Using Netstat for Network Monitoring in Linux

This article explains how to use Netstat for network monitoring in Linux. Netstat information, such as active connections, listening ports, routing tables, and network interface statistics. It is part of the net-tools package, which must be installed separately on many modern Linux distributions.

Install Netstat on Linux
Netstat is not installed by default on many systems. It can be installed using the package manager relevant to your Linux distribution.

Debian/Ubuntu:
```
sudo apt install net-tools -y
```
RHEL/CentOS/Fedora:
```
sudo dnf install net-tools -y
```
Arch Linux:
```
sudo pacman -Sy net-tools
```
SUSE:
```
sudo zypper install net-tools -y
```
Alpine:
```
sudo apk add net-tools
```

To verify installation:

netstat --version

Command Syntax:
netstat [OPTIONS]

Running netstat without any options displays active (non-listening) connections.

Output Fields Explanation:

Proto: Protocol (TCP/UDP)
Recv-Q / Send-Q: Queue sizes for receiving and sending
Local Address: Local IP and port
Foreign Address: Remote IP and port
State: State of the connection (e.g., ESTABLISHED)

Commonly Used Options:
-a: Displays all connections (listening and non-listening)
-l: Shows only listening sockets
-t: Displays TCP connections
-u: Displays UDP connections
-n: Displays numeric addresses instead of resolving names
-p: Displays the PID and name of the program to which each socket belongs
-r: Displays the kernel routing table
-i: Displays network interface statistics
-o: Displays timers

Practical Examples:

Show all connections with PIDs:
```
sudo netstat -p
```
Show all listening TCP and UDP ports:
```
sudo netstat -ltup
```
Display routing table:
```
netstat -r
```
Display interface statistics:
```
netstat -i
```
Display all active connections:
```
sudo netstat -apn
```
Show only TCP or UDP connections:
```
sudo netstat -aptn
sudo netstat -apun
```
Show socket timers:
```
netstat -ano
```
Show only listening sockets:
```
netstat -tuln
```

Netstat is a fundamental tool for network troubleshooting and monitoring in Linux. Although newer tools like “ss” are now preferred in modern systems, netstat remains widely used and useful for quick diagnostics. If you require additional assistance, feel free to contact our support staff.

Looking for deeper network insights? Learn How to monitor incoming and outgoing network connections in Linux servers

Spread the love

Tagged: Linux