{"id":51372,"date":"2024-09-05T20:14:37","date_gmt":"2024-09-05T20:14:37","guid":{"rendered":"https:\/\/goodwriterz.com\/site\/?p=51372"},"modified":"2024-09-05T20:14:37","modified_gmt":"2024-09-05T20:14:37","slug":"how-to-use-netstat-on-linux","status":"publish","type":"post","link":"https:\/\/goodwriterz.com\/site\/how-to-use-netstat-on-linux\/","title":{"rendered":"How to Use netstat on Linux"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_68_1 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title \" >\u062c\u062f\u0648\u0644 \u0627\u0644\u0645\u062d\u062a\u0648\u064a\u0627\u062a<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 eztoc-toggle-hide-by-default' ><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-netstat-on-linux\/#Key_Takeaways\" title=\"Key Takeaways\">Key Takeaways<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-netstat-on-linux\/#Ports_Processes_and_Protocols\" title=\"Ports, Processes, and Protocols\">Ports, Processes, and Protocols<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-netstat-on-linux\/#Listing_All_Sockets_with_netstat\" title=\"Listing All Sockets with netstat\">Listing All Sockets with netstat<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-netstat-on-linux\/#Listing_Sockets_by_Type_Using_the_netstat_Command\" title=\"Listing Sockets by Type Using the netstat Command\">Listing Sockets by Type Using the netstat Command<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-netstat-on-linux\/#Listing_Sockets_by_State\" title=\"Listing Sockets by State\">Listing Sockets by State<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-netstat-on-linux\/#Network_Statistics_by_Protocol\" title=\"Network Statistics by Protocol\">Network Statistics by Protocol<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-netstat-on-linux\/#Showing_Process_Names_and_PIDs\" title=\"Showing Process Names and PIDs\">Showing Process Names and PIDs<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-netstat-on-linux\/#Listing_Numeric_Addresses\" title=\"Listing Numeric Addresses\">Listing Numeric Addresses<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-netstat-on-linux\/#Displaying_the_Routing_Table\" title=\"Displaying the Routing Table\">Displaying the Routing Table<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-netstat-on-linux\/#Finding_the_Port_Used_by_a_Process\" title=\"Finding the Port Used by a Process\">Finding the Port Used by a Process<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-netstat-on-linux\/#List_the_Network_Interfaces\" title=\"List the Network Interfaces\">List the Network Interfaces<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-netstat-on-linux\/#List_Multicast_Group_Memberships\" title=\"List Multicast Group Memberships\">List Multicast Group Memberships<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-netstat-on-linux\/#The_New_Kids_on_the_Block\" title=\"The New Kids on the Block\">The New Kids on the Block<\/a><\/li><\/ul><\/nav><\/div>\n<div>\n<section class=\"emaki-custom-block emaki-custom-key-points\">\n<div class=\"emaki-custom key-points\" id=\"custom_block_0\">\n<h3 class=\"title icon i-list\"><span class=\"ez-toc-section\" id=\"Key_Takeaways\"><\/span>Key Takeaways<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<div class=\"custom_block-content key-points\">\n<ul>\n<li> The netstat command provides information about network connections, ports in use, and the processes using them. <\/li>\n<li> Netsat can take arguments to filter out unneeded information and only show the specific details you&#8217;re looking for. <\/li>\n<li> Run sudo netstat -i to list your network interfaces. <\/li>\n<\/ul>\n<\/div><\/div>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":0,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":0,\"nbrPlacementsScanned\":0,\"ruleCount\":200,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":240} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":1,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":1,\"nbrPlacementsScanned\":0,\"ruleCount\":200,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":200,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/section>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":1,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":1,\"nbrPlacementsScanned\":1,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":0} --><br \/>\n<!-- No winning ad found for zone: below first paragraph! --><\/p>\n<p> The Linux <code>netstat<\/code> command gives you a treasure-trove of information about your network connections, the ports that are in use, and the processes using them. Learn how to use it. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":1,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":1,\"nbrPlacementsScanned\":1,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":179} --><br \/>\n<!-- No winning ad found for zone: native in content! --><\/p>\n<h2 id=\"ports-processes-and-protocols\"><span class=\"ez-toc-section\" id=\"Ports_Processes_and_Protocols\"><\/span> Ports, Processes, and Protocols <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Network_socket\">Network sockets<\/a> can either be connected or waiting for a connection. The connections use networking protocols like <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Transmission_Control_Protocol\">Transport Control Protocol<\/a> (TCP) or <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/User_Datagram_Protocol\">User Datagram Protocol<\/a> UDP. They use <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/IPv4\">Internet Protocol<\/a> addresses and <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Port_(computer_networking)\">network ports<\/a> to establish connections. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":1,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":1,\"nbrPlacementsScanned\":1,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":440} --><\/p>\n<p> The word sockets might conjure up images of a physical connection point for a lead or cable, but in this context, a socket is a software construct used to handle one end of a network data connection. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":1,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":1,\"nbrPlacementsScanned\":1,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":641} --><\/p>\n<p> Sockets have two main states: They are either connected and facilitating an ongoing network communication, or they are waiting for an incoming connection to connect to them. There are other states, such as the state when a socket is midway through establishing a connection on a remote device, but putting transient states aside, you can think of a socket as either being connected or waiting (which is often called listening). <\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":1,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":1,\"nbrPlacementsScanned\":1,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":1070} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":2,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":2,\"nbrPlacementsScanned\":1,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<p> The listening socket is called the server, and the socket that requests a connection with the listening socket is called a client. These names have nothing to do with hardware or computer roles. They simply define the role of each socket at each end of the connection. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":2,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":2,\"nbrPlacementsScanned\":2,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":270} --><\/p>\n<p> The <code>netstat<\/code> command lets you discover which sockets are connected and which sockets are listening. Meaning, it tells you which ports are in use and which processes are using them. It can show you routing tables and statistics about your <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Network_interface_controller\">network interfaces<\/a> and <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Multicast\">multicast connections<\/a>. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":2,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":2,\"nbrPlacementsScanned\":2,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":554} --><\/p>\n<p> The functionality of <code>netstat<\/code> has been replicated over time in different Linux utilities, such as <a rel=\"nofollow noopener\" target=\"_blank\" href=\"http:\/\/man7.org\/linux\/man-pages\/man8\/ip.8.html\">ip<\/a> and <a rel=\"nofollow noopener\" target=\"_blank\" href=\"http:\/\/man7.org\/linux\/man-pages\/man8\/ss.8.html\">ss<\/a>. It&#8217;s still worth knowing this granddaddy of all network analysis commands, because it is available on all Linux and Unix-like operating systems, and even on Windows and Mac. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":2,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":2,\"nbrPlacementsScanned\":2,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":841} --><\/p>\n<p> Here&#8217;s how to use it, complete with example commands. <\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":2,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":2,\"nbrPlacementsScanned\":2,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":900} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":3,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":3,\"nbrPlacementsScanned\":2,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":3,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":3,\"nbrPlacementsScanned\":3,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":0} --><\/p>\n<h2 id=\"listing-all-sockets-with-netstat\"><span class=\"ez-toc-section\" id=\"Listing_All_Sockets_with_netstat\"><\/span> Listing All Sockets with netstat <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> The <code>-a<\/code> (all) option makes <code>netstat<\/code> show all the connected and waiting sockets. This command is liable to produce a long listing, so we pipe it into <code>less<\/code>. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":3,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":3,\"nbrPlacementsScanned\":3,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":154} --><\/p>\n<pre>netstat -a | less<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":3,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":3,\"nbrPlacementsScanned\":3,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":173} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"netstat -a | less in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/How-to-Use-netstat-on-Linux.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/How-to-Use-netstat-on-Linux.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":3,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":3,\"nbrPlacementsScanned\":3,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":413} --><\/p>\n<p> The listing includes TCP (IP), <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/IPv6\">TCP6<\/a> (IPv6), and UDP sockets. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":3,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":3,\"nbrPlacementsScanned\":3,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":475} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"382\" loading=\"lazy\" alt=\"Output from netstat -a | less in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567268_496_How-to-Use-netstat-on-Linux.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567268_496_How-to-Use-netstat-on-Linux.png?resize=646%2C382&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":3,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":3,\"nbrPlacementsScanned\":3,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":715} --><\/p>\n<p> The wrap-around in the terminal window makes it a little difficult to see what is going on. Here&#8217;s a couple of sections from that listing: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":3,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":3,\"nbrPlacementsScanned\":3,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":859} --><\/p>\n<p> <strong>Active Internet connections (servers and established)<\/strong> <\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":3,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":3,\"nbrPlacementsScanned\":3,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":914} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":4,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":4,\"nbrPlacementsScanned\":3,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<div class=\"table-container\">\n<table border=\"1\" cellpadding=\"1\" cellspacing=\"1\" align=\"\" summary=\"\">\n<thead>\n<tr>\n<th scope=\"col\">\n<p> Proto <\/p>\n<\/th>\n<th scope=\"col\">\n<p> Recv-Q <\/p>\n<\/th>\n<th scope=\"col\">\n<p> Send-Q <\/p>\n<\/th>\n<th scope=\"col\">\n<p> Local Address <\/p>\n<\/th>\n<th scope=\"col\">\n<p> Foreign Address <\/p>\n<\/th>\n<th scope=\"col\">\n<p> State <\/p>\n<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\n<p> TCP <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> localhost: domain <\/p>\n<\/td>\n<td>\n<p> 0.0.0.0:* <\/p>\n<\/td>\n<td>\n<p> LISTEN <\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p> TCP <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0.0.0.0:ssh <\/p>\n<\/td>\n<td>\n<p> 0.0.0.0:* <\/p>\n<\/td>\n<td>\n<p> LISTEN <\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p> TCP <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> localhost:ipp <\/p>\n<\/td>\n<td>\n<p> 0.0.0.0:* <\/p>\n<\/td>\n<td>\n<p> LISTEN <\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p> TCP <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> localhost:smtp <\/p>\n<\/td>\n<td>\n<p> 0.0.0.0:* <\/p>\n<\/td>\n<td>\n<p> LISTEN <\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p> TCP6 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> (::):ssh <\/p>\n<\/td>\n<td>\n<p> (::):* <\/p>\n<\/td>\n<td>\n<p> LISTEN <\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p> TCP6 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> ip6-localhost:ipp <\/p>\n<\/td>\n<td>\n<p> (::):* <\/p>\n<\/td>\n<td>\n<p> LISTEN <\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":4,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":4,\"nbrPlacementsScanned\":4,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":560} --><\/p>\n<p> <strong>Active UNIX domain sockets (servers and established)<\/strong> <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":4,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":4,\"nbrPlacementsScanned\":4,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":614} --><\/p>\n<div class=\"table-container\">\n<table border=\"1\" cellpadding=\"1\" cellspacing=\"1\" align=\"\" summary=\"\">\n<thead>\n<tr>\n<th scope=\"col\">\n<p> Proto <\/p>\n<\/th>\n<th scope=\"col\">\n<p> RefCnt <\/p>\n<\/th>\n<th scope=\"col\">\n<p> Flags <\/p>\n<\/th>\n<th scope=\"col\">\n<p> Type <\/p>\n<\/th>\n<th scope=\"col\">\n<p> State <\/p>\n<\/th>\n<th scope=\"col\">\n<p> I-Node <\/p>\n<\/th>\n<th scope=\"col\">\n<p> Path <\/p>\n<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\n<p> unix <\/p>\n<\/td>\n<td>\n<p> 24 <\/p>\n<\/td>\n<td>\n<p> ( ) <\/p>\n<\/td>\n<td>\n<p> DGRAM <\/p>\n<\/td>\n<td> <\/td>\n<td>\n<p> 12831 <\/p>\n<\/td>\n<td>\n<p> <code>\/run\/systemd\/journal\/dev-log<\/code> <\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p> unix <\/p>\n<\/td>\n<td>\n<p> 2 <\/p>\n<\/td>\n<td>\n<p> ( ACC ) <\/p>\n<\/td>\n<td>\n<p> STREAM <\/p>\n<\/td>\n<td>\n<p> LISTENING <\/p>\n<\/td>\n<td>\n<p> 24747 <\/p>\n<\/td>\n<td>\n<p> <code>@\/tmp\/dbus-zH6clYmvw8<\/code> <\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p> unix <\/p>\n<\/td>\n<td>\n<p> 2 <\/p>\n<\/td>\n<td>\n<p> ( ) <\/p>\n<\/td>\n<td>\n<p> DGRAM <\/p>\n<\/td>\n<td> <\/td>\n<td>\n<p> 26372 <\/p>\n<\/td>\n<td>\n<p> <code>\/run\/user\/1000\/system\/notify<\/code> <\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p> unix <\/p>\n<\/td>\n<td>\n<p> 2 <\/p>\n<\/td>\n<td>\n<p> ( ) <\/p>\n<\/td>\n<td>\n<p> DGRAM <\/p>\n<\/td>\n<td> <\/td>\n<td>\n<p> 23382 <\/p>\n<\/td>\n<td>\n<p> <code>\/run\/user\/121\/system\/notify<\/code> <\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p> unix <\/p>\n<\/td>\n<td>\n<p> 2 <\/p>\n<\/td>\n<td>\n<p> ( ACC ) <\/p>\n<\/td>\n<td>\n<p> SEQPACKET <\/p>\n<\/td>\n<td>\n<p> LISTENING <\/p>\n<\/td>\n<td>\n<p> 12839 <\/p>\n<\/td>\n<td>\n<p> <code>\/run\/udev\/control<\/code> <\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":4,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":4,\"nbrPlacementsScanned\":4,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":1094} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":5,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":5,\"nbrPlacementsScanned\":4,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<p> The &#8220;Active Internet&#8221; section lists the connected external connections and local sockets listening for remote connection requests. That is, it lists the network connections that are (or will be) established to external devices. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":5,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":5,\"nbrPlacementsScanned\":5,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":239} --><\/p>\n<p> The &#8220;UNIX domain&#8221; section lists the connected and listening internal connections. In other words, it lists the connections that have been established within your computer between different applications, processes, and elements of the operating system. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":5,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":5,\"nbrPlacementsScanned\":5,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":502} --><\/p>\n<p> The &#8220;Active Internet&#8221; columns are: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":5,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":5,\"nbrPlacementsScanned\":5,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":548} --><\/p>\n<ul>\n<li><strong>Proto:<\/strong> The protocol used by this socket (for example, TCP or UDP). <\/li>\n<li><strong>Recv-Q:<\/strong> The receive queue. These are incoming bytes that have been received and are buffered, waiting for the local process that is using this connection to read and consume them. <\/li>\n<li><strong>Send-Q:<\/strong> The send queue. This shows the bytes that are ready to be sent from the send queue. <\/li>\n<li><strong>Local address:<\/strong> The address details of the local end of the connection. The default is for <code>netstat<\/code> to show the local hostname for the address, and the name of the service for the port. <\/li>\n<li><strong>Foreign address:<\/strong> The address and port number of the remote end of the connection. <\/li>\n<li><strong>State:<\/strong> The state of the local socket. For UDP sockets, this is usually blank. See the state table, below. <\/li>\n<\/ul>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":5,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":5,\"nbrPlacementsScanned\":5,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":1260} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":6,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":6,\"nbrPlacementsScanned\":5,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<p> For TCP connections, the state value can be one of the following : <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":6,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":6,\"nbrPlacementsScanned\":6,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":68} --><\/p>\n<ul>\n<li><strong>LISTEN:<\/strong> Server-side only. The socket is waiting for a connection request. <\/li>\n<li><strong>SYN-SENT:<\/strong> Client-side only. This socket has made a connection request and is waiting to see if it will be accepted. <\/li>\n<li><strong>SYN-RECEIVED:<\/strong> Server-side only. This socket is waiting for a connection acknowledgment after accepting a connection request. <\/li>\n<li><strong>ESTABLISHED:<\/strong> Server and clients. A working connection has been established between the server and the client, allowing data to be transferred between the two. <\/li>\n<li><strong>FIN-WAIT-1:<\/strong> Server and clients. This socket is waiting for a connection termination request from the remote socket, or for an acknowledgment of a connection termination request that was previously sent from this socket. <\/li>\n<li><strong>FIN-WAIT-2:<\/strong> Server and clients. This socket is waiting for a connection termination request from the remote socket. <\/li>\n<li><strong>CLOSE-WAIT:<\/strong> Server and client. This socket is waiting for a connection termination request from the local user. <\/li>\n<li><strong>CLOSING:<\/strong> Server and clients. This socket is waiting for a connection termination request acknowledgment from the remote socket. <\/li>\n<li><strong>LAST-ACK:<\/strong> Server and client. This socket is waiting for an acknowledgment of the connection termination request it sent to the remote socket. <\/li>\n<li><strong>TIME-WAIT:<\/strong> Server and clients. This socket sent an acknowledgment to the remote socket to let it know that it received the remote socket&#8217;s termination request. It is now waiting to make sure that acknowledgment was received. <\/li>\n<li><strong>CLOSED:<\/strong> There is no connection, so the socket has been terminated. <\/li>\n<\/ul>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":6,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":6,\"nbrPlacementsScanned\":6,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":1557} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":7,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":7,\"nbrPlacementsScanned\":6,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<p> The &#8220;Unix domain&#8221; columns are: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":7,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":7,\"nbrPlacementsScanned\":7,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":42} --><\/p>\n<ul>\n<li><strong>Proto:<\/strong> The protocol used by this socket. It will be &#8220;unix.&#8221; <\/li>\n<li><strong>RefCnt:<\/strong> Reference count. The number of attached processes connected to this socket. <\/li>\n<li><strong>Flags:<\/strong> This is usually set to <code>ACC<\/code> , which represents <code>SO_ACCEPTON<\/code>, meaning the socket is waiting for a connection request. <code> SO_WAITDATA<\/code>, shown as <code>W<\/code>, means there is data waiting to be read. <code>SO_NOSPACE<\/code>, shown as <code>N<\/code>, means there is no space to write data to the socket (i.e., the send buffer is full). <\/li>\n<li><strong>Type:<\/strong> The socket type. See the type table below. <\/li>\n<li><strong>State:<\/strong> The state of the socket. See the state table below. <\/li>\n<li><strong>I-Node:<\/strong> The file system inode associated with this socket. <\/li>\n<li><strong>Path<\/strong>: The file system path to the socket. <\/li>\n<\/ul>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":7,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":7,\"nbrPlacementsScanned\":7,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":703} --><\/p>\n<p> The Unix domain socket type can be one of the following: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":7,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":7,\"nbrPlacementsScanned\":7,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":761} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":true,\"currentRuleCount\":900,\"actualCount\":761,\"hasActualCountMetThreshold\":true,\"countRemainingForInjection\":139,\"nextBlockCount\":939,\"hasCountRemainingForInjectionMetThreshold\":true,\"nextCount\":1700} --><\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":7,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":7,\"nbrPlacementsScanned\":7,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":900} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":8,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":8,\"nbrPlacementsScanned\":7,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":0} --><\/p>\n<ul>\n<li><strong>DGRAM:<\/strong> The socket is being used in datagram mode, using messages of fixed length. Datagrams are neither guaranteed to be reliable, sequenced, nor unduplicated. <\/li>\n<li><strong>STREAM:<\/strong> This socket is a stream socket. This is the commonplace &#8220;normal&#8221; type of socket connection. These sockets are designed to provide reliable sequenced (in-order) delivery of packets. <\/li>\n<li><strong>RAW:<\/strong> This socket is being used as a raw socket. Raw sockets operate at the network level of the <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/OSI_model#Layer_1:_Physical_Layer\">OSI Model<\/a> and don&#8217;t reference TCP and UDP headers from the transport level. <\/li>\n<li><strong>RDM:<\/strong> This socket is located on one end of a reliably delivered messages connection. <\/li>\n<li><strong>SEQPACKET:<\/strong> This socket is operating as a sequential packet socket, which is another means of providing reliable, sequenced, and unduplicated packet delivery. <\/li>\n<li><strong>PACKET:<\/strong> Raw interface access socket. Packet sockets are used to receive or send raw packets at the device driver (i.e., data link layer) level of the OSI model. <\/li>\n<\/ul>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":8,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":8,\"nbrPlacementsScanned\":8,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":800} --><\/p>\n<p> The Unix domain socket state can be one of the following: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":8,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":8,\"nbrPlacementsScanned\":8,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":859} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":true,\"currentRuleCount\":900,\"actualCount\":859,\"hasActualCountMetThreshold\":true,\"countRemainingForInjection\":41,\"nextBlockCount\":330,\"hasCountRemainingForInjectionMetThreshold\":true,\"nextCount\":1189} --><\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":8,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":8,\"nbrPlacementsScanned\":8,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":900} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":9,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":9,\"nbrPlacementsScanned\":8,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":0} --><\/p>\n<ul>\n<li><strong>FREE:<\/strong> This socket is unallocated. <\/li>\n<li><strong>LISTENING:<\/strong> This socket is listening for incoming connection requests. <\/li>\n<li><strong>CONNECTING:<\/strong> This socket is in the process of connecting. <\/li>\n<li><strong>CONNECTED:<\/strong> A connection has been established, and the socket is able to receive and transmit data. <\/li>\n<li><strong>DISCONNECTING:<\/strong> The connection is in the process of being terminated. <\/li>\n<\/ul>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":9,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":9,\"nbrPlacementsScanned\":9,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":289} --><\/p>\n<p> Wow, that&#8217;s a lot of information! Many of the <code>netstat<\/code> options refine the results in one way or another, but they don&#8217;t change the content too much. Let&#8217;s take a look. