Read Listening Sockets and Routes with netstat

netstat answers the questions you usually need first: what is listening, which addresses are exposed, and which process owns a socket. It also covers routes and dropped packets. The examples match net-tools 2.10, installed here as package version 2.10-0.1ubuntu4.4.

Allow about 15 minutes. You need a shell and the net-tools package. These commands only read kernel networking information; they do not open ports, change routes, restart services or touch firewall rules.

1. Check the installed command

Confirm which binary will run and note its version:

$ command -v netstat
/usr/bin/netstat
$ netstat --version
net-tools 2.10

The output may include build features after the version line, which is normal. The command is old, and the manpage itself calls it mostly obsolete, pointing you at ss for sockets, ip route for routes and ip -s link for interface statistics. It still earns its keep when you need its familiar output or a script already depends on it.

2. List listening TCP and UDP sockets

Start with numeric output so DNS and service-name lookups do not slow the inspection or hide the actual endpoint:

$ netstat -lnt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 127.0.0.1:5432        0.0.0.0:*               LISTEN
tcp6       0      0 :::22                  :::*                    LISTEN

• -l selects listening sockets.
• -n keeps addresses and ports numeric.
• -t selects TCP; add -u for UDP with netstat -lnu.
• -a adds non-listening sockets, including established connections.

Read the local address carefully. 127.0.0.1:PORT is local to the host, 0.0.0.0:PORT can accept IPv4 traffic on any local IPv4 address, and for IPv6 :::PORT is the wildcard form. A wildcard listener may be intended, but it deserves a service and firewall review.

On a busy machine, keep the output manageable:

$ netstat -lnt | grep -E ':(22|80|443)\s'

This filters the displayed text; it does not change the sockets. The exact spacing differs between builds, so run the unfiltered command whenever an empty result could be misleading.

3. Identify the owning process

Add -p for the PID and program name:

$ netstat -lntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address   Foreign Address State  PID/Program name
tcp        0      0 127.0.0.1:5432  0.0.0.0:*       LISTEN 1234/postgres

Process details follow normal ownership and kernel access rules. You may see a warning that not all processes could be identified, and a hyphen instead of a PID. Try it as your ordinary user first. Reach for elevated privileges only when the investigation needs information owned by other users:

$ sudo netstat -lntp

4. Inspect current connections without name lookups

To see both servers and active connections, combine -a, -n and a protocol selector:

$ netstat -ant
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address      Foreign Address    State
tcp        0      0 127.0.0.1:5432     127.0.0.1:48122    ESTABLISHED
tcp        0      0 0.0.0.0:22        0.0.0.0:*          LISTEN

Common TCP states include LISTEN, ESTABLISHED, TIME_WAIT and CLOSE_WAIT. A single snapshot is not a history: sockets can disappear while netstat is printing them, and the manpage itself acknowledges transient oddities can occur. Repeat the read before treating one line as proof of a persistent problem.

For a short live view, -c prints the selected information every second:

$ netstat -c -n -t

Press Ctrl-C to return to the shell. This only stops netstat's display loop; it does not stop network traffic.

5. Check routes and interfaces

Use -r for the kernel routing table:

$ netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags Iface
0.0.0.0         192.0.2.1       0.0.0.0         UG    enp1s0
192.0.2.0       0.0.0.0        255.255.255.0   U     enp1s0

-n prevents host-name resolution, so the destination and gateway stay easy to compare with firewall or routing documentation. The default route is the row whose destination is 0.0.0.0. Use netstat -i for interface counters such as received, transmitted, dropped and errored packets:

$ netstat -i
Kernel Interface table
Iface  MTU  RX-OK RX-ERR RX-DRP TX-OK TX-ERR TX-DRP Flg
lo     65536  ...    0      0      ...    0      0     LRU

Counter values are cumulative since the interface or system reset. A non-zero number is a clue, not a diagnosis. Compare it over time and correlate it with link, driver and kernel logs before changing anything.

6. Read protocol counters when a connection is failing

netstat -s prints protocol statistics. Narrow it when you can:

$ netstat -s --tcp
Tcp:
    ... active connection openings
    ... failed connection attempts
    ... segments retransmitted

The exact counters depend on the running kernel. Look for trends in failed opens, resets and retransmissions rather than treating one counter as a verdict. The command reads information exposed through /proc, including files such as /proc/net/tcp, /proc/net/route and /proc/net/snmp. If those interfaces are restricted or unavailable, the output may be incomplete.