterisk * as a wildcard which means "any". An example would be
Under "Local Address" *, in *:smtp, means the process is listening on all of the network interfaces the machine has for the port mapped as smtp (see /etc/services for service resolution). This can also be shown as 0.0.0.0. The first *, in *:*, means connections can come from any IP address, and the second *, in *:*, means the connection can originate from any port on the remote machine.
Caveats
Some versions of netstat lack explicit field delimiters in their printf-generated output, leading to numeric fields running together and thus corrupting the output data.
Under Linux, raw data can often be obtained from the /proc/net/dev to work around the printf output corruption arising in netstat's network interface statistics summary, netstat -i, until such time as the problem is corrected.[citation needed]
On the Windows platform, netstat information can be retrieved by calling the GetTcpTable and GetUdpTable functions in the IP Helper API, or IPHLPAPI.DLL. Information returned includes local and remote IP addresses, local and remote ports, and (for GetTcpTable) TCP status codes. In addition to the command-line netstat.exe tool that ships with Windows, GUI-based netstat programs are available.
On the Windows platform, this command is available only if the Internet Protocol (TCP/IP) protocol is installed as a component in the properties of a network adapter in Network Connections.
On the Windows platform running Remote Desktop Services (formerly Terminal Services) it will only show connections for the current user, not for the whole computer.
On macOS, the /System/Library/CoreServices/Applications folder (or /Applications/Utilities in OS X Mountain Lion and earlier) contains a network GUI utility called Network Utility, the Netstat tab of which runs the netstat command and displays its output in the tab.
See also
ss, a Linux utility to investigate sockets from iproute2 meant to replace netstat
^"Deprecated Linux networking commands and their replacements". Doug Vitale Tech Blog. 21 December 2011.
^"netstat man page (notes section)". Retrieved 2 August 2014. This program is obsolete. Replacement for netstat is ss. Replacement for netstat -r is ip route. Replacement for netstat -i is ip -s link. Replacement for netstat -g is ip maddr.
Microsoft TechNet: Netstat – documentation for the Windows netstat.exe command-line program
net-tools project page on SourceForge
Netstat Command: WindowsCMD.com 2022-01-11 at the Wayback Machine
January 22, 2023
netstat, this, article, needs, additional, citations, verification, please, help, improve, this, article, adding, citations, reliable, sources, unsourced, material, challenged, removed, find, sources, netstat, news, newspapers, books, scholar, jstor, august, 2. This article needs additional citations for verification Please help improve this article by adding citations to reliable sources Unsourced material may be challenged and removed Find sources Netstat news newspapers books scholar JSTOR August 2012 Learn how and when to remove this template message In computing netstat network statistics is a command line network utility that displays network connections for Transmission Control Protocol both incoming and outgoing routing tables and a number of network interface network interface controller or software defined network interface and network protocol statistics It is available on Unix Plan 9 Inferno and Unix like operating systems including macOS Linux Solaris and BSD It is also available on IBM OS 2 and on Microsoft Windows NT based operating systems including Windows XP Windows Vista Windows 7 Windows 8 and Windows 10 netstatThe netstat commandDeveloper s Various open source and commercial developersInitial release1983 40 years ago 1983 Written inPlan 9 COperating systemUnix Unix like Plan 9 Inferno OS 2 Microsoft Windows ReactOSPlatformCross platformTypeCommandLicenseOS 2 Windows Proprietary commercial softwarenet tools ReactOS GPLv2Plan 9 MIT LicenseIt is used for finding problems in the network and to determine the amount of traffic on the network as a performance measurement 1 On Linux this program is mostly obsolete although still included in many distributions On Linux netstat part of net tools is superseded by ss part of iproute2 The replacement for netstat r is ip route the replacement for netstat i is ip s link and the replacement for netstat g is ip maddr all of which are recommended instead 2 3 4 5 Contents 1 Statistics provided 2 Parameters 3 Examples 3 1 Cross platform 3 2 Unix like 3 3 Windows 3 4 nix 3 5 Wildcards 4 Caveats 5 Platform specific remarks 6 See also 7 References 8 Further reading 9 External linksStatistics provided Edit The ReactOS netstat command Netstat provides statistics for the following Proto The name of the protocol TCP or UDP Local Address The IP address of the local computer and the