Shows connections for the protocol specified by protocol.
Show which processes are using which sockets (similar to -b under Windows) (you must be root to do this) If this parameter is used with -s to display statistics by protocol, protocol can be tcp, udp, icmp, ip, tcpv6, udpv6, icmpv6, or ipv6. In this case, protocol can be tcp, udp, tcpv6, or udpv6.
This parameter is available on Microsoft Windows XP, Windows Server 2003, and Windows 2000 if a hotfix is applied. This parameter can be combined with -a, -n, and -p. You can find the application based on the PID in the Processes tab in Windows Task Manager.
Limits display to a particular socket address family, unix, inet, inet6ĭisplays multicast group membership information for both IPv4 and IPv6 (may only be available on newer operating systems)ĭisplays network interfaces and their statisticsĭisplays the memory statistics for the networking code (STREAMS statistics on Solaris).ĭisplays active TCP connections, however, addresses and port numbers are expressed numerically and no attempt is made to determine names.ĭisplays active TCP connections and includes the process id (PID) for each connection. This parameter can be combined with -s.ĭisplays fully qualified domain names for foreign addresses (only available on Windows Vista and newer operating systems). ( Windows XP, Windows Server 2003 and newer Windows operating systems not Microsoft Windows 2000 or older).Ĭauses -i to report the total number of bytes of traffic.ĭisplays ethernet statistics, such as the number of bytes and packets sent and received. Some parameters are not supported on all platforms.ĭisplays all active connections and the TCP and UDP ports on which the computer is listening.ĭisplays the binary (executable) program's name involved in creating each connection or listening port. Parameters used with this command must be prefixed with a hyphen (-) rather than a slash ( /). For more information about the states of a TCP connection, see RFC 793. The possible states are as follows: CLOSE_WAIT, CLOSED, ESTABLISHED, FIN_WAIT_1, FIN_WAIT_2, LAST_ACK, LISTEN, SYN_RECEIVED, SYN_SEND, and TIME_WAIT.
The names that corresponds to the IP address and the port are shown unless the -n parameter is specified. Foreign Address – The IP address and port number of the remote computer to which the socket is connected.If the port is not yet established, the port number is shown as an asterisk. An asterisk (*) is shown for the host if the server is listening on all interfaces. The name of the local computer that corresponds to the IP address and the name of the port is shown unless the -n parameter is specified. Local Address – The IP address of the local computer and the port number being used.Proto – The name of the protocol ( TCP or UDP).Netstat provides statistics for the following: The replacement for netstat -r is ip route, the replacement for netstat -i is ip -s link, and the replacement for netstat -g is ip maddr, all of which are recommended instead. On Linux, netstat (part of "net-tools") is superseded by ss (part of iproute2). On Linux this program is mostly obsolete, although still included in many distributions. It is used for finding problems in the network and to determine the amount of traffic on the network as a performance measurement.
It is also available on IBM OS/2 and on Microsoft Windows NT-based operating systems including Windows XP, Windows Vista, Windows 7, Windows 8 and Windows 10. It is available on Unix, Plan 9, Inferno, and Unix-like operating systems including macOS, Linux, Solaris and BSD. In computing, netstat ( network statistics) is a command-line network utility that displays network connections for Transmission Control Protocol (both incoming and outgoing), routing tables, and a number of network interface ( network interface controller or software-defined network interface) and network protocol statistics.
OS/2, Windows: Proprietary commercial software Unix, Unix-like, Plan 9, Inferno, OS/2, Microsoft Windows, ReactOS Various open-source and commercial developers