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":9,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":9,\"nbrPlacementsScanned\":9,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":469} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":9,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":9,\"nbrPlacementsScanned\":9,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":469} --><\/p>\n<h2 id=\"listing-sockets-by-type-using-the-netstat-command\"><span class=\"ez-toc-section\" id=\"Listing_Sockets_by_Type_Using_the_netstat_Command\"><\/span> Listing Sockets by Type Using the netstat Command <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> The <code>netstat -a<\/code> command can provide more information than you need to see. If you only want or need to see the TCP sockets, you can use the <code>-t<\/code> (TCP) option to restrict the display to only show TCP sockets. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":9,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":9,\"nbrPlacementsScanned\":9,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":675} --><\/p>\n<pre>netstat -at | less<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":9,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":9,\"nbrPlacementsScanned\":9,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":695} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"netstat -at | less in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567268_828_How-to-Use-netstat-on-Linux.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567268_828_How-to-Use-netstat-on-Linux.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":9,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":9,\"nbrPlacementsScanned\":9,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":935} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":10,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":10,\"nbrPlacementsScanned\":9,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<p> The display out is greatly reduced. The few sockets that are listed are all TCP sockets. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":10,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":10,\"nbrPlacementsScanned\":10,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":90} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"382\" loading=\"lazy\" alt=\"Output from netstat -at | less in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567269_614_How-to-Use-netstat-on-Linux.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567269_614_How-to-Use-netstat-on-Linux.png?resize=646%2C382&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":10,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":10,\"nbrPlacementsScanned\":10,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":330} --><\/p>\n<p> The <code>-u<\/code> (UDP) and <code>-x<\/code> (UNIX) options behave in a similar way, restricting the results to the type of socket specified on the command line. Here&#8217;s the -u (UDP) option in use: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":10,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":10,\"nbrPlacementsScanned\":10,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":507} --><\/p>\n<pre>netstat -au | less<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":10,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":10,\"nbrPlacementsScanned\":10,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":527} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"netstat -au | less in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567269_135_How-to-Use-netstat-on-Linux.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567269_135_How-to-Use-netstat-on-Linux.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":10,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":10,\"nbrPlacementsScanned\":10,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":767} --><\/p>\n<p> Only UDP sockets are listed. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":10,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":10,\"nbrPlacementsScanned\":10,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":797} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":true,\"currentRuleCount\":900,\"actualCount\":797,\"hasActualCountMetThreshold\":true,\"countRemainingForInjection\":103,\"nextBlockCount\":240,\"hasCountRemainingForInjectionMetThreshold\":true,\"nextCount\":1037} --><\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":10,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":10,\"nbrPlacementsScanned\":10,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":900} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":11,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":11,\"nbrPlacementsScanned\":10,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":0} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"382\" loading=\"lazy\" alt=\"Output from netstat -au | less in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567269_136_How-to-Use-netstat-on-Linux.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567269_136_How-to-Use-netstat-on-Linux.png?resize=646%2C382&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":11,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":11,\"nbrPlacementsScanned\":11,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":137} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":11,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":11,\"nbrPlacementsScanned\":11,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":137} --><\/p>\n<h2 id=\"listing-sockets-by-state\"><span class=\"ez-toc-section\" id=\"Listing_Sockets_by_State\"><\/span> Listing Sockets by State <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> To see the sockets that are in the listening or waiting state, use the <code>-l<\/code> (listening) option. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":11,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":11,\"nbrPlacementsScanned\":11,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":232} --><\/p>\n<pre>netstat -l | less<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":11,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":11,\"nbrPlacementsScanned\":11,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":251} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"netstat -l | less in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567270_812_How-to-Use-netstat-on-Linux.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567270_812_How-to-Use-netstat-on-Linux.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":11,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":11,\"nbrPlacementsScanned\":11,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":491} --><\/p>\n<p> The sockets that are listed are those that are in the listening state. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":11,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":11,\"nbrPlacementsScanned\":11,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":563} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"382\" loading=\"lazy\" alt=\"Output of netstat -l | less in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567270_513_How-to-Use-netstat-on-Linux.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567270_513_How-to-Use-netstat-on-Linux.png?resize=646%2C382&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":11,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":11,\"nbrPlacementsScanned\":11,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":803} --><\/p>\n<p> This can be combined with the -t (TCP, -u (UDP) and -x (UNIX) options to further home in on the sockets of interest. Let&#8217;s look for listening TCP sockets: <\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":11,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":11,\"nbrPlacementsScanned\":11,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":963} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":12,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":12,\"nbrPlacementsScanned\":11,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<pre>netstat -lt | less<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":12,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":12,\"nbrPlacementsScanned\":12,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":20} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"netstat -lt | less in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567270_520_How-to-Use-netstat-on-Linux.