Understanding the netstat Command and Its Common Options

The author encountered a question about the netstat -tnpl command and decided to explore what netstat does, noting that it is a command‑line tool used to monitor incoming and outgoing network connections and their status.

netstat is available on Linux, Windows, and macOS; on Unix‑like systems you can view detailed help with man netstat , while on Linux and Windows you can use netstat --help .

Running man netstat on Linux reveals a large amount of documentation. The basic definition is that netstat -- show network status , i.e., it lists the current network status.

The default output is a six‑tuple table showing active Internet connections and active UNIX domain sockets. Columns include protocol, local address, foreign address, state, and the Recv‑Q/Send‑Q queues, which are usually zero unless data is pending.

Key sections of the output are:

Active Internet connections (TCP connections), where Recv‑Q and Send‑Q indicate pending data.

Active UNIX domain sockets , used for local inter‑process communication and generally faster than network sockets.

The article then details the most common netstat options:

General options

-a : Show all sockets (listening and non‑listening).

-t / -at : Show TCP sockets; -at shows all states, -t shows only ESTABLISHED.

-u / -au : Show UDP sockets; similar state filtering as TCP.

-p : Show the PID and program name owning each socket (requires appropriate permissions).

-l : Show only listening sockets (often described as “listening”).

-c : Continuously display the information every second.

-s , -st , -su : Show statistics for all protocols, TCP only, or UDP only.

-r : Display the kernel routing table.

--verbose : List supported address families (AF_INET, AF_INET6, AF_UNIX, etc.).

-i , -ie : Show network interface packet statistics, similar to ifconfig .

Examples of combined usage include:

netstat -ap|grep 'program_name'

to find which process is using a specific port, and

netstat -ap|grep 8080

to filter by port number.

Specific question

The original query about netstat -tnpl is answered by breaking down the flags:

-t : Show only TCP connections.

-n : Display addresses and ports numerically.

-p : Show the PID/program name.

-l : Show only listening sockets.

Running the command displays the listening TCP sockets with numeric addresses and the owning process IDs.

Finally, the article notes that modern Linux distributions recommend using ss instead of netstat, and the ip suite ( ip route , ip -s link , ip addr ) to replace many netstat functionalities.