If you want to obtain in­form­a­tion about the network status using netstat commands, you only need to access the command line tool of your operating system in order to do this. In Windows, Linux, and macOS, the procedure required for this differs, as does the ap­plic­a­tion of some netstat commands in the re­spect­ive operating system.

Cheap domain names – buy yours now
  • Free website pro­tec­tion with SSL Wildcard included
  • Free private re­gis­tra­tion for greater privacy
  • Free Domain Connect for easy DNS setup

How to use the netstat network tool?

In all common operating systems, both netstat and a cor­res­pond­ing command line tool for running the network service are available by default. In Windows systems you use the well-es­tab­lished command prompt, in Linux dis­tri­bu­tions and on Mac devices you use the terminal.

Access netstat in Windows

First use the Windows key + [R] key com­bin­a­tion. Use this shortcut to access the ‘Run’ tool. Now type ‘cmd’ and confirm the entry via ‘OK’ to start the command prompt.

You can then type any netstat command directly into the command prompt and confirm with the Enter key.

Access netstat in Linux

As a Linux user, you enter netstat commands in the terminal. In the popular dis­tri­bu­tion Ubuntu, there is a factory-assigned key com­bin­a­tion to access netstat:

[Ctrl] + [Alt] +[T]
Note

netstat is pre-installed up to Ubuntu 16.04 as part of the net-tools package. In newer versions of the Linux dis­tri­bu­tion, you first have to install the package. To do this, execute the following command: ‘sudo apt-get install net-tools’.

Other dis­tri­bu­tions like Debian do not have a shortcut by default. However, you can easily search for and launch the command line tool using the search function in the ‘Show ap­plic­a­tions’ menu (also works in Ubuntu). To do this, simply type ‘terminal’.

Once the terminal is open, you can execute the desired netstat commands.

Activate netstat in macOS

The terminal is also the command line tool of choice on Mac devices when it comes to executing netstat commands. You have two con­veni­ent options for accessing it: The Spotlight Search and the ‘Utilities’ menu.

Using Spotlight search works as follows:

  1. Open the Spotlight Search by clicking on the mag­ni­fy­ing glass icon in the menu bar or using the key com­bin­a­tion [Cmd] + [Space].
  2. Enter ‘Terminal’ in the search field.
  3. Start the tool by double-clicking on the cor­res­pond­ing search result.

Via the Utilities menu, start the terminal as follows:

  1. Switch to your desktop.
  2. Click on the ‘Go to’ item in the menu bar.
  3. Select ‘Utilities’.
  4. Open the terminal by double-clicking on the cor­res­pond­ing entry.

These useful netstat commands are available for Windows, Linux, and Mac

Many netstat commands are ap­plic­able across systems, since syntax and required para­met­ers do not differ. Here and there, however, there are dif­fer­ences in the commands in Windows, Linux, and macOS. In the following tables we have listed all the important netstat commands for the in­di­vidu­al systems.

netstat commands for Windows

[OPTION] Command De­scrip­tion
netstat List of all active con­nec­tions
info netstat info Starts the netstat overview menu
-a netstat -a Lists the open sockets in addition to active con­nec­tions
-b netstat -b Displays the ex­ecut­able file involved in creating a con­nec­tion or listening port (listener) (requires ad­min­is­trat­or priv­ileges)
-e netstat -e Ethernet stat­ist­ics (bytes received and sent, data packets, etc.)
-f netstat -f Returns the ((fully-qualified domain name (FQDN) domains/do­main­ver­wal­tung/fqdn-fully-qualified-domain-name/)) of remote addresses
-i netstat -i Shows how long a ((TCP server/knowhow/tcp-vorges­tellt/)) con­nec­tion has spent in its current state
-n netstat -n Displays addresses and port numbers nu­mer­ic­ally
-o netstat -o Presents con­nec­tions with the as­so­ci­ated process ID in each case
-p protocol netstat -p TCP Shows the con­nec­tions for the specified protocol, in this case TCP; also possible: ((UDP server/knowhow/udp-user-datagram-protocol/)), TCPv6, or UDPv6
-q netstat -q Lists all con­nec­tions: all listening TCP sockets/ports and all open TCP ports that are not listening
-r netstat -r Shows the contents of the routing table
-s netstat -s Gets stat­ist­ics about the main network protocols; default: IP, IPv6, ((ICMP server/knowhow/was-ist-das-icmp-protokoll-und-wie-funk­tioniert-es/)), ICMPv6, TCP, TCPv6, UDP, UDPv6
-t netstat -t Shows the offload status (TCP offload to relieve the main processor) of active con­nec­tions
-x netstat -x Informs about all con­nec­tions, listeners, and shared endpoints for Net­work­Dir­ect
-y netstat -y Shows the TCP con­nec­tion templates of all active con­nec­tions
Interval netstat -p 10 Displays the re­spect­ive stat­ist­ics again after a selected number of seconds (here 10); can be combined as desired (here with -p), [CTRL] + [C] ter­min­ates the interval display