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567270_520_How-to-Use-netstat-on-Linux.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":12,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":12,\"nbrPlacementsScanned\":12,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":260} --><\/p>\n<p> Now, we see only TCP listening sockets. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":12,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":12,\"nbrPlacementsScanned\":12,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":301} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"382\" loading=\"lazy\" alt=\"output from netstat -lt | less in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567270_767_How-to-Use-netstat-on-Linux.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567270_767_How-to-Use-netstat-on-Linux.png?resize=646%2C382&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":12,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":12,\"nbrPlacementsScanned\":12,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":541} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":12,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":12,\"nbrPlacementsScanned\":12,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":541} --><\/p>\n<h2 id=\"network-statistics-by-protocol\"><span class=\"ez-toc-section\" id=\"Network_Statistics_by_Protocol\"><\/span> Network Statistics by Protocol <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> To see statistics for a protocol, use the <code>-s<\/code> (statistics) option and pass in the <code>-t<\/code> (TCP), <code>-u<\/code> (UDP), or <code>-x<\/code> (UNIX) options. If you just use the <code>-s<\/code> (statistics) option on its own, you&#8217;ll see statistics for all protocols. Let&#8217;s check the statistics for the TCP protocol. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":12,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":12,\"nbrPlacementsScanned\":12,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":818} --><\/p>\n<pre>netstat -st | less<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":12,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":12,\"nbrPlacementsScanned\":12,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":838} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":true,\"currentRuleCount\":900,\"actualCount\":838,\"hasActualCountMetThreshold\":true,\"countRemainingForInjection\":62,\"nextBlockCount\":240,\"hasCountRemainingForInjectionMetThreshold\":true,\"nextCount\":1078} --><\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":12,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":12,\"nbrPlacementsScanned\":12,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":900} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":13,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":13,\"nbrPlacementsScanned\":12,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":0} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"netstat -st | less in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567271_243_How-to-Use-netstat-on-Linux.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567271_243_How-to-Use-netstat-on-Linux.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":13,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":13,\"nbrPlacementsScanned\":13,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":178} --><\/p>\n<p> A collection of statistics for the TCP connections is displayed in <code>less<\/code>. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":13,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":13,\"nbrPlacementsScanned\":13,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":252} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"382\" loading=\"lazy\" alt=\"Output from netstat -st | less in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567271_156_How-to-Use-netstat-on-Linux.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567271_156_How-to-Use-netstat-on-Linux.png?resize=646%2C382&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":13,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":13,\"nbrPlacementsScanned\":13,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":492} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":13,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":13,\"nbrPlacementsScanned\":13,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":492} --><\/p>\n<h2 id=\"showing-process-names-and-pids\"><span class=\"ez-toc-section\" id=\"Showing_Process_Names_and_PIDs\"><\/span> Showing Process Names and PIDs <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> It can be useful to see the <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Process_identifier\">process ID<\/a> (PID) of the process using a socket, together with the name of that process. The <code>-p<\/code> (program) option does just that. Let&#8217;s see what the PIDs and process names are for the processes using a TCP socket that is in the listening state. We use <code>sudo<\/code> to make sure we receive all of the information that is available, including any information that would normally require root permissions. <\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":13,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":13,\"nbrPlacementsScanned\":13,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":918} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":14,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":14,\"nbrPlacementsScanned\":13,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<pre>sudo netstat -p -at<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":14,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":14,\"nbrPlacementsScanned\":14,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":21} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"382\" loading=\"lazy\" alt=\"sudo netstat -p -at\u00a0 in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567271_96_How-to-Use-netstat-on-Linux.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567271_96_How-to-Use-netstat-on-Linux.png?resize=646%2C382&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":14,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":14,\"nbrPlacementsScanned\":14,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":261} --><\/p>\n<p> Here&#8217;s that output in a formatted table: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":14,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":14,\"nbrPlacementsScanned\":14,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":307} --><\/p>\n<p> <code><strong>Active Internet connections (servers and established)<\/strong><\/code> <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":14,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":14,\"nbrPlacementsScanned\":14,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":362} --><\/p>\n<div class=\"table-container\">\n<table border=\"1\" cellpadding=\"1\" cellspacing=\"1\" align=\"\" summary=\"\">\n<thead>\n<tr>\n<th scope=\"col\">\n<p> Proto <\/p>\n<\/th>\n<th scope=\"col\">\n<p> Recv-Q <\/p>\n<\/th>\n<th scope=\"col\">\n<p> Send-Q <\/p>\n<\/th>\n<th scope=\"col\">\n<p> Local Address <\/p>\n<\/th>\n<th scope=\"col\">\n<p> Foreign Address <\/p>\n<\/th>\n<th scope=\"col\">\n<p> State <\/p>\n<\/th>\n<th scope=\"col\">\n<p> PID\/Program Name <\/p>\n<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\n<p> tcp <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> localhost: domain <\/p>\n<\/td>\n<td>\n<p> 0.0.0.0:* <\/p>\n<\/td>\n<td>\n<p> LISTEN <\/p>\n<\/td>\n<td>\n<p> 6927\/systemd-resolv <\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p> tcp <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0.0.0.0:ssh <\/p>\n<\/td>\n<td>\n<p> 0.0.0.0:* <\/p>\n<\/td>\n<td>\n<p> LISTEN <\/p>\n<\/td>\n<td>\n<p> 751\/sshd <\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p> tcp <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> localhost:ipp <\/p>\n<\/td>\n<td>\n<p> 0.0.0.0:* <\/p>\n<\/td>\n<td>\n<p> LISTEN <\/p>\n<\/td>\n<td>\n<p> 7687\/cupsd <\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p> tcp <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> localhost:smtp <\/p>\n<\/td>\n<td>\n<p> 0.0.0.0:* <\/p>\n<\/td>\n<td>\n<p> LISTEN <\/p>\n<\/td>\n<td>\n<p> 1176\/master <\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p> tcp6 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> (::):ssh <\/p>\n<\/td>\n<td>\n<p> (::):* <\/p>\n<\/td>\n<td>\n<p> LISTEN <\/p>\n<\/td>\n<td>\n<p> 751\/sshd <\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p> tcp6 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> ip6-localhost:ipp <\/p>\n<\/td>\n<td>\n<p> (::):* <\/p>\n<\/td>\n<td>\n<p> LISTEN <\/p>\n<\/td>\n<td>\n<p> 7687\/cupsd <\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p> tcp6 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> ip6-localhost:smtp <\/p>\n<\/td>\n<td>\n<p> (::):* <\/p>\n<\/td>\n<td>\n<p> LISTEN <\/p>\n<\/td>\n<td>\n<p> 1176\/master <\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":14,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":14,\"nbrPlacementsScanned\":14,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":1002} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":15,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":15,\"nbrPlacementsScanned\":14,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<p> We&#8217;ve got an extra column called &#8220;PID\/program name.