Cheatsheet Netstat
Ferramenta para análise de rede
Netstat
33
cards found
Categories:
Versions:
Basic Commands
Basic syntax
netstat # active connections
netstat -a # all (incl. listening)
netstat -n # numeric addresses
netstat -an # common combination
netstat --help # help
Fundamental usage.
Main options
-a # all connections
-n # numeric format
-t # TCP only
-u # UDP only
-l # listening only (Linux)
-p # show process
-s # statistics
Most used flags.
TCP states
LISTENING # waiting for connections
ESTABLISHED # active connection
TIME_WAIT # closing
CLOSE_WAIT # remote closed
SYN_SENT # starting
FIN_WAIT # terminating
Connection states.
Output explained
Proto Recv-Q Send-Q
Local Address Foreign Address
State PID/Program
# Local = local port
# Foreign = remote destination
Interpret the columns.
Connections and Ports
Listening ports
# Linux
netstat -tlnp # TCP listening
netstat -ulnp # UDP listening
# Windows
netstat -an | findstr LISTENING
View open ports.
Numeric addresses
# Without resolving names (faster)
netstat -n
netstat -an
# Avoids slow reverse DNS
# Shows IP:port instead of host:service
Numeric output.
TCP only / UDP only
netstat -t # TCP connections
netstat -u # UDP connections
netstat -at # all TCP
netstat -au # all UDP
Filter by protocol.
Specific port
# Linux
netstat -an | grep :80
netstat -an | grep :3306
# Windows
netstat -year | findstr :8080
Search for a port.
Established connections
# Linux
netstat -an | grep ESTABLISHED
# Windows
netstat -an | findstr ESTABLISHED
# Count by state
netstat -an | awk '/^tcp/{print $6}' | sort | uniq -c
Active connections.
Statistics
General statistics
netstat -s # all protocols
netstat -st # TCP only
netstat -su # UDP only
netstat -s | grep -i error # errors
Network counters.
By protocol
# TCP summary
netstat -st | head -20
# UDP packets
netstat -su
# ICMP statistics
netstat -s | grep -A5 Icmp
Details by protocol.
Network interfaces
netstat -i # interface table
netstat -ie # detailed format
# Columns: MTU, RX-OK, RX-ERR,
# TX-OK, TX-ERR
Interface statistics.
Multicast groups
netstat -g # multicast memberships
# Linux: shows interfaces and
# IPv4/IPv6 multicast groups
Multicast traffic.
Route Table
Routing table
netstat -r # routing table
netstat -rn # numeric (no DNS)
# Equivalent to: route -n (Linux)
# Shows destination, gateway, mask
View network routes.
Interpret routes
Destination Gateway Genmask
0.0.0.0 192.168.1.1 0.0.0.0
# 0.0.0.0 = default route
# Gateway = next hop
# Flags: U (up), G (gateway)
Table fields.
Route to a host
# Linux: use ip route
ip route get 8.8.8.8
# Windows
route print
tracert 8.8.8.8
Find the path.
Processes and PIDs
Show processes (Linux)
# Requires root/sudo
sudo netstat -tlnp
sudo netstat -anp
# Shows PID/ProgramName
# in the last column
Map ports to processes.
Show PID (Windows)
netstat -year
# -a all, -n numeric, -o PID
# Last column = process PID
PID per connection.
From PID to program
# Windows: find the program
tasklist | findstr 1234
# Linux
ps -p 1234
sudo lsof -i -P | grep 1234
Identify the process.
Who uses a port
# Linux (lsof)
sudo lsof -i :80
sudo lsof -i :3306
# Linux (fuser)
sudo fuser 8080/tcp
# Windows
netstat -year | findstr :8080
Find the port owner.
Netstat no Linux
Useful combinations
netstat -tulpn # listening ports
netstat -anp # everything with process
netstat -s # statistics
netstat -rn # numeric routes
netstat -i # interfaces
Combinations on Linux.
Alternative: ss
# ss is faster (replacement)
ss -tulpn # = netstat -tulpn
ss -an # all connections
ss -s # summary
ss -tan state established
Modern ss command.
Continuous monitoring
# Refresh every 2s
watch -n 2 netstat -an
# Changes only
netstat -c # continuous output
# Count by state
watch "netstat -an | grep -c ESTABLISHED"
Watch in real time.
Installation
# net-tools (netstat package)
sudo apt install net-tools # Debian
sudo yum install net-tools # RHEL
# On modern distros, ss is the default
Install netstat.
Netstat no Windows
Common commands
netstat -an # all numeric
netstat -year # with PID
netstat -ab # with program (admin)
netstat -r # routing table
netstat -s # statistics
Usage on Windows.
Find the program
# 1. Find the port PID
netstat -year | findstr :8080
# 2. View program by PID
tasklist /FI "PID eq 1234"
# Or directly (admin):
netstat -ab | findstr 8080
Port → program.
Refresh interval
# Repeat every 5 seconds
netstat -an 5
# Stop with Ctrl+C
# Combine with a counter
netstat -e 5 # interface statistics
Monitoring on Windows.
Interface statistics
netstat -e # bytes sent/received
netstat -e 5 # every 5s
# Shows: Bytes, Unicast, Non-unicast,
# Discards, Errors, Unknown
Network card traffic.
Diagnosis and Tricks
Filter with grep/findstr
# Linux
netstat -an | grep :443
netstat -an | grep -v TIME_WAIT
# Windows
netstat -year | findstr :443
netstat -year | findstr ESTABLISHED
Filter the results.
Best practices
• Use -n to avoid DNS slowness
• sudo/root to see processes (-p)
• Prefer ss on modern Linux
• netstat -year on Windows for PID
• Combine with lsof/tasklist
• Monitor with watch for diagnostics
Usage conventions.
Count states
# Linux: count by state
netstat -an | awk '/^tcp/{print $6}'
| sort | uniq -c
# Total connections
netstat -an | grep -c ESTABLISHED
State analysis.
Detect suspicious ports
# Unexpected listening ports
sudo netstat -tulpn
# Connections to external IPs
netstat -an | grep ESTABLISHED
# Cross-check with firewall and processes
Security audit.
netstat vs ss vs ip
netstat # classic (net-tools)
ss # modern, faster
ip # addresses and routes
# Trend: ss + ip replace
# netstat + ifconfig + route
Current tools.