netstat Command in Linux: Syntax, Options & Practical Examples (Ubuntu)

Oct 20, 2021 Jul 1, 2026 Rohan Timalsina Deepak Prasad

Tested on	Ubuntu 25.04 (Plucky Puffin)
Package	`net-tools 2.10` `net-tools 2.10`
Applies to	Ubuntu, Debian, RHEL, Rocky Linux, AlmaLinux, Oracle Linux, CentOS Stream, Fedora, Arch Linux, SUSE, openSUSE, Alpine
Privilege	sudo or root
Man page	netstat(8)
Scope	netstat from net-tools prints active sockets, routing tables, interface counters, and protocol statistics on Linux. It is a legacy but still common tool for checking listening ports and connection states on Debian and.
Related guides	Install netstat on Debian tcpdump Linux commands

netstat — quick reference

Socket display

Show TCP, UDP, and UNIX sockets — connected by default; add -a or -l for more.

When to use	Command
Show connected sockets (default)	`netstat`
Include listening and idle sockets	`netstat -a`
Show only listening server sockets	`netstat -l`
TCP sockets only	`netstat -t`
UDP sockets only	`netstat -u`
UNIX domain sockets only	`netstat -x`
Listening TCP ports (common admin check)	`netstat -tln`
Listening TCP and UDP with numeric ports	`netstat -tuln`

Naming and output width

Skip DNS and service lookups for script-friendly output.

When to use	Command
Numeric addresses and ports (no DNS lookup)	`netstat -n`
Numeric hosts only	`netstat --numeric-hosts`
Numeric ports only	`netstat --numeric-ports`
Do not truncate IP addresses	`netstat -W`
Verbose — extra protocol details	`netstat -v`

Process and extended socket info

Map sockets to programs and show extra columns.

When to use	Command
Show PID and program name (often needs root)	`netstat -p`
Listening TCP with process names	`sudo netstat -tlnp`
Extended info (user, inode on some sockets)	`netstat -e`
Show TCP timer information	`netstat -o`
Refresh output every second	`netstat -c`

Address family

Limit output to IPv4 or IPv6.

When to use	Command
IPv4 sockets only	`netstat -4`
IPv6 sockets only	`netstat -6`
IPv4 listening TCP with processes	`netstat -4tlnp`

Routing, interfaces, and statistics

Kernel routing table, NIC counters, and protocol summaries.

When to use	Command
Print kernel routing table	`netstat -r`
Print routing cache instead of FIB	`netstat -C`
Interface summary (RX/TX counters)	`netstat -i`
One interface only	`netstat -I=enp0s3`
Protocol statistics (TCP, UDP, ICMP, …)	`netstat -s`
Multicast group memberships	`netstat -g`

Help and version

When to use	Command
Show usage	`netstat --help`
Show net-tools version	`netstat --version`

netstat — command syntax

Synopsis from netstat --help on Ubuntu 25.04 (net-tools 2.10):

text
netstat [-vWeenNcCF] [<Af>] -r
netstat [-vWnNcaeol] [<Socket> ...]
netstat { [-vWeenNac] -i | [-cnNe] -M | -s [-6tuw] }

netstat reads /proc/net and related kernel interfaces. It does not change network configuration. Process names (-p) may require sudo to see every user's sockets.

netstat — command examples

Essential List listening TCP ports

The most common netstat check: which TCP ports on this host accept incoming connections.

Run the command:

bash

netstat -tln

Sample output:

output

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN
tcp6       0      0 :::22                   :::*                    LISTEN

LISTEN means a service is waiting for connections on that local address and port.

Essential Listening ports with process names (-tlnp)

When a port looks unexpected, add -p to see which program owns it. Root sees more processes than a normal user.

Run the command:

bash

sudo netstat -tlnp

Sample output:

output

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      338/systemd-resolve
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1/init
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      1436/cupsd
tcp6       0      0 :::22                   :::*                    LISTEN      1/init

Match the port in Local Address to the PID/Program name column, then inspect that process if you need to stop or reconfigure it.

Essential Listening TCP and UDP together (-tuln)

UDP has no connection state, but -l still shows UDP sockets bound for incoming datagrams.

Run the command:

bash

netstat -tuln

Sample output:

output

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN
tcp6       0      0 :::22                   :::*                    LISTEN
udp        0      0 127.0.0.53:53           0.0.0.0:*
udp        0      0 0.0.0.0:5353            0.0.0.0:*

UDP lines have no State column — only the bound local endpoint is shown.

Common Kernel routing table (-r)

See how this host forwards packets — default gateway and local subnets.

Run the command:

bash

netstat -rn

Sample output:

output

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         10.0.2.2        0.0.0.0         UG        0 0          0 enp0s3
10.0.2.0        0.0.0.0         255.255.255.0   U         0 0          0 enp0s3
192.168.0.0     0.0.0.0         255.255.255.0   U         0 0          0 enp0s8

UG in the Flags column marks the default route via a gateway.

Common Network interface counters (-i)

Quick RX/TX packet and error counts per NIC — useful when investigating link problems.

Run the command:

bash

netstat -i

Sample output:

output

Kernel Interface table
Iface             MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
enp0s3           1500     6384      0      0 0          4401      0      0      0 BMRU
enp0s8           1500       84      0      0 0           180      0      0      0 BMRU
lo              65536     9013      0      0 0          9013      0      0      0 LRU

Non-zero RX-ERR or TX-ERR may point to driver, cable, or duplex issues.

Common Protocol summary statistics (-s)

Summarize kernel network stack counters — ICMP, TCP segments, UDP datagrams, and more.