port number being used The name of the local computer that corresponds to the IP address and the name of the port is shown unless the n parameter is specified An asterisk is shown for the host if the server is listening on all interfaces If the port is not yet established the port number is shown as an asterisk Foreign Address The IP address and port number of the remote computer to which the socket is connected The names that corresponds to the IP address and the port are shown unless the n parameter is specified If the port is not yet established the port number is shown as an asterisk State Indicates the state of a TCP connection The possible states are as follows CLOSE WAIT CLOSED ESTABLISHED FIN WAIT 1 FIN WAIT 2 LAST ACK LISTEN SYN RECEIVED SYN SEND and TIME WAIT For more information about the states of a TCP connection see RFC 793 Parameters EditParameters used with this command must be prefixed with a hyphen rather than a slash Some parameters are not supported on all platforms Name Description Windows ReactOS macOS BSD NetBSD FreeBSD Linux Solaris OS 2 a Displays all active connections and the TCP and UDP ports on which the computer is listening Yes Yes Yes b Displays the binary executable program s name involved in creating each connection or listening port Windows XP Windows Server 2003 and newer Windows operating systems not Microsoft Windows 2000 or older Yes No No b Causes i to report the total number of bytes of traffic No Yes Yes No e Displays ethernet statistics such as the number of bytes and packets sent and received This parameter can be combined with s Yes Yes No f Displays fully qualified domain names lt FQDN gt for foreign addresses only available on Windows Vista and newer operating systems Yes No No f Address Family Limits display to a particular socket address family unix inet inet6 No Yes No g Displays multicast group membership information for both IPv4 and IPv6 may only be available on newer operating systems No No Yes i Displays network interfaces and their statistics No No Yes m Displays the memory statistics for the networking code STREAMS statistics on Solaris No No n Displays active TCP connections however addresses and port numbers are expressed numerically and no attempt is made to determine names Yes Yes Yes o Displays active TCP connections and includes the process id PID for each connection You can find the application based on the PID in the Processes tab in Windows Task Manager This parameter can be combined with a n and p This parameter is available on Microsoft Windows XP Windows Server 2003 and Windows 2000 if a hotfix is applied 6 Yes No No p protocol Shows connections for the protocol specified by protocol In this case protocol can be tcp udp tcpv6 or udpv6 If this parameter is used with s to display statistics by protocol protocol can be tcp udp icmp ip tcpv6 udpv6 icmpv6 or ipv6 Yes Yes Yes p Show which processes are using which sockets similar to b under Windows you must be root to do this No No Yes P protocol Shows connections for the protocol specified by protocol In this case protocol can be ip ipv6 icmp icmpv6 igmp udp tcp or rawip No No Yes r Displays the contents of the IP routing table This is equivalent to the route print command under Windows Yes Yes Yes Yes s Displays statistics by protocol By default statistics are shown for the TCP UDP ICMP and IP protocols If the IPv6 protocol for Windows XP is installed statistics are shown for the TCP over IPv6 UDP over IPv6 ICMPv6 and IPv6 protocols The p parameter can be used to specify a set of protocols Yes Yes Yes t Display only TCP connections No Yes Yes u Display only UDP connections No No Yes Yes W Display wide output doesn t truncate hostnames or IPv6 addresses No No Yes No x Displays NetworkDirect connections listeners and shared endpoints Yes y Displays the TCP connection template for all connections Cannot be combined with the other options Yes v When used in conjunction with b it will display the sequence of components involved in creating the connection or listening port for all executables Yes No NoInterval Redisplays the selected information every Interval seconds Press CTRL C to stop the redisplay If this parameter is omitted netstat prints the selected information only once Yes Yes No h Displays help at the command prompt Yes No Yes Yes Yes Yes Yes Yes No Displays help at the command prompt Yes No No No No No No No Yes Displays help at the command prompt Yes Yes No No No No No No NoExamples EditCross platform Edit On macOS BSD systems Linux distributions and Microsoft Windows To display the statistics for only the TCP or UDP protocols type one of the following commands netstat sp tcp netstat sp udp Unix like Edit On Unix like systems To display all ports open by a process with id pid netstat aop grep pid To continuously display open TCP and UDP connections numerically and also which program is using