Mastering netstat: Essential Commands to Inspect Linux Network Connections

Introduction

The netstat command is a powerful tool for inspecting network connections, routing tables, and interface statistics on Linux systems. It is frequently used by backend developers, system administrators, and during technical interviews.

Print all connections

Use the -a flag to display every socket, including listening and established connections.

[root@VM-16-9-centos ~]# netstat -a

Print TCP or UDP connections

Use -t for TCP only and -u for UDP only.

[root@VM-16-9-centos ~]# netstat -t

[root@VM-16-9-centos ~]# netstat -u

Disable reverse DNS lookup

The -n option prevents hostname resolution, speeding up output.

[root@VM-16-9-centos ~]# netstat -n

Show program PID and name

Adding -p lists the owning process ID and program name for each socket.

[root@VM-16-9-centos ~]# netstat -p

Print listening sockets

Use -l to show only sockets that are in a listening state.

[root@VM-16-9-centos ~]# netstat -l

Continuous output

The -c flag refreshes the display continuously.

[root@VM-16-9-centos ~]# netstat -c

Find port by PID

Combine netstat -nap with grep to locate the port used by a specific process ID.

[root@VM-16-9-centos test]# netstat -nap | grep 12178

Find process by port

Similarly, filter by port number to retrieve the owning PID.

[root@VM-16-9-centos test]# netstat -nap | grep 8888

Count socket states with awk

Use awk to tally the number of sockets in each state.

netstat -n | awk '/^tcp/ {++S[$NF]} END {for(a in S) print a, S[a]}'

Network statistics

The -s option provides a summary of protocol statistics such as total packets, ICMP messages, and error counts.

[root@VM-16-9-centos ~]# netstat -s

Interface table

Use -i to display the kernel interface table with packet counters. [root@VM-16-9-centos ~]# netstat -i These examples form a concise reference for using netstat to diagnose and monitor Linux network activity.