&#8221; This column lists the PID and name of the process using each of the sockets. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":15,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":15,\"nbrPlacementsScanned\":15,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":145} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":15,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":15,\"nbrPlacementsScanned\":15,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":145} --><\/p>\n<h2 id=\"listing-numeric-addresses\"><span class=\"ez-toc-section\" id=\"Listing_Numeric_Addresses\"><\/span> Listing Numeric Addresses <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> Another step we can take to remove some ambiguity is to display the local and remote addresses as IP addresses instead of their resolved domain and hostnames. If we use the <code>-n<\/code> (numeric) option, the IPv4 addresses are shown in dotted-decimal format: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":15,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":15,\"nbrPlacementsScanned\":15,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":395} --><\/p>\n<pre>sudo netstat -an | less<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":15,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":15,\"nbrPlacementsScanned\":15,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":420} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"57\" loading=\"lazy\" alt=\"sudo netstat -an | less in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567272_771_How-to-Use-netstat-on-Linux.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567272_771_How-to-Use-netstat-on-Linux.png?resize=646%2C57&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":15,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":15,\"nbrPlacementsScanned\":15,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":660} --><\/p>\n<p> The IP addresses are shown as numeric values. The port numbers are also shown, separated by a colon &#8221; <code>:<\/code> &#8221; from the IP Address. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":15,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":15,\"nbrPlacementsScanned\":15,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":798} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":true,\"currentRuleCount\":900,\"actualCount\":798,\"hasActualCountMetThreshold\":true,\"countRemainingForInjection\":102,\"nextBlockCount\":240,\"hasCountRemainingForInjectionMetThreshold\":true,\"nextCount\":1038} --><\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":15,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":15,\"nbrPlacementsScanned\":15,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":900} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":16,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":16,\"nbrPlacementsScanned\":15,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":0} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"382\" loading=\"lazy\" alt=\"Output from sudo netstat -an | less in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567272_587_How-to-Use-netstat-on-Linux.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567272_587_How-to-Use-netstat-on-Linux.png?resize=646%2C382&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":16,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":16,\"nbrPlacementsScanned\":16,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":138} --><\/p>\n<p> An IP address of 127.0.0.1 shows that the socket is bound to the <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Localhost\">loopback address of the local computer<\/a>. You can think of an <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/0.0.0.0\">IP address of 0.0.0.0<\/a> as meaning the &#8220;default route&#8221; for local addresses, and &#8220;any IP address&#8221; for foreign addresses. IPv6 addresses shown as &#8220;<code>::<\/code>&#8221; are also all zero addresses. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":16,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":16,\"nbrPlacementsScanned\":16,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":470} --><\/p>\n<p> The ports that are listed can be easily <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/List_of_TCP_and_UDP_port_numbers#Well-known_ports\">checked to see what their usual purpose is<\/a>: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":16,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":16,\"nbrPlacementsScanned\":16,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":555} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":16,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":16,\"nbrPlacementsScanned\":16,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":873} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":16,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":16,\"nbrPlacementsScanned\":16,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":873} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":true,\"currentRuleCount\":900,\"actualCount\":873,\"hasActualCountMetThreshold\":true,\"countRemainingForInjection\":27,\"nextBlockCount\":58,\"hasCountRemainingForInjectionMetThreshold\":true,\"nextCount\":931} --><\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":16,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":16,\"nbrPlacementsScanned\":16,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":900} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":17,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":17,\"nbrPlacementsScanned\":16,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":0} --><\/p>\n<h2 id=\"displaying-the-routing-table\"><span class=\"ez-toc-section\" id=\"Displaying_the_Routing_Table\"><\/span> Displaying the Routing Table <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> The <code>-r<\/code> (route) option displays the kernel routing table. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":17,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":17,\"nbrPlacementsScanned\":17,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":31} --><\/p>\n<pre>sudo netstat -r<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":17,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":17,\"nbrPlacementsScanned\":17,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":48} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"247\" loading=\"lazy\" alt=\"sudo netstat -r in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567272_677_How-to-Use-netstat-on-Linux.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567272_677_How-to-Use-netstat-on-Linux.png?resize=646%2C247&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":17,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":17,\"nbrPlacementsScanned\":17,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":288} --><\/p>\n<p> Here&#8217;s that output in a neat table: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":17,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":17,\"nbrPlacementsScanned\":17,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":329} --><\/p>\n<p> <strong>Kernel IP routing table<\/strong> <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":17,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":17,\"nbrPlacementsScanned\":17,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":354} --><\/p>\n<div class=\"table-container\">\n<table border=\"1\" cellpadding=\"1\" cellspacing=\"1\" align=\"\" summary=\"\">\n<thead>\n<tr>\n<th scope=\"col\">\n<p> Destination <\/p>\n<\/th>\n<th scope=\"col\">\n<p> Gateway <\/p>\n<\/th>\n<th scope=\"col\">\n<p> Genmask <\/p>\n<\/th>\n<th scope=\"col\">\n<p> Flags <\/p>\n<\/th>\n<th scope=\"col\">\n<p> MSS <\/p>\n<\/th>\n<th scope=\"col\">\n<p> Window <\/p>\n<\/th>\n<th scope=\"col\">\n<p> irtt <\/p>\n<\/th>\n<th scope=\"col\">\n<p> Iface <\/p>\n<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\n<p> default <\/p>\n<\/td>\n<td>\n<p> Vigor.router <\/p>\n<\/td>\n<td>\n<p> 0.0.0.0 <\/p>\n<\/td>\n<td>\n<p> UG <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> enp0s3 <\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p> link-local <\/p>\n<\/td>\n<td>\n<p> 0.0.0.0 <\/p>\n<\/td>\n<td>\n<p> 255.255.0.0 <\/p>\n<\/td>\n<td>\n<p> U <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> enp0s3 <\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p> 