Knowledge, Server

What is netstat: Basic usage of the netstat command

25
Dec

The netstat command (short for Network Statistics) is one of the most essential tools for system administrators, network developers, or users who need to monitor the connection status of a system. This tool can be used to check which destinations are connected, which ports are being used, where connections are waiting to be established, or which systems are currently exchanging data with each other.

What is netstat?

netstat is a command line tool used to monitor and analyze the status of network connections related to a computer or server. It allows viewing the status of open TCP and UDP ports, displaying active connections, and providing network statistics such as the number of packets sent or received, routing table interface information, and more.

This tool is available on multiple operating systems, such as Windows, Linux, and macOS, with usage features or switches that may vary depending on the system.

Basic Usage of netstat

The most basic command is to call netstat without any additional parameters, which will display the results showing the currently established TCP connections, for example:

netstat

The results will appear approximately as follows:

Proto Local Address Foreign Address State
TCP 127.0.0.1:5000 127.0.0.1:6000 ESTABLISHED

Description of each column:

  • Proto: Types of Protocols (TCP/UDP)
  • Local Address: IP and port of the local machine
  • Foreign Address: IP and port of the destination
  • State: The status of the connection, such as ESTABLISHED, LISTENING, TIME_WAIT, and so on.

3. Popular options of netstat

-a (all)

Show all connections, both active and waiting (listening).

netstat -a

-n (numeric)

Display the IP number instead of the host name for speed.

netstat -an

-o (Windows only)

Display the process ID (PID) associated with the connection.

netstat -ano

-p (Linux/macOS)

Display the name of the process or program that is open on that port.

netstat -ap

-r

Display routing table

netstat -r

-s (for plural nouns)

Display statistics on protocol usage, such as TCP, UDP, and ICMP.

netstat -s

4. Examples of Real-World Applications

Check which port the machine is listening on.

Windows:

netstat -an | find "LISTEN"

Linux:

netstat -tuln

Switch Description:

  • -t = TCP
  • -u = UDP
  • -l = listening
  • -n = Display IP in numerical format

View all connections with PID

Windows:

netstat -ano

Then use this command to find the name of the relevant process:

tasklist | findstr [PID]

Linux:

netstat -tunap

Check which IP addresses are connected.

netstat -an | find "ESTABLISHED"

It can be analyzed which external servers the device is currently connecting to.

5. Explanation of TCP Status

Commonly Encountered Status:

  • LISTENING – The program is waiting for a connection.
  • ESTABLISHED – The connection has been established and is active.
  • TIME_WAIT – The connection has been closed but is still waiting to ensure that the final packet has been sent.
  • CLOSE_WAIT – The other side has closed the connection, but our program has not yet closed it.
  • SYN_SENT – The connection request has been sent and is waiting for a response.
  • SYN_RECEIVED – Connection received and awaiting acknowledgment

6. Comparison with New Tools

In current Linux systems, netstat is often replaced by the ss command, which processes data more quickly.

View all open TCP/UDP ports:

ss -tuln

View processes that are listening on ports:

ss -tulnp

Additionally, there is the lsof command that can be used in conjunction with other commands, such as:

lsof -i :80

Will help identify which process is currently open port 80.

7. Using netstat with other commands

In Linux/macOS, you can use grep to filter data:

netstat -an | grep 443

In Windows, use findstr:

netstat -an | findstr 443

8. Safety Analysis

You can use netstat to analyze unusual behaviors such as:

  • Devices connecting to multiple IP addresses for unknown reasons may be part of a botnet or malware.
  • Ports that should not be opened (such as unnecessary remote desktop ports)

These inspections can help reduce the risk from cyber threats.

9. Usage in PowerShell

netstat can be used in PowerShell just like in Command Prompt, and it can also be used with pipelines, for example:

netstat -an | Where-Object { $_ -match "443" }

10. Write a script to check the port.

In Linux/Bash, you can write scripts to automatically check ports, for example:

PORT=22
netstat -tuln | grep ":$PORT " > /dev/null
if [ $? -eq 0 ]; then
echo "Port $PORT is open."
else
echo "Port $PORT is closed."
fi

11. Limitations of netstat

Although netstat is very useful, it has limitations, such as:

  • Unable to display in real-time
  • Lacks in-depth analysis features compared to newer tools.
  • netstat may not be installed on newer versions of Linux; the net-tools package must be installed additionally.

12. Summary

netstat is a fundamental tool that system administrators should be familiar with. It is used for:

  • Check the network connection.
  • Analyze open portfolios.
  • Monitor active connections.
  • Check for abnormal connections.
  • Use with other tools for accurate analysis.

Although there are more advanced tools available, netstat still plays a crucial role in basic network administration and serves as an excellent starting point for anyone interested in networking at any level.