Run the command:

bash

netstat -s | head -25

Sample output:

output

Ip:
    Forwarding: 2
    14378 total packets received
    2 with invalid addresses
    0 forwarded
    14372 incoming packets delivered
    10080 requests sent out
Icmp:
    83 ICMP messages received
    0 input ICMP message failed
    ICMP input histogram:
        destination unreachable: 45
        echo requests: 18
        echo replies: 18
Tcp:
    312 active connections
    45 failed connection attempts

Pipe to grep or compare two snapshots when hunting for rising error counters.

Common Skip DNS lookups (-n)

On slow or broken DNS, -n prints IP addresses and port numbers immediately.

Run the command:

bash

netstat -tn | head -6

Sample output:

output

Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 192.168.0.4:22          192.168.0.1:59556       ESTABLISHED
tcp        0      0 127.0.0.1:33999         127.0.0.1:50490         ESTABLISHED

Combine -n with -p in scripts: netstat -tnp.

Advanced IPv6 listening sockets only (-6 -tln)

When debugging dual-stack services, filter to TCP IPv6 listeners.

Run the command:

bash

netstat -6tln

Sample output:

output

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp6       0      0 :::22                   :::*                    LISTEN
tcp6       0      0 ::1:631                 :::*                    LISTEN

:::22 means SSH listens on all IPv6 addresses on port 22.

Advanced Extended socket columns (-e)

-e adds User and Inode columns — helpful when matching sockets to /proc or correlating with lsof.

Run the command:

bash

netstat -te | head -6

Sample output:

output

Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode
tcp        0      0 server1:ssh             gateway:59556           ESTABLISHED root       29042
tcp        0      0 localhost:33999         localhost:50490         ESTABLISHED root       0

Not every socket exposes a useful inode value; listening sockets usually do.

netstat — when to use / when not

Use netstat when	Use something else when
You are on a host that still ships net-tools and you need a quick list of listening ports or routes Legacy runbooks or monitoring scripts already call netstat You want protocol-wide statistics with `-s` in one command Colleagues expect the classic Recv-Q / Send-Q / State table format	You want the fastest, most complete socket view on modern Linux → ss You need to map a port to files and memory maps → lsof You are scanning remote hosts for open ports → nmap net-tools is not installed and you cannot add it → `ss` from iproute2

netstat vs ss

	netstat (net-tools)	ss (iproute2)
Package	net-tools (legacy)	iproute2 (default on most distros)
Speed on large socket tables	Slower	Faster
Socket types	inet, unix, some others	TCP, UDP, SCTP, MPTCP, vsock, …
Filters	Flag combinations	Rich `state` and port expressions
Maintenance	Low — compatibility tool	Active development

For new scripts and daily work on Ubuntu, prefer ss. Keep netstat when you must match old documentation or net-tools is already the team standard.

netstat — interview corner

What does netstat show?

netstat reads the kernel networking tables and prints active sockets, optional routing and interface data, and protocol statistics. It does not send packets to remote hosts — everything is local state.

bash

netstat -tln

A strong answer is:

"netstat lists local socket endpoints, connection states, routes, and stack stats from /proc. It's legacy; ss is the modern replacement on Linux."

Why do listening ports not appear by default?

By default netstat shows connected sockets only. Listening daemons sit in LISTEN state and need -l (often with -a for UDP and idle sockets).

bash

netstat -tln

A strong answer is:

"Default output omits listeners. I use -tln for TCP listening ports or -tuln to include UDP binds."

What are Recv-Q and Send-Q?

Recv-Q is bytes received by the kernel for that socket but not yet read by the application. Send-Q is data sent by the app but not yet acknowledged on the wire. High queues under load can mean a slow reader or network congestion.

A strong answer is:

"Recv-Q is the kernel receive backlog for the socket; Send-Q is data queued for transmission or awaiting ACK. Sustained high values warrant investigation."

netstat vs ss — which do you use?

ss uses netlink, supports more socket types and filters, and scales better on busy servers. netstat remains common on older docs and minimal images with net-tools installed.

bash

ss -tln

A strong answer is:

"I use ss on modern Linux for speed and filters. netstat when a legacy script or distro still standardizes on net-tools."

What does TIME_WAIT mean?

TIME_WAIT appears after a TCP connection closes — the side that initiated close waits briefly so late packets cannot confuse a new connection using the same quad. Many TIME_WAIT lines to the same port are usually normal on busy clients.

A strong answer is:

"TIME_WAIT is the post-close wait state for stray segments. Lots of them on an outbound client is common; on a server it can mean short-lived connections or a tuning question."

Troubleshooting

Symptom	Likely cause	Fix
`netstat: command not found`	net-tools not installed	`sudo apt install net-tools` on Debian/Ubuntu
Empty `PID/Program name` column	Insufficient privilege	Run with `sudo netstat -p`
No listening ports shown	Missing `-l`	Add `-l` or `-a`
Slow output	DNS lookups	Add `-n`
`no support for AF INET (sctp)` with `-v`	SCTP not enabled	Ignore or drop SCTP-related flags
Different output than ss	Different data source / defaults	Compare with `ss -tln`; prefer ss for new work

Rohan Timalsina

is a technical writer and Linux enthusiast who writes practical guides on Linux commands and system administration. He focuses on simplifying complex topics through clear explanations.

Expertise

Linux
HTML5
JavaScript
Web Design
Front-end Web Development

netstat — quick reference

Socket display

Naming and output width

Process and extended socket info

Address family

Routing, interfaces, and statistics

Help and version

netstat — command syntax

netstat — command examples

netstat — when to use / when not

netstat vs ss

netstat — interview corner

Troubleshooting

Related Articles

Troubleshoot Default Routes in Linux

Troubleshoot Slow Network Speed in Linux

Troubleshoot Packet Loss in Linux