Netstat
| Company type | Command-line utility |
|---|---|
| Industry | Computer networking software |
| Products | Network socket and routing analysis |
netstat is a command-line tool used for network analysis that reveals active network sockets, routing information, and diverse statistics related to network interfaces and protocols. This utility is present on Unix, Plan 9, Inferno, and Unix-like platforms such as macOS, Linux, Solaris, BSD variants, as well as IBM OS/2 and Windows NT-based operating systems including Windows XP through Windows 10.
Although largely outdated on Linux where it has been replaced by the ss command (part of iproute2), netstat continues to be included in many Linux distributions. It is mainly employed for troubleshooting network problems and evaluating traffic performance. Modern alternatives to netstat's common features include ip route for viewing routing tables, ip -s link for interface statistics, and ip maddr for multicast address information—these are preferred tools in contemporary network administration.
Statistics provided
Netstat delivers data on:
- Proto – The protocol designation (for example, TCP or UDP), sometimes followed by "4" or "6" indicating IPv4 or IPv6.
- Local Address – The IP address and port number of the local machine. Hostnames and port names appear unless the option is used. An asterisk (*) signifies listening on all interfaces or an unconnected port.
- Foreign Address – The remote machine’s IP address and port number, with names shown unless suppressed by . An asterisk (*) indicates an unestablished port.
- State – The status of a TCP connection, such as , , or , according to .
Parameters
Options require a hyphen prefix () instead of a slash; availability differs depending on the operating system.
| Name | Description | Windows | ReactOS | macOS | BSD | NetBSD | FreeBSD | Linux | Solaris | OS/2 |
|---|---|---|---|---|---|---|---|---|---|---|
| -a | Lists all active connections along with listening TCP/UDP ports. | Yes | Yes | Yes | Yes | Yes | Yes | |||
| -b | Displays the binary executable name associated with each connection or listening port (available from Windows XP onward; not supported on Windows 2000). | Yes | No | No | ||||||
| -b | Reports total bytes of data transferred when used with -i. | No | Yes | Yes |
No | |||||
| -e | Shows ethernet statistics including bytes and packets sent/received; can be combined with -s. | Yes | Yes |
No | ||||||
| -f | Resolves fully qualified domain names for foreign addresses (available in Windows Vista and later). | Yes | No |
No | ||||||
| -f Address Family | Restricts output to specific socket address families: unix, inet, or inet6. | No |
Yes |
No | ||||||
| -g | Displays multicast group membership details for IPv4 and IPv6 on newer systems. | No | No |
Yes |
||||||
| -i | Lists network interfaces along with their statistics. | No | No | Yes | Yes | Yes | Yes | Yes | ||
| -m | Provides network memory statistics (STREAMS-related on Solaris). | No | No | Yes | Yes | Yes | Yes |
Yes |
||
| -n | Shows active TCP connections using numeric addresses and ports exclusively. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | |
| -o | Displays active TCP connections including process IDs (PIDs); supported on Windows XP, Server 2003, and patched Windows 2000 versions. | Yes | No |
No | ||||||
| -p protocol | Filters displayed connections by protocol (tcp, udp, tcpv6, udpv6). When combined with -s, protocols such as tcp, udp, icmp, ip, tcpv6, udpv6, icmpv6, or ipv6 can be specified. | Yes | Yes | Yes | Yes | Yes | Yes | |||
| -p | Shows processes utilizing sockets (similar to -b on Windows; requires root privileges). | No | No | Yes | ||||||
| -P protocol | Displays connections for specified protocols including ip, ipv6, icmp, icmpv6, igmp, udp, tcp, rawip. | No | No | Yes | ||||||
| -r | Outputs the IP routing table (comparable to 'route print' on Windows). | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| -s | Presents statistics categorized by protocol; defaults cover TCP, UDP, ICMP, and IP. IPv6 protocols are supported if installed. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | |
| -t | Restricts output to TCP connections only. | No | Yes | |||||||
| -u | Limits display to UDP connections exclusively. | No | Yes | |||||||
| -W | Produces wide-format output without truncating hostnames or IPv6 addresses. | No | Yes |
No | ||||||
| -x | Reveals NetworkDirect connections along with listeners and shared endpoints. | Yes
| ||||||||
| -y | Displays the TCP connection template for all current connections; this option is unique. | Yes
| ||||||||
| -v | When used with -b, provides detailed component sequences responsible for establishing the connection or listening port. | Yes | No |
No | ||||||
| Interval | Repeats selected output every specified Interval seconds; press CTRL+C to terminate. If omitted, displays information once. | Yes | Yes |
No | ||||||
| -h | Shows help information at the command prompt. | Yes | No | Yes | Yes | Yes | Yes | Yes | Yes | No |
scope="row" – -?
