巧匠Developer Cheatsheet

netstat Cheatsheet - Linux Network Troubleshooting Reference

Two things dominate day-to-day netstat: is anything listening on my port, and how many ESTABLISHED versus TIME_WAIT connections do I have. Combine -a with -p and you get both the listener and the process holding the port; this table covers those checks plus routing and interface stats, so a quick "is it open / is it healthy" triage needs no extra tooling.

SysOps·39 commands·Last updated 2026-07-21
netstatNetworkingPortslinux

View Connections 6

netstat
Show all active connections
netstat -a
Show all listening and non-listening ports
netstat -at
Show TCP connections only
netstat -au
Show UDP connections only
netstat -an
Don't resolve names/ports (faster)
netstat -anp
Show PID and process name (needs root)

Listening Ports 6

netstat -l
Show all listening ports
netstat -lt
Show TCP listening ports
netstat -lu
Show UDP listening ports
netstat -lx
Show Unix socket listeners
netstat -lntp
TCP listeners with processes (root); most common
netstat -lnup
UDP listeners with processes

Routing Table & Interface Stats 5

netstat -r
Show the routing table (like route)
netstat -rn
Routing table without hostname resolution (faster)
netstat -i
Show interface statistics (packets in/out)
netstat -ie
Interface details (like ifconfig)
netstat -rn | grep UG
Show only the default gateway route

Protocol Statistics 5

netstat -s
Show statistics for all protocols
netstat -st
Show TCP statistics
netstat -su
Show UDP statistics
netstat -s | grep -i error
Show network error statistics
netstat -s | grep -i retrans
Show TCP retransmission statistics

Filter by State & Troubleshoot 6

netstat -an | grep ESTABLISHED
Show established connections
netstat -an | grep TIME_WAIT
Show TIME_WAIT connections
netstat -an | grep :80
Show connections on port 80
netstat -lntp | grep :80
Find which process listens on port 80
netstat -an | awk '{print $6}' | sort | uniq -c
Count connections per state
netstat -an | grep ESTABLISHED | wc -l
Count current active connections

Advanced Options 6

-n
No name resolution; shown faster
-p
Show PID and name of the owning process (root)
-c 1
Continuously output every second (live monitoring)
-o
Show connection timer information
-e
Show extra info: user and inode columns
-v
Verbose: show unconfigured interfaces

Alternatives (ss / ip) 5

ss -tlnp
ss replaces netstat -tlnp; faster
ss -tn state established
Filter established connections with ss
ss -s
Connection statistics summary with ss
ip addr
ip replaces ifconfig/netstat -ie for interfaces
ip route
ip replaces netstat -r for the routing table

Tips

  • netstat is being replaced by ss; on newer systems prefer ss (faster, modern).
  • Viewing processes needs root, otherwise the PID column shows -.
  • Too many TIME_WAIT means frequent short connections; consider long-lived connections or a pool.
  • netstat -an is fastest; -p slows it down by mapping processes.
  • ss reads kernel data via netlink, an order of magnitude faster than netstat.
  • The most common port-occupancy check is netstat -tlnp | grep <port>.

Related Cheatsheets

6 related cheatsheets

Linux Troubleshooting Cheatsheet - System Fault Diagnosis Command ReferenceA one-stop Linux troubleshooting reference organized by process/load, port/network, disk/memory, and logs/services, helping you quickly spot performance bottlenecks, connection anomalies, and resource hogs during live incidents.Vim Cheatsheet - Editor Command ReferenceA Vim operation reference covering cursor motion, text editing, search and replace, visual mode, and save/exit, aimed at developers and operators editing files on a server, including real-world tricks such as batch replacement and saving with sudo.Systemd Cheatsheet - Systemd Service Management Command ReferenceA Systemd service-management reference covering start/stop and boot-enabling, journalctl log viewing, timer scheduling, targets and runlevels, and resource limits, with the differences between easily-confused pairs such as reload vs restart and mask vs disable.Cron Cheatsheet - Cron Expression & Task Scheduling ReferenceA Cron scheduling reference spanning the 5-field expression format, special characters and time macros, common examples, environment variables, and troubleshooting, flagging frequent pitfalls such as the OR relationship between day-of-month and day-of-week and the minimal default PATH.CI/CD Commands Cheatsheet - CI/CD Pipeline Debugging ReferenceA debugging reference for GitHub Actions, GitLab CI, and Jenkins pipelines, covering job reruns and log extraction, runner online status, cache and disk usage, and local reproduction with act or gitlab-runner exec.MQ Commands Cheatsheet - Kafka/RabbitMQ/RocketMQ ReferenceAn MQ operations reference for Kafka, RabbitMQ, RocketMQ, and Redis Pub/Sub, focused on the four high-frequency scenarios of locating consumer backlog, hunting connection leaks, diagnosing cluster state, and benchmarking throughput.

Official References

Each command links to its official documentation below, so you can verify the latest usage and read deeper.

Maintained by LaoHand

Publicly updated on Jul 21, 2026, continuously proofread against official docs.

Contact Us

Wrong command or description? Send us corrections, business inquiries or product feedback by email.

Contact Us