In­tro­duc­tion to netstat: what is netstat and how does it work?

Netstat — derived from the words network and stat­ist­ics — is a program that’s con­trolled via commands issued in the command line. It delivers basic stat­ist­ics on all network activ­it­ies and informs users on which ports and addresses the cor­res­pond­ing con­nec­tions – TCP and UDP – are running and which ports are open for tasks.

In 1983, netstat was first im­ple­men­ted into the Unix de­riv­at­ive BSD (Berkley Software Dis­tri­bu­tion), whose version 4.2 supported the first Internet protocol family TCP/IP. netstat has been in­teg­rated into Linux since its debut in 1991 and has been present in Windows since the release of version 3.11 (1993), which could also com­mu­nic­ate via TCP/IP with the help of ex­ten­sions. While the para­met­ers of netstat commands (as well as their outputs) differ from system to system, when it comes to their functions, the various im­ple­ment­a­tions are very similar.

Knowing about the incoming and outgoing con­nec­tions of your computer or server gives you a big advantage in the fight against dis­pro­por­tion­ate traffic and malicious software. These con­nec­tions are es­tab­lished via the re­spect­ive network address, which indicates, among other things, which port was opened in advance for data exchange.

The big problem with these open ports is the fact that they offer third parties the op­por­tun­ity to sneak malware into your system. Moreover, there is a pos­sib­il­ity that a Trojan that is already in your system may install a so-called backdoor and open a cor­res­pond­ing port in the process. For this reason, you should regularly check the ports opened by your system. netstat is excellent for this.

Thanks to the detailed stat­ist­ics, you can also get in­form­a­tion about the packets trans­ferred since the last system start and any errors that occurred. Also, the routing table, which gives in­form­a­tion about the data packets’ journey through the network, can be displayed with the help of netstat.

In Windows operating systems, you can use the netstat services via the command line (cmd.exe). So, in Windows you need the command prompt, which you can start at any time via “Run” by pressing the key com­bin­a­tion [Windows key] + [R] and entering ‘cmd’. In macOS and Linux, launch the Terminal to use the network tool.

The syntax of netstat’s commands varies from system to system. However, it basically has the following pattern:

Typical for the listing of the para­met­ers is a preceding hyphen (-), which you only have to put in front of the first link when combining several options:

In order to make the use of the listed netstat commands for Windows easier to un­der­stand, we will show you some example commands (Windows):

If you don’t want to retrieve all active con­nec­tions, but only all active IPv4 con­nec­tions, you can do this using the netstat command:

If you only want to obtain stat­ist­ics on the ICMPv6 protocol, enter the following command in the command line:

One of the most popular netstat commands is un­doubtedly to query all open ports and active con­nec­tions (including process ID) in numeric form: