netstatLegacy network statistics (and their ss/ip twins)
netstat shows listening ports, connections, the routing table, interface counters and protocol statistics. It's from the old net-tools package, no longer installed by default, but still in countless runbooks and on older servers, so you must read it and know the modern equivalent.
netstat [-t] [-u] [-l] [-a] [-n] [-p] | netstat -r | netstat -i | netstat -sA runbook says 'run netstat -tulnp'. On a fresh Ubuntu server, make that work and read the result.
sudoRoot is needed to see the PID/Program name of sockets owned by other users.
netstat reads the kernel's text tables in /proc: /proc/net/tcp, tcp6, udp and udp6 for sockets, /proc/net/route for routes, /proc/net/dev for interface counters and /proc/net/snmp and netstat for protocol statistics. Each socket line in those files carries hex addresses, a state code and an inode number; netstat decodes them and, with -p, finds the owning process by scanning /proc/<pid>/fd for that socket inode. Because it reads and parses whole files it is slow on hosts with very many connections, and it can't filter in the kernel the way ss does. The net-tools package (netstat, ifconfig, route, arp) has been deprecated in favour of iproute2 (ss, ip) for years. Modern equivalents: netstat -tulnp is ss -tulnp, netstat -rn is ip route, netstat -i is ip -s link, netstat -s is nstat or ss -s.
-t / -uTCP / UDP sockets-lListening sockets only-aAll sockets, listening and connected-nNumeric output, no name lookups (always use it)-pPID and program name (needs root for other users)-rKernel routing table (like ip route)-iInterface packet and error counters (like ip -s link)-sPer-protocol statistics: retransmits, drops, resets-cRepeat every second-eExtra columns: user and inodenetstat -tulp without -nnetstat then resolves every address and port to a name; on a box with many connections or slow DNS it can take minutes.
netstat -tulnpWriting new scripts around netstatnet-tools is deprecated and missing from new images; its output format also differs across systems.
ss -tulnp, ip route, ip -s linkParsing netstat output without skipping its headersThe two header lines get counted as states or connections.
netstat -ant | tail -n +3 | ... # or ss -HTry these on a Linux machine of your own. Each task has a hint and a solution.
List listening TCP ports with numeric addresses using netstat (net-tools is installed in the sandbox).
Show the kernel routing table with netstat, then with the modern command, and compare.
Count TCP sockets per state with netstat, skipping the header lines.
netstatLegacy network statistics (and their ss/ip twins)
netstat shows listening ports, connections, the routing table, interface counters and protocol statistics. It's from the old net-tools package, no longer installed by default, but still in countless runbooks and on older servers, so you must read it and know the modern equivalent.
netstat [-t] [-u] [-l] [-a] [-n] [-p] | netstat -r | netstat -i | netstat -sA runbook says 'run netstat -tulnp'. On a fresh Ubuntu server, make that work and read the result.
sudoRoot is needed to see the PID/Program name of sockets owned by other users.
netstat reads the kernel's text tables in /proc: /proc/net/tcp, tcp6, udp and udp6 for sockets, /proc/net/route for routes, /proc/net/dev for interface counters and /proc/net/snmp and netstat for protocol statistics. Each socket line in those files carries hex addresses, a state code and an inode number; netstat decodes them and, with -p, finds the owning process by scanning /proc/<pid>/fd for that socket inode. Because it reads and parses whole files it is slow on hosts with very many connections, and it can't filter in the kernel the way ss does. The net-tools package (netstat, ifconfig, route, arp) has been deprecated in favour of iproute2 (ss, ip) for years. Modern equivalents: netstat -tulnp is ss -tulnp, netstat -rn is ip route, netstat -i is ip -s link, netstat -s is nstat or ss -s.
-t / -uTCP / UDP sockets-lListening sockets only-aAll sockets, listening and connected-nNumeric output, no name lookups (always use it)-pPID and program name (needs root for other users)-rKernel routing table (like ip route)-iInterface packet and error counters (like ip -s link)-sPer-protocol statistics: retransmits, drops, resets-cRepeat every second-eExtra columns: user and inodenetstat -tulp without -nnetstat then resolves every address and port to a name; on a box with many connections or slow DNS it can take minutes.
netstat -tulnpWriting new scripts around netstatnet-tools is deprecated and missing from new images; its output format also differs across systems.
ss -tulnp, ip route, ip -s linkParsing netstat output without skipping its headersThe two header lines get counted as states or connections.
netstat -ant | tail -n +3 | ... # or ss -HTry these on a Linux machine of your own. Each task has a hint and a solution.
List listening TCP ports with numeric addresses using netstat (net-tools is installed in the sandbox).
Show the kernel routing table with netstat, then with the modern command, and compare.
Count TCP sockets per state with netstat, skipping the header lines.