them on Linux netstat nutpacw Windows Edit On Microsoft Windows To display active TCP connections and the process IDs every 5 seconds type the following command works on NT based systems only or Windows 2000 with hotfix netstat o 5 To display active TCP connections and the process IDs using numerical form type the following command works on NT based systems only or Windows 2000 with hotfix netstat no nix Edit Command Explanationnetstat a Shows all sockets both listening and non listening all protocols like TCP UDP etc netstat at Shows only TCP connections au shows only UDP connections netstat ant Shows all TCP connections with no DNS resolution show IP addresses instead netstat al Shows only listening sockets netstat aep Also show PID and to which program each socket belongs e adds extra info like the user Run as root to see all PIDs netstat s gt file2 txt Shows network statistics netstat r Shows kernel routing information This is the same output as route e netstat i Displays a table of all network interfaces Add e to get output similar to ifconfig netstat ct Displays TCP connections continuously netstat g Display multicast group membership information for IPv4 and IPv6 netstat lntu Display all services listening for TCP and UDP all free open ports on the local machine netstat atnp grep ESTA Displays all currently established TCP connections Wildcards Edit Netstat uses an asterisk as a wildcard which means any An example would beExample output Local Address Foreign Address State smtp LISTEN Under Local Address in smtp means the process is listening on all of the network interfaces the machine has for the port mapped as smtp see etc services for service resolution This can also be shown as 0 0 0 0 The first in means connections can come from any IP address and the second in means the connection can originate from any port on the remote machine Caveats EditSome versions of netstat lack explicit field delimiters in their printf generated output leading to numeric fields running together and thus corrupting the output data Platform specific remarks Edit The macOS netstat command Under Linux raw data can often be obtained from the proc net dev to work around the printf output corruption arising in netstat s network interface statistics summary netstat i until such time as the problem is corrected citation needed On the Windows platform netstat information can be retrieved by calling the GetTcpTable and GetUdpTable functions in the IP Helper API or IPHLPAPI DLL Information returned includes local and remote IP addresses local and remote ports and for GetTcpTable TCP status codes In addition to the command line netstat exe tool that ships with Windows GUI based netstat programs are available On the Windows platform this command is available only if the Internet Protocol TCP IP protocol is installed as a component in the properties of a network adapter in Network Connections On the Windows platform running Remote Desktop Services formerly Terminal Services it will only show connections for the current user not for the whole computer On macOS the System Library CoreServices Applications folder or Applications Utilities in OS X Mountain Lion and earlier contains a network GUI utility called Network Utility the Netstat tab of which runs the netstat command and displays its output in the tab See also Editss a Linux utility to investigate sockets from iproute2 meant to replace netstat lsof i bmonReferences Edit IBM Systems Information Center ibm com 8 May 2007 net tools linuxfoundation org Arch Linux archlinux org 8 June 2011 Deprecated Linux networking commands and their replacements Doug Vitale Tech Blog 21 December 2011 netstat man page notes section Retrieved 2 August 2014 This program is obsolete Replacement for netstat is ss Replacement for netstat r is ip route Replacement for netstat i is ip s link Replacement for netstat g is ip maddr The netstat command can now display process IDs that correspond to active TCP or UDP connections in Windows 2000 Archived from the original on 24 August 2007 Further reading EditDyson Peter 1995 Mastering OS 2 Warp Sybex ISBN 978 0782116632 Stanek William R 2008 Windows Command Line Administrator s Pocket Consultant 2nd Edition Microsoft Press ISBN 978 0735622623 External links Edit Wikibooks has a book on the topic of Guide to Windows Commands netstat 8 Linux Programmer s Manual Administration and Privileged Commands netstat 1 FreeBSD General Commands Manual netstat 1M Solaris 10 System Administration Commands Reference Manual netstat 1 Inferno General commands Manual Microsoft TechNet Netstat documentation for the Windows netstat exe command line program net tools project page on SourceForge Netstat Command WindowsCMD com Archived 2022 01 11 at the Wayback Machine Retrieved from https en wikipedia org w index php title Netstat amp oldid 1121230265, wikipedia, wiki, book, books, library,
