What is netstat and how do you use it?
Author: Domeny.ForSale editorial team Published
In brief: netstat is a command-line tool that displays network connections, ports where programs wait for traffic, and other network information. On Linux, it is usually available in the net-tools package: the sudo netstat -tulnp command shows TCP and UDP ports and their associated processes. sudo netstat -tnp is useful for checking established TCP connections, and ss is a modern alternative.
What does netstat show, and when is it useful?
netstat lets you check which addresses your computer communicates with and which programs provide network services. For example, it can help you determine whether a web server is running, why an application cannot bind to a port, or which process is maintaining a connection to another device.
A port is a number used to direct network traffic to a particular service. A program listening on a port waits for communication, while an active TCP connection links a specific local address and port to the address and port at the other end.
netstat shows the state visible on the computer you are checking. Its output alone does not prove that a service is accessible from the internet: a firewall, router or the infrastructure provider’s network rules may block access.
How do you install netstat on Linux?
First, check whether the tool already works:
netstat --version
If the shell reports that the command is not found, install the net-tools package using your distribution’s package manager. Typical commands are:
| Distribution | Installation |
|---|---|
| Debian, Ubuntu | sudo apt update && sudo apt install net-tools |
| Fedora | sudo dnf install net-tools |
| Arch Linux | sudo pacman -S net-tools |
| openSUSE | sudo zypper install net-tools |
Installation requires administrator privileges. On a managed server, if you do not have access to sudo, ask the administrator to install it or check whether the ss command is available.
On many modern Linux systems, netstat is not installed by default, and ss from the iproute2 package is recommended for diagnosing connections. netstat can still be useful when working with older instructions and environments.
How do you check active connections?
To display TCP connections without sockets waiting for new connections, run:
sudo netstat -tnp
The -t option selects TCP, -n displays numeric addresses and ports without resolving names, and -p adds process information. sudo also lets you see details of processes belonging to other users; without the appropriate privileges, some information may be unavailable.
The State column shows the connection state. ESTABLISHED means an established connection, SYN_SENT indicates an attempt to establish one, and TIME_WAIT is a state after a connection has ended, during which the system still retains its information. A TIME_WAIT entry does not, by itself, indicate a failure.
If you are only interested in established TCP connections, you can filter the output:
sudo netstat -tnp | grep ESTABLISHED
The Local Address column contains the local address and port, while Foreign Address contains the address and port at the other end. UDP does not establish connections in the same way as TCP, so its sockets do not have an equivalent ESTABLISHED state. Use sudo netstat -unp to check them.
How do you find programs listening on ports?
The most practical command for checking network services is:
sudo netstat -tulnp
The -l option limits the output to listening sockets, while -u includes UDP. For TCP, you will see the LISTEN state; for UDP, these are sockets receiving datagrams, rather than listening for connections in the TCP sense.
A simplified example entry might look like this:
tcp 0 0 127.0.0.1:8080 0.0.0.0:* LISTEN 2451/python3
This means that the python3 process, with PID 2451, is listening on port 8080, but only on the local loopback interface. A PID is a process identifier that lets you inspect the process in more detail, for example with ps -p 2451 -f.
The listening address matters:
127.0.0.1:8080— the service is accessible through the local IPv4 address, not directly from other computers.0.0.0.0:8080— listening on all local IPv4 addresses.:::8080— listening on all local IPv6 addresses; IPv4 support depends on the system and application configuration.
Do not interpret 0.0.0.0:* in the Foreign Address column as a remote client. For a listening socket, it means that no remote endpoint is specified.
Example: an application cannot bind to port 8080
If an application reports that port 8080 is in use, check the listening TCP sockets:
sudo netstat -tlnp | grep ':8080 '
Read the PID and program name, then inspect the process with ps -p PID -f, replacing PID with the number you found. Determine whether it is a previous instance of your application or a service that is needed. Only then stop the appropriate program using its standard method, or choose another port — do not terminate an unknown process simply because it prevents your application from starting.
If netstat is unavailable, you can perform a similar check with:
sudo ss -tulnp
If you have trouble accessing the service from another computer, first confirm the listening address and process, then check the firewall and network route. This separates a problem with an application that is not running from a problem reaching its port.
See also: Domain names and social media — what should be consistent?
Read also
