NETSTAT(8)

🎀 NETSTAT(8) 🎀

Okay bestie, this is the netstat(8) page from the Linux System Administrator's Manual 📖💖 It's your go-to for poking at the Linux networking subsystem 🔥

✨ NAME ✨

netstat — print network connections, routing tables, interface statistics, masquerade connections, and multicast memberships 🦋

✨ SYNOPSIS ✨

netstat [address_family_options] [--tcp|-t] [--udp|-u] [--udplite|-U]
[--sctp|-S] [--raw|-w] [--l2cap|-2] [--rfcomm|-f] [--listening|-l]
[--all|-a] [--numeric|-n] [--numeric-hosts] [--numeric-ports]
[--numeric-users] [--symbolic|-N] [--extend|-e[--extend|-e]]
[--timers|-o] [--program|-p] [--verbose|-v] [--continuous|-c]
[--wide|-W]

netstat {--route|-r} [address_family_options] [--extend|-e[--extend|-e]]
[--verbose|-v] [--numeric|-n] [--numeric-hosts] [--numeric-ports]
[--numeric-users] [--continuous|-c]

netstat {--interfaces|-i} [--all|-a] [--extend|-e[--extend|-e]]
[--verbose|-v] [--program|-p] [--numeric|-n] [--numeric-hosts]
[--numeric-ports] [--numeric-users] [--continuous|-c]

netstat {--groups|-g} [--numeric|-n] [--numeric-hosts] [--numeric-ports]
[--numeric-users] [--continuous|-c]

netstat {--masquerade|-M} [--extend|-e] [--numeric|-n] [--numeric-hosts]
[--numeric-ports] [--numeric-users] [--continuous|-c]

netstat {--statistics|-s} [--tcp|-t] [--udp|-u] [--udplite|-U]
[--sctp|-S] [--raw|-w]

netstat {--version|-V}

netstat {--help|-h}

address_family_options:

[-4|--inet] [-6|--inet6]
[--protocol={inet,inet6,unix,ipx,ax25,netrom,ddp,bluetooth, ... } ]
[--unix|-x] [--inet|--ip|--tcpip] [--ax25] [--x25] [--rose] [--ash]
[--bluetooth] [--ipx] [--netrom] [--ddp|--appletalk] [--econet|--ec]

✨ NOTES ✨

Okay so this program is mostly obsolete 💀 The replacement for netstat is ss, the replacement for netstat -r is ip route, the replacement for netstat -i is ip -s link, and the replacement for netstat -g is ip maddr 🫶

✨ DESCRIPTION ✨

Netstat spills the tea on the Linux networking subsystem 🍓 The first argument you give it decides what kind of info you get back ✨

🌸 (none)

By default, netstat shows you a list of open sockets 🦋 If you don't name any address families, you'll get the active sockets from every configured address family 💅

• --route, -r — shows the kernel routing tables 🗺️ Check out route(8) for the full scoop. Fun fact: netstat -r and route -e give you the exact same output 💖
• --groups, -g — shows multicast group membership info for IPv4 and IPv6 🌈
• --interfaces, -i — shows a table of all your network interfaces 🔥
• --masquerade, -M — shows a list of masqueraded connections 🙈
• --statistics, -s — shows summary stats for each protocol 📊

