0% found this document useful (0 votes)
5 views4 pages

Netstat Commands for Unix and Windows

Uploaded by

Art Attack
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
5 views4 pages

Netstat Commands for Unix and Windows

Uploaded by

Art Attack
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

Unix-like

[edit]

On Unix-like systems:

To display all ports open by a process with id pid:


netstat -aop | grep "pid"

To continuously display open TCP and UDP connections numerically and also which
program is using them on Linux:
netstat -nutpacw
Windows
[edit]

On Microsoft Windows:

To display active TCP connections and the process IDs every 5 seconds, type the
following command (works on NT based systems only, or Windows 2000 with hotfix):
netstat -o 5

To display active TCP connections and the process IDs using numerical form, type the
following command (works on NT based systems only, or Windows 2000 with hotfix):
netstat -no
*nix
[edit]

Command Explanation

Shows all sockets, both listening and non-listening, all protocols like
netstat -a
TCP, UDP etc.

netstat -at Shows only TCP connections (-au shows only UDP connections)

Shows all TCP connections with no DNS resolution (show IP addresses


netstat -ant
instead).

netstat -al Shows only listening sockets.


Also show PID and to which program each socket belongs, e adds extra
netstat -aep
info like the user. Run as root to see all PIDs.

netstat -s Shows network statistics.

netstat -r Shows kernel routing information. This is the same output as route -e.

Displays a table of all network interfaces. Add -e to get output similar to


netstat -i
ifconfig.

netstat -ct Displays TCP connections continuously.

netstat -g Display multicast group membership information for IPv4 and IPv6.

Display all services listening for TCP and UDP, all free open ports on
netstat -lntu
the local machine.

netstat -atnp |
grep ESTA
Displays all currently "established" TCP connections.

Wildcards
[edit]

Netstat uses an asterisk * as a wildcard which means "any". An example would be

Example output:

Unix-like
[edit]

On Unix-like systems:

To display all ports open by a process with id pid:


netstat -aop | grep "pid"

To continuously display open TCP and UDP connections numerically and also which
program is using them on Linux:
netstat -nutpacw
Windows
[edit]

On Microsoft Windows:

To display active TCP connections and the process IDs every 5 seconds, type the
following command (works on NT based systems only, or Windows 2000 with hotfix):
netstat -o 5

To display active TCP connections and the process IDs using numerical form, type the
following command (works on NT based systems only, or Windows 2000 with hotfix):
netstat -no
*nix
[edit]

Command Explanation

Shows all sockets, both listening and non-listening, all protocols like
netstat -a
TCP, UDP etc.

netstat -at Shows only TCP connections (-au shows only UDP connections)

Shows all TCP connections with no DNS resolution (show IP addresses


netstat -ant
instead).

netstat -al Shows only listening sockets.

Also show PID and to which program each socket belongs, e adds extra
netstat -aep
info like the user. Run as root to see all PIDs.

netstat -s Shows network statistics.

netstat -r Shows kernel routing information. This is the same output as route -e.
Displays a table of all network interfaces. Add -e to get output similar to
netstat -i
ifconfig.

netstat -ct Displays TCP connections continuously.

netstat -g Display multicast group membership information for IPv4 and IPv6.

Display all services listening for TCP and UDP, all free open ports on
netstat -lntu
the local machine.

netstat -atnp |
grep ESTA
Displays all currently "established" TCP connections.

Wildcards
[edit]

Netstat uses an asterisk * as a wildcard which means "any". An example would be

Example output:

Common questions

Powered by AI

The '-n' option forces netstat to show numerical addresses instead of resolving IP addresses to hostnames. This is useful for reducing lookup time and for scenarios where human-readable addresses are not necessary, such as automated scripts that process network information .

To list all services listening for TCP and UDP connections on a Unix-like system, use the command 'netstat -lntu' . This command displays all listening services and any open ports on the local machine.

The wildcard * in netstat commands represents "any" and is particularly useful in scripting or when filtering is required across multiple similar states or patterns without specifying exact details. For example, it could simplify the script that monitors specific network states across various IPs or ports without distinguishing individually .

The command 'netstat -r' provides detailed kernel routing information, which is equivalent to the output of 'route -e' . Both commands are used to display the current network routing tables available to the system.

To continuously monitor open TCP and UDP connections and identify the programs using them on Unix-like systems, the command 'netstat -nutpacw' is used .

On a Unix-like system, you can determine all ports open by a specific process ID by using the command 'netstat -aop | grep "pid"', substituting "pid" for the actual process ID you're interested in .

To observe continuously changing TCP connections on Unix-like systems, the command 'netstat -ct' is used. This allows the user to monitor TCP connections as they change in real-time .

On Windows systems, to monitor TCP connections every 5 seconds and include process IDs, the command 'netstat -o 5' can be used. This command is available on NT-based systems, and Windows 2000 with a hotfix .

The command 'netstat -a' shows all sockets, both listening and non-listening, across all protocols such as TCP and UDP . On the other hand, 'netstat -al' focuses only on showing currently listening sockets .

The 'netstat -g' command is useful for network administrators as it displays multicast group membership information for both IPv4 and IPv6. This allows administrators to monitor and manage memberships effectively, ensuring that multicast traffic is correctly distributed only to the intended hosts .

You might also like