Understanding and troubleshooting with the netstat command

The netstat command is a highly practical tool for network diagnostics, configurations, and other port-scanning activities. More specifically, system administrators use it for network troubleshooting and performance diagnostics.

The netstat command works on Microsoft Windows, Linux, Unix, FreeBSD, and more. Therefore, all the commands in this article will produce the same results irrespective of your operating system, unless otherwise stated for Linux.

The Linux operating system comes with a considerable number of built-in capabilities pre-installed. Depending on their level of expertise, users may not be fully aware of the capabilities of a particular command. This article provides the basics of netstat and how to troubleshoot network issues with it.

Functions

We will learn how the netstat command functions by seeing its commonly used applications. We will see how to generate routing information, network interface statistics, or run port-scanning operations with the command. It might be a good idea to take notes on the most frequently recurring options and what they do, because they will come in handy while working with other commands.

Displaying kernel routing table

Using the netstat command with the -r option lists the kernel routing information in the same way as with the route command.

$ netstat -rn 
Kernel IP routing table 
Destination     Gateway         Genmask         Flags   MSS
Window  irtt Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG        0 0
0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0
0 eth0

Displaying configured network interface statistics

The -i option configures the netstat command to display network interface statistics. By including the -a option, we’ll include all interfaces present on the kernel in the output, not just those currently configured.

$ netstat -i
Kernel Interface table
Iface       MTU Met   RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0       1500 0     31611      0      0 0         27503      0      0      0 BMRU
lo        65536 0      2913      0      0 0          2913      0      0      0 LRU

Simply put, the MTU field displays the current MTU, while the Met field displays the metric values of the interface. The other fields display additional information:

• The -OK suffixed fields indicate successfully received (RX) or transferred (TX) packets.
• The -ERR suffixed fields indicate connections with errors.
• The -DRP suffixed fields indicate the amount of packets dropped.
• The -OVR suffixed fields indicate the amount of packets lost due to overrun.

The netstat command supports the use of some options in listing active and passive sockets. These options include:

• -t for active TCP socket connections
• -u for active UDP socket connections
• -w for active RAW socket connections
• -x for active Unix socket connections

Adding the -a option will display sockets that are listening for connection. This output will be a list of all servers currently running on the Linux machine.

TCP/IP and port-scanning operations with netstat

Port scanning is the process of locating listening ports in a system.

A listening port is a free port that listens for incoming traffic from applications and processes. You can use a firewall to manage listening ports by opening or closing them. The open ports accept incoming packets from remote locations, while the closed ports are occupied by an application or a process.

Some common ports that are open by default:

Listening operations should be implemented on a frequent basis, as any port opened to outside connections is a possible point of entry into your system. If there’s anything unwanted listening for connections, make sure to remove the package by following the steps below:

• Navigate to System Security | Firewalls in your system’s control panel.
• Select New Rule.
• For an inbound port, select Inbound Rules; for an outbound port, select Outbound Rules, then click Next.
• Specify the protocol used by the port (TCP or UDP).
• Click Specific Local Ports and enter the port number.
• Click Next, followed by Block the Connection, and Next again.
• Choose the applicable network location(s), click Next, then Finish.

A service can always be disabled, but it’s best to remove the underlying package so that it cannot be started by accident. Packages can always be reinstalled later.

Quick check

Let’s examine, for example, how to use the netstat -untlp command to address any currently connected and listening ports.

This command displays anything listening for incoming traffic and the port it is listening on. Breaking this command down, the first parameter, -t, identifies your request for information pertaining to TCP. Next, -u represents UDP; -l requests listening sockets; -p attempts to show the name of the program; and -n shows numeric values. Putting it all together, you get netstat -tulpn:

$ sudo netstat -untlp

The first column displays active and established connections in the following headers:

How to list all ports

The -a command is used to list all ports. The output will be similar to this:

$ netstat -a
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 enlightened:domain      *:*                     LISTEN
tcp        0      0 localhost:ipp           *:*                     LISTEN
tcp        0      0 enlightened.local:54750 li240-5.members.li:http ESTABLISHED
tcp        0      0 enlightened.local:49980 del01s07-in-f14.1:https ESTABLISHED
tcp6       0      0 ip6-localhost:ipp       [::]:*                  LISTEN
udp        0      0 enlightened:domain      *:*
udp        0      0 *:bootpc                *:*
udp        0      0 enlightened.local:ntp   *:*
udp        0      0 localhost:ntp           *:*
udp        0      0 *:ntp                   *:*
udp        0      0 *:58570                 *:*
udp        0      0 *:mdns                  *:*
udp        0      0 *:49459                 *:*
udp6       0      0 fe80::216:36ff:fef8:ntp [::]:*
udp6       0      0 ip6-localhost:ntp       [::]:*
udp6       0      0 [::]:ntp                [::]:*
udp6       0      0 [::]:mdns               [::]:*
udp6       0      0 [::]:63811              [::]:*
udp6       0      0 [::]:54952              [::]:*
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags       Type       State         I-Node   Path
unix  2      [ ACC ]     STREAM     LISTENING     12403    @/tmp/dbus-IDgfj3UGXX
unix  2      [ ACC ]     STREAM     LISTENING     40202    @/dbus-vfs-daemon/socket-6nUC6CCx

Here the LISTEN state signifies that sshd is listening for incoming IP packets on all network interfaces and IPs on TCP port 22. The ESTABLISHED state shows an active SSH connection, listing the system's local address and port as well as the Recv-Q and Send-Q columns.

Listing all active listening ports

Use the netstat command and the -l option to listen only to active ports, with the following output:

$ netstat -l
Active Internet connections (only servers)
Proto  Recv-Q Send-Q   Local Address         Foreign Address
State
tcp         0      0

You can also list the ports that are being listened to. This works for root users on a Linux machine:

$sudo netstat -plnt

Listing specific ports

TCP and UDP ports perform different functions. TCP provides an orderly and error-checked stream of packets, while UDP provides a faster stream of packets at the expense of error checking. The netstat command supports options to list both ports separate from one another.

TCP ports

Adding the -at option to the netstat command will display all TCP ports. Note that excluding the -a option will display only active ports:

$ netstat -at
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address State
tcp        0      0 enlightened:domain      *:* LISTEN
tcp        0      0 localhost:ipp           *:*                     LISTEN
tcp        0      0 enlightened.local:36310 del01s07-in-f24.1:https ESTABLISHED
tcp        0      0 enlightened.local:45038 a96-17-181-10.depl:http ESTABLISHED
tcp        0      0 enlightened.local:37892 ABTS-North-Static-:http ESTABLISHED
.....

UDP ports

Likewise, the -au options added to the netstat command will list all UDP ports. Forgoing the -a option will display only active ports:

$ netstat -au
AActive Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
udp        0      0 *:34660                 *:*
udp        0      0 enlightened:domain      *:*
udp        0      0 *:bootpc                *:*
udp        0      0 enlightened.local:ntp   *:*
udp        0      0 localhost:ntp           *:*
udp        0      0 *:ntp                   *:*
udp6       0      0 fe80::216:36ff:fef8:ntp [::]:*
udp6       0      0 ip6-localhost:ntp       [::]:*
udp6       0      0 [::]:ntp                [::]:*

Troubleshooting with netstat

Troubleshooting with netstat involves identifying, diagnosing, and solving network problems by adding options to the command. In addition to the -untlp option above, you can use the grep option for troubleshooting issues.

Using netstat + grep

To see what process is occupying a specific port, you can use the grep option.

# netstat -an | grep ':80'

This is helpful, for example, when you’re trying to run a web server on a particular port and discover it’s already in use.

If you discover that an unknown service is connected to a port, take immediate action by copying and pasting the details into a search engine to identify the service.

Listing raw network statistics only

Network statistics are displayed using the -s option with the netstat command:

$ netstat -s
Ip:
 30525 total packets received
 0 forwarded
 0 incoming packets discarded
  20375 incoming packets delivered
 16250 requests sent out
 40 outgoing packets dropped
Icmp:
 325 ICMP messages received
 0 input ICMP message failed.
 ICMP input histogram:
 destination unreachable: 125
 325 ICMP messages sent
 0 ICMP messages failed
 ICMP output histogram:
 destination unreachable: 125
 ... OUTPUT TRUNCATED …

Advanced uses of the netstat command

We have seen how netstat can be used for troubleshooting and displaying statistics. The netstat command can also be applied in two advanced use cases.

Monitoring logins in an SSH Server

Let’s say you’re running a public server such as an SSH web server. The SSH server will open a port in the server system for users to access and log in.

The default port for sshd is TCP port 22. With the netstat command, you can monitor all open ports, using the options together with the command, as shown below:

$ sudo netstat -untap | sed '2p;/ssh/!d'
Proto Recv-Q Send-Q Local Address  Foreign Address  State   PID/Program name
tcp        0      0 0.0.0.0:22     0.0.0.0:*        LISTEN  1296/sshd: /usr/sbi
tcp6       0      0 :::22          :::*             LISTEN  1296/sshd: /usr/sbi

The IP address and port number are combined to tell your Linux machine where to send SSH packets.

Monitoring a web browsing session

The netstat command can also be used to monitor your internet browsing session:

$ netstat -punta
Proto  Local Address         Foreign Address    State        PID/Program name
[...]
tcp    192.168.43.234:50586  72.21.91.66:443    ESTABLISHED  2798/firefox
tcp    192.168.43.234:38262  52.36.174.147:443  ESTABLISHED  6481/chrome
tcp    192.168.43.234:53232  99.86.33.45:443    ESTABLISHED  2798/firefox
[...]

Your computer may secretly listen or connect to an unknown website. An excellent way to detect this is to monitor connections with the netstat command:

$ netstat -abf 5 > activity.txt

The -a option lists all connections and listening ports; -b displays all applications making the connections; while -f shows the complete DNS name of every listed connection, for ease of identifying the connection source. The > symbol pushes the results to an activity.txt file.

Conclusion

While the netstat command is a powerful system administrator tool, you don’t have to be a sysadmin to make use of it. As we have seen, netstat is useful in many scenarios, even if our goal is just securing day-to-day browsing activities.

But netstat should not be limited to the commands discussed here alone—options and flags can significantly expand the scope of what is possible with the netstat command.