✨ OPTIONS ✨

• --verbose, -v — be extra chatty and tell you what's going on 🗣️ It especially prints some useful info about unconfigured address families 🧚
• --wide, -W — don't chop off IP addresses; the output gets as wide as it needs to be 🦋 This is optional for now so existing scripts don't break 🫶
• --numeric, -n — show numerical addresses instead of trying to figure out symbolic host, port, or user names 🔢
• --numeric-hosts — shows numerical host addresses, but doesn't change how port or user names get resolved 💜
• --numeric-ports — shows numerical port numbers, but doesn't change how host or user names get resolved 🌸
• --numeric-users — shows numerical user IDs, but doesn't change how host or port names get resolved 🍓
• --protocol=family, -A — picks which address families (or maybe better called low-level protocols) you want connections shown for ✨ family is a comma (,) separated list of keywords like inet, inet6, unix, ipx, ax25, netrom, econet, ddp, and bluetooth 🎀 It does the same thing as using --inet|-4, --inet6|-6, --unix|-x, --ipx, --ax25, --netrom, --ddp, and --bluetooth 👑 The inet family (Iv4) covers raw, udp, udplite, and tcp protocol sockets 🦋 The bluetooth family (Iv4) covers l2cap and rfcomm protocol sockets 🫧
• -c, --continuous — makes netstat print the info you picked every single second, nonstop 🔁
• -e, --extend — shows additional info 🔍 Use this twice if you want maximum detail 🤯
• -o, --timers — includes info about networking timers ⏱️
• -p, --program — shows the PID and name of the program each socket belongs to 🧚 You'll see a hyphen if the socket belongs to the kernel (like a kernel service, or a process that exited while its socket still hasn't finished closing) 💀
• -l, --listening — shows only listening sockets 👂 These get left out by default, so this is how you find them 🫶
• -a, --all — shows both listening and non-listening sockets ✨ When you use it with the --interfaces option, it also shows interfaces that aren't up 🌈
• -F — prints routing info from the FIB 📚 This one's the default 💅
• -C — prints routing info from the route cache 🗃️

⚠️ bestie, the original page lists -F and -C as routing info options, so make sure you pick the one you actually need before you go wild on the output 🙈

✨ FILES ✨

• /etc/services — the services translation file 🧚
• /proc — the mount point for the proc filesystem 💜 It's how you get into the kernel's status info, and it's guarded by these files:
  • /proc/net/dev — device information 🔌
  • /proc/net/raw — raw socket information 🍓
  • /proc/net/tcp — TCP socket information 🦋
  • /proc/net/udp — UDP socket information 🌸
  • /proc/net/udplite — UDPLite socket information ✨
  • /proc/net/igmp — IGMP multicast information 📡
  • /proc/net/unix — Unix domain socket information 🐚
  • /proc/net/ipx — IPX socket information 💾
  • /proc/net/ax25 — AX25 socket information 📻
  • /proc/net/appletalk — DDP (appletalk) socket information 🍏
  • /proc/net/nr — NET/ROM socket information 🛰️
  • /proc/net/route — IP routing information 🗺️
  • /proc/net/ax25_route — AX25 routing information 🧭
  • /proc/net/ipx_route — IPX routing information 🛣️
  • /proc/net/nr_nodes — the NET/ROM nodelist 📋
  • /proc/net/nr_neigh — NET/ROM neighbours 👯
  • /proc/net/ip_masquerade — masqueraded connections 🎭
  • /proc/net/snmp — statistics 📊
• /sys/kernel/debug/bluetooth/l2cap — Bluetooth L2CAP information 🩵
• /sys/kernel/debug/bluetooth/rfcomm — Bluetooth serial connections 🫧

✨ SEE ALSO ✨

Go check out route(8), ifconfig(8), iptables(8), proc(5), ss(8), and ip(8) 💅 They're the squad that pairs perfectly with this one.

✨ BUGS ✨

⚠️ Okay, bestie, real talk: every now and then you might see strange info pop up if a socket changes while you're looking at it 🙈 It's super unlikely though, so don't spiral.

✨ AUTHORS ✨

The netstat user interface was written by Fred Baumgarten <dc6iq@insu1.etec.uni-karlsruhe.de> 👑 The man page was basically done by Matt Welsh <mdw@tc.cornell.edu> 🎀 Alan Cox <Alan.Cox@linux.org> gave it an update, and then Tuan Hoang <tqhoang@bigfoot.com> updated it again 💖

The man page and the command in the net-tools package got totally rewritten by Bernd Eckenfels <ecki@linux.de> 🔥 And UDPLite options were added by Brian Micek <bmicek@gmail.com> 🌈

That's a wrap, bestie! 🦋 This was net-tools, last updated 2014-10-07, and you're officially a NETSTAT(8) legend now 👑💅✨