Linux · sockets & transfer

netstat

the classic socket listing

netstat lists network connections and listening ports. Like ifconfig it belongs to net-tools and has been replaced — by ss — but "netstat -tulpn" is in so many guides that it is worth knowing, and it exists on Windows and macOS as well.

netstat -tulpn and ss -tulpn answer the same question: what is listening?

Listening ports

netstat -tulpn

TCP and UDP, with process

Replaced by

same switches, faster

Routing table

netstat -rn

now "ip route"

Package

net-tools

not installed by default

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

root@netflow — bashnet-tools

# netstat -tulpn

1Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name

2tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 812/sshd

3tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 1004/mysqld

tcp6 0 0 :::80 :::* LISTEN 2231/nginx

4udp 0 0 127.0.0.53:53 0.0.0.0:* 640/systemd-resolve

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

The switches spell the question

t TCP, u UDP, l listening, p the owning process, n numbers instead of names.

Listening on every address

0.0.0.0:22 means SSH accepts connections on all interfaces — reachable from the network.

Listening on localhost only

127.0.0.1:3306 means MySQL accepts connections only from this machine. Nothing outside can reach it.

UDP has no state

UDP is connectionless, so the State column is empty. This is the local DNS stub.

Switches

A switch changes how the command behaves. These are the ones used day to day; man netstat lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-t: TCP sockets.
-u: UDP sockets.
-l: Listening sockets only.
-p: Show the owning process.
-n: Numeric: no name lookups.
-r: Show the routing table.
-i: Show interface statistics.
-a: All sockets, listening and connected.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

ss -tulpn

The modern equivalent, with the same switches.

netstat -rn

Shows the routing table numerically.

netstat -i

Shows per-interface packet and error counters.

netstat -an | grep ESTABLISHED

Lists the connections currently open.

In cybersecurity

Every listening port is a service an attacker can try.

Know your listeners

Each line should be something you can name and justify. An unknown process listening on a high port is a classic sign of a backdoor.

0.0.0.0 versus 127.0.0.1

A database or admin panel bound to 0.0.0.0 is exposed to the network. Bind it to localhost unless other machines truly need it.

Run it as root

Without root the process column is blank for other users’ sockets, and the most interesting information is missing.

Protocols it shows

TCP UDP IPv4 IPv6

Read alongside

ssLists the sockets on a host — what is listening on which port, which connections are open, and which process owns each.ip routePrints the kernel routing table and answers which interface and next hop a given destination will use.