netstat commands for Linux

[OPTION] Command De­scrip­tion
netstat List of all active con­nec­tions
-h, --help netstat -h Accesses the netstat overview menu
-r, --route netstat -r Shows routing table
-i, --in­ter­faces netstat -i Displays in­form­a­tion about the network in­ter­faces
-g, --groups netstat -g Presents in­form­a­tion about the in­ter­faces’ mem­ber­ship in ((multicast server/knowhow/multicast/)) groups
-s, --stat­ist­ics netstat -s Detailed network stat­ist­ics, divided by protocols (IP, TCP, UDP, ICMP, MPTCP)
-M, --mas­aquer­ade netstat -M Listing of all currently masked IP con­nec­tions; only available if IP masking is supported by the system
-v, --verbose netstat -v More detailed output; among other things, the netstat command outputs which address families are not con­figured in the system core
-W, --wide netstat -W Prevents IP addresses from being truncated (‘IP trunking’; removing the last character block)
-n, numeric netstat -n Outputs numeric addresses instead of resolving the host name
--numeric-hosts netstat --numeric-hosts Host names are not resolved
--numeric-ports netstat --numeric-ports Port names are not resolved
--numeric-users netstat --numeric-users User names are not resolved
-N, --symbolic netstat -N Resolves hardware names
-e, --extend netstat -e Displays extended in­form­a­tion, for example the user that the socket belongs to
-p, --programs netstat -p Presents process ID and program name of the re­spect­ive socket (requires ad­min­is­trat­or priv­ileges)
-o, --timers netstat -o Shows in­form­a­tion about timers for packet sending timeouts
-c, --con­tinu­ous netstat -c Ensures that the desired netstat display is con­tinu­ously updated
-l, --listening netstat -l Displays open network sockets/ports
-a, --all netstat -a netstat command to show all sockets (connected and dis­con­nec­ted)
-F, --fib netstat -F Shows for­ward­ing table (also called For­ward­ing In­form­a­tion Base, FIB for short)
-C, --cache netstat -C Presents the routing cache
-Z, --context netstat -Z Displays the ((SELinux server/security/was-ist-selinux/)) security context for sockets
-t, --tcp netstat -t Displays only TCP sockets
-u, --udp netstat -u Displays UDP sockets only
-U, --udplite netstat -U Displays UDP-Lite sockets only
-s, --sctp netstat -s Shows only ((SCTP server/knowhow/sctp-stream-control-trans­mis­sion-protocol/)) sockets
-w, --raw netstat -w Displays only RAW sockets
-x, --unix Nnetstat -x Displays only UNIX sockets

netstat commands for Mac

[OPTION] Command De­scrip­tion
-A netstat -A In com­bin­a­tion with the standard display; shows the addresses of all protocol control blocks connected to sockets
-a netstat -a In com­bin­a­tion with the standard display; shows the status of all sockets
-b netstat -b In com­bin­a­tion with the interface display; presents number of incoming and outgoing bytes
-c Queue netstat -c Queue In com­bin­a­tion with the queue display -q; displays in­form­a­tion only for the queue specified in the netstat command
-d netstat -d In com­bin­a­tion with the interface display; informs about the number of dropped packets
-f address family netstat -f inet Limits stat­ist­ics or reports on address control blocks to hits with the specified address family (here: inet or IPv4); other options: inet6, unix
-g netstat -g Presents in­form­a­tion about the in­ter­faces’ mem­ber­ship in multicast groups
-I Interface netstat -I Interface (capital i) Displays in­form­a­tion ex­clus­ively for the specified interface
-i netstat -i Displays all available, auto­mat­ic­ally con­figured in­ter­faces
-L netstat -L Displays the size of the different queues; number 1: rejected con­nec­tions, number 2: rejected in­com­plete con­nec­tions, number 3: maximum number of con­nec­tions in queue
-l netstat -l (small L) Present­a­tion of the complete IPV6 address
-m netstat -m Stat­ist­ics recorded by memory man­age­ment routines
-n netstat -n Numerical display of network addresses
-p protocol netstat -p TCP Displays stat­ist­ics only for the specified protocol (here: TCP); a list of available protocols can be found in the /etc/protocols directory
-q netstat -q Displays the queue stat­ist­ics of the network interface
-r netstat -r Presents the network routing tables
-R netstat -R Gives in­form­a­tion about the reach­ab­il­ity
-s netstat -s Sum­mar­ises the in­form­a­tion for each protocol sep­ar­ately; if this option is repeated, counters with a status of ‘0’ are not con­sidered again
-v netstat -v More detailed report; among other things, the process ID for each open port is now displayed as well
-W netstat -W Prevents IP addresses from being truncated (‘IP trunking’; removing the last character block)
-w waiting time netstat -w 30 Reprints network interface or protocol stat­ist­ics at intervals of ‘X’ seconds (here: 30)
-x netstat -x Presents extended link layer reach­ab­il­ity in­form­a­tion in addition to what is displayed via -R

netstat commands: Example

With the help of the in­di­vidu­al para­met­ers from the above tables you can check the status of the active con­nec­tions and open or closed ports and in­ter­faces in detail. Of course, you can also combine different netstat commands directly with each other, as in the following cross-system example:

netstat -an

By combining the -a and -n para­met­ers, you auto­mat­ic­ally get the status of all active and inactive sockets, with all addresses rendered in numeric form.

Tip

A more detailed overview of the basics and syntax of netstat is provided in our article ‘In­tro­duc­tion to netstat’.

Go to Main Menu