– {{{1}}}/? – Displays help at the command line on various systems; fully supported on Windows with limited support elsewhere.
|
Cross-platform
For macOS, BSD, Linux, and Windows environments:
To retrieve statistics specifically for TCP or UDP protocols, execute:
netstat -sp tcp
netstat -sp udp
Unix-like systems
Within Unix-like operating systems:
To enumerate all ports opened by a process identified by pid:
netstat -aop | grep "pid"
To monitor numeric TCP and UDP connections along with associated programs on Linux in real-time:
netstat -nutpacw
Windows
On Microsoft Windows platforms:
To display active TCP connections including process identifiers every 5 seconds (applicable to NT-based versions or Windows 2000 with hotfix):
netstat -o 5
To list active TCP connections and their process IDs using numeric format:
netstat -no
*nix
| Command | Description |
|---|---|
netstat -a |
Displays all sockets, both listening and non-listening, across all protocols such as TCP and UDP. |
netstat -at |
Lists only TCP connections (-au option for UDP). |
netstat -ant |
Shows all TCP connections with IP addresses, disabling DNS name resolution. |
netstat -al |
Presents only sockets in a listening state. |
netstat -aep |
Reveals process IDs and corresponding programs; requires root privileges to view all PIDs. |
netstat -s |
Outputs detailed network statistics. |
netstat -r |
Displays kernel routing tables (equivalent to route -e). |
netstat -i |
Lists network interfaces; adding -e provides extended information. |
netstat -ct |
Continuously updates the display of TCP connections. |
netstat -g |
Shows multicast group memberships for IPv4 and IPv6. |
netstat -lntu |
Lists all listening TCP and UDP ports (services currently open). |
| <code>netstat -atnp | grep ESTA</code> | Filters to show all TCP connections currently in the "established" state. |
Wildcards
In netstat, an asterisk (*) functions as a wildcard representing "any." For instance:
Sample output: <syntaxhighlight lang="output"> ....Local Address Foreign Address State ... *:smtp *:* LISTEN </syntaxhighlight>
In the example *:smtp, the asterisk indicates the service listens on all network interfaces for the SMTP port. In *:*, the first asterisk denotes connections originating from any IP address, while the second signifies any remote port.
Caveats
Certain netstat versions do not include explicit delimiters between fields in their printf-generated output, which can cause numeric values to merge improperly and result in corrupted data.
Platform-specific remarks
On Linux, raw interface data can be accessed directly from /proc/net/dev to avoid corruption issues present in netstat’s network interface statistics summary (netstat -i) until such bugs are addressed.
Within Microsoft Windows, netstat obtains its information through the GetTcpTable and GetUdpTable functions provided by the IP Helper API (IPHLPAPI.DLL), supplying local and remote IP addresses, ports, and TCP connection states. Aside from the native command-line tool netstat.exe, graphical netstat applications are also available.
This utility requires that the Internet Protocol (TCP/IP) component is installed as part of the network adapter configuration in Windows Network Connections.
On Windows machines running Remote Desktop Services, netstat reports connections only for the active user session rather than across all users on the system.
For macOS, the Network Utility application (located at /System/Library/CoreServices/Applications or /Applications/Utilities on earlier releases) includes a Netstat tab that executes the netstat command and presents its results visually.
See also
Further reading
- Peter Dyson, Mastering OS/2 Warp, Sybex, 1995
- William R. Stanek, Windows Command-Line Administrator's Pocket Consultant, 2nd Edition, Microsoft Press, 2008
External links
- Microsoft TechNet: Netstat – Documentation for netstat.exe on Windows
- net-tools project hosted on SourceForge
- Netstat Command: WindowsCMD.com