192.168.4.0 <\/p>\n<\/td>\n<td>\n<p> 0.0.0.0 <\/p>\n<\/td>\n<td>\n<p> 255.255.255.0 <\/p>\n<\/td>\n<td>\n<p> U <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> enp0s3 <\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":17,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":17,\"nbrPlacementsScanned\":17,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":674} --><\/p>\n<p> And, here&#8217;s what the columns mean: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":17,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":17,\"nbrPlacementsScanned\":17,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":714} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":true,\"currentRuleCount\":900,\"actualCount\":714,\"hasActualCountMetThreshold\":true,\"countRemainingForInjection\":186,\"nextBlockCount\":931,\"hasCountRemainingForInjectionMetThreshold\":true,\"nextCount\":1645} --><\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":17,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":17,\"nbrPlacementsScanned\":17,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":900} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":18,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":18,\"nbrPlacementsScanned\":17,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":0} --><\/p>\n<ul>\n<li><strong>Destination:<\/strong> The destination network or destination host device (if the destination is not a network). <\/li>\n<li><strong>Gateway:<\/strong> The gateway address. An asterisk &#8220;<code>*<\/code>&#8221; appears here if a gateway address is not set. <\/li>\n<li><strong>Genmask:<\/strong> The subnet mask for the route. <\/li>\n<li><strong>Flags:<\/strong> See the flags table, below. <\/li>\n<li><strong>MSS:<\/strong><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Maximum_segment_size\">Default Maximum Segment Size<\/a> for TCP connections over this route&#8212;this is the largest amount of data that can be received in one TCP segment. <\/li>\n<li><strong>Window:<\/strong> The <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/TCP_tuning#Window_size\">default window size<\/a> for TCP connections over this route, indicating the number of packets that can be transferred and received before the receiving buffer is full. In practice, the packets are consumed by the receiving application. <\/li>\n<li><strong>irtt:<\/strong> The Initial <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Round-trip_delay_time\">Round Trip Time<\/a>. This value is referenced by the kernel to make dynamic adjustments to TCP parameters for remote connections that are slow to respond. <\/li>\n<li><strong>Iface:<\/strong> The network interface from which the packets sent over this route are transmitted. <\/li>\n<\/ul>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":18,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":18,\"nbrPlacementsScanned\":18,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":745} --><\/p>\n<p> The flags value can be one of: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":18,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":18,\"nbrPlacementsScanned\":18,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":777} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":true,\"currentRuleCount\":900,\"actualCount\":777,\"hasActualCountMetThreshold\":true,\"countRemainingForInjection\":123,\"nextBlockCount\":414,\"hasCountRemainingForInjectionMetThreshold\":true,\"nextCount\":1191} --><\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":18,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":18,\"nbrPlacementsScanned\":18,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":900} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":19,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":19,\"nbrPlacementsScanned\":18,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":0} --><\/p>\n<ul>\n<li><strong>U:<\/strong> The route is up. <\/li>\n<li><strong>H:<\/strong> Target is a host and the only destination possible on this route. <\/li>\n<li><strong>G:<\/strong> Use the gateway. <\/li>\n<li><strong>R:<\/strong> Reinstate the route for dynamic routing. <\/li>\n<li><strong>D:<\/strong> Dynamically installed by the routing daemon. <\/li>\n<li><strong>M:<\/strong> Modified by the routing daemon when it received an <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Internet_Control_Message_Protocol\">Internet Control Message Protocol<\/a> (ICMP) packet. <\/li>\n<li><strong>A:<\/strong> Installed by <code>addrconf<\/code>, the automated DNS and DHCP config file generator. <\/li>\n<li><strong>C:<\/strong> Cache entry. <\/li>\n<li><strong>!:<\/strong> Reject route. <\/li>\n<\/ul>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":19,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":19,\"nbrPlacementsScanned\":19,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":291} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":19,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":19,\"nbrPlacementsScanned\":19,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":291} --><\/p>\n<h2 id=\"finding-the-port-used-by-a-process\"><span class=\"ez-toc-section\" id=\"Finding_the_Port_Used_by_a_Process\"><\/span> Finding the Port Used by a Process <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> If we pipe the output of <code>netstat<\/code> through <code>grep<\/code>, we can search for a process by name and identify the port it is using. We use the <code>-a<\/code> (all), <code>-n<\/code> (numeric) and <code>-p<\/code> (program) options used previously, and search for &#8220;sshd.&#8221; <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":19,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":19,\"nbrPlacementsScanned\":19,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":519} --><\/p>\n<pre>sudo netstat -anp | grep \"sshd\"<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":19,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":19,\"nbrPlacementsScanned\":19,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":562} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"197\" loading=\"lazy\" alt=\"sudo netstat -anp | grep &quot;sshd&quot; in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567272_651_How-to-Use-netstat-on-Linux.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567272_651_How-to-Use-netstat-on-Linux.png?resize=646%2C197&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":19,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":19,\"nbrPlacementsScanned\":19,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":802} --><\/p>\n<p> <code>grep<\/code> finds the target string, and we see that the <code>sshd<\/code> daemon is using port 22. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":19,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":19,\"nbrPlacementsScanned\":19,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":883} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":true,\"currentRuleCount\":900,\"actualCount\":883,\"hasActualCountMetThreshold\":true,\"countRemainingForInjection\":17,\"nextBlockCount\":136,\"hasCountRemainingForInjectionMetThreshold\":true,\"nextCount\":1019} --><\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":19,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":19,\"nbrPlacementsScanned\":19,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":900} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":20,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":20,\"nbrPlacementsScanned\":19,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":0} --><\/p>\n<p> Of course, we can also do this in reverse. If we search for &#8220;:22&#8221;, we can find out which process is using that port, if any. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":20,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":20,\"nbrPlacementsScanned\":20,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":119} --><\/p>\n<pre>sudo netstat -anp | grep \":22\"<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":20,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":20,\"nbrPlacementsScanned\":20,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":161} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"147\" loading=\"lazy\" alt=\"sudo netstat -anp | grep &quot;:22&quot; in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567273_341_How-to-Use-netstat-on-Linux.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567273_341_How-to-Use-netstat-on-Linux.png?resize=646%2C147&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":20,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":20,\"nbrPlacementsScanned\":20,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":401} --><\/p>\n<p> This time <code>grep<\/code> finds the &#8220;:22&#8221; target string, and we see that the process using this port is the <code>sshd<\/code> daemon, process ID 751. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":20,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":20,\"nbrPlacementsScanned\":20,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":538} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":20,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":20,\"nbrPlacementsScanned\":20,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":538} --><\/p>\n<h2 id=\"list-the-network-interfaces\"><span class=\"ez-toc-section\" id=\"List_the_Network_Interfaces\"><\/span> List the Network Interfaces <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> The <code>-i<\/code> (interfaces) option will display a table of the network interfaces that <code>netstat<\/code> can discover. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":20,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":20,\"nbrPlacementsScanned\":20,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":640} --><\/p>\n<pre>sudo netstat -i<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":20,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":20,\"nbrPlacementsScanned\":20,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":657} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"212\" loading=\"lazy\" alt=\"Kernel Interface table in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567273_17_How-to-Use-netstat-on-Linux.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567273_17_How-to-Use-netstat-on-Linux.png?resize=646%2C212&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":20,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":20,\"nbrPlacementsScanned\":20,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":897} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":true,\"currentRuleCount\":900,\"actualCount\":897,\"hasActualCountMetThreshold\":true,\"countRemainingForInjection\":3,\"nextBlockCount\":50,\"hasCountRemainingForInjectionMetThreshold\":true,\"nextCount\":947} --><\/p>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":20,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":20,\"nbrPlacementsScanned\":20,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":900} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":21,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":21,\"nbrPlacementsScanned\":20,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":true,\"actualCount\":0} --><\/p>\n<p> Here&#8217;s the output in a more legible fashion: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":21,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":21,\"nbrPlacementsScanned\":21,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":47} --><\/p>\n<p> <strong>Kernel Interface table<\/strong> <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":21,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":21,\"nbrPlacementsScanned\":21,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":71} --><\/p>\n<div class=\"table-container\">\n<table border=\"1\" cellpadding=\"1\" cellspacing=\"1\" align=\"\" summary=\"\">\n<thead>\n<tr>\n<th scope=\"col\">\n<p> Iface <\/p>\n<\/th>\n<th scope=\"col\">\n<p> MTU <\/p>\n<\/th>\n<th scope=\"col\">\n<p> RX-OK <\/p>\n<\/th>\n<th scope=\"col\">\n<p> RX-ERR <\/p>\n<\/th>\n<th scope=\"col\">\n<p> RX-DRP <\/p>\n<\/th>\n<th scope=\"col\">\n<p> RX-OVR <\/p>\n<\/th>\n<th scope=\"col\">\n<p> TX-OK <\/p>\n<\/th>\n<th scope=\"col\">\n<p> TX-ERR <\/p>\n<\/th>\n<th scope=\"col\">\n<p> TX-DRP <\/p>\n<\/th>\n<th scope=\"col\">\n<p> TX-OVR <\/p>\n<\/th>\n<th scope=\"col\">\n<p> Flg <\/p>\n<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\n<p> enp0s3 <\/p>\n<\/td>\n<td>\n<p> 1500 <\/p>\n<\/td>\n<td>\n<p> 4520671 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 4779773 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> BMRU <\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p> lo <\/p>\n<\/td>\n<td>\n<p> 65536 <\/p>\n<\/td>\n<td>\n<p> 30175 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 30175 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> 0 <\/p>\n<\/td>\n<td>\n<p> LRU <\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":21,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":21,\"nbrPlacementsScanned\":21,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":311} --><\/p>\n<p> This is what the columns mean: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":21,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":21,\"nbrPlacementsScanned\":21,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":343} --><\/p>\n<ul>\n<li><strong>Iface:<\/strong> The name of the interface. The <code>enp0s3<\/code> interface is the network interface to the outside world, and the <code>lo<\/code> interface is the loopback interface. The loopback interface enables processes to intercommunicate within the computer using networking protocols, even if the computer is not connected to a network. <\/li>\n<li><strong>MTU:<\/strong> The <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Maximum_transmission_unit\">Maximum Transmission Unit<\/a> (MTU). This is the largest &#8220;packet&#8221; that can be sent. It consists of a header containing routing and protocol flags, and other metadata, plus the data that is actually being transported. <\/li>\n<li><strong>RX-OK:<\/strong> The number of packets received, with no errors. <\/li>\n<li><strong>RX-ERR:<\/strong> The number of packets received, with errors. We want this to be as low as possible. <\/li>\n<li><strong>RX-DRP:<\/strong> The number of packets dropped (i.e., lost). We also want this to be as low as possible. <\/li>\n<li><strong>RX-OVR:<\/strong> Number of packets lost due to overflows when receiving. This usually means that the receiving buffer was full and could not accept any more data, but more data was received and had to be discarded. The lower this figure, the better, and zero is perfect. <\/li>\n<li><strong>TX-OK:<\/strong> The number of packets transmitted, with no errors. <\/li>\n<li><strong>RX-ERR:<\/strong> The number of packets transmitted, with errors. We want this to be zero. <\/li>\n<li><strong>RX-DRP:<\/strong> The number of packets dropped when transmitting. Ideally, this should be zero. <\/li>\n<li><strong>RX-OVR:<\/strong> The number of packets lost due to overflows when transmitting. This usually means the send buffer was full and could not accept any more data, but more data was was ready to be transmitted and had to be discarded. <\/li>\n<li><strong>Flg:<\/strong> Flags. See the flags table below. <\/li>\n<\/ul>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":21,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":21,\"nbrPlacementsScanned\":21,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":1879} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":22,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":22,\"nbrPlacementsScanned\":21,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<p> The flags represent the following: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":22,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":22,\"nbrPlacementsScanned\":22,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":36} --><\/p>\n<ul>\n<li><strong>B:<\/strong> A broadcast address is in use. <\/li>\n<li><strong>L:<\/strong> This interface is a loopback device. <\/li>\n<li><strong>M:<\/strong> All packets are being received (i.e., in promiscuous mode). Nothing is filtered or discarded. <\/li>\n<li><strong>O:<\/strong><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Address_Resolution_Protocol\">Address Resolution Protocol<\/a> (ARP) is turned off for this interface. <\/li>\n<li><strong>P:<\/strong> This is a <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Point-to-Point_Protocol\">Point-to-Point<\/a> (PPP) connection. <\/li>\n<li><strong>R:<\/strong> The interface is running. <\/li>\n<li><strong>U:<\/strong> The interface is up. <\/li>\n<\/ul>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":22,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":22,\"nbrPlacementsScanned\":22,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":377} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":22,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":22,\"nbrPlacementsScanned\":22,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":377} --><\/p>\n<h2 id=\"list-multicast-group-memberships\"><span class=\"ez-toc-section\" id=\"List_Multicast_Group_Memberships\"><\/span> List Multicast Group Memberships <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> Simply put, a <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/IP_multicast\">multicast transmission<\/a> enables a packet to be sent only once, regardless of the number of recipients. For services such as video streaming, for example, this increases the efficiency from the sender&#8217;s point of view by a tremendous amount. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":22,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":22,\"nbrPlacementsScanned\":22,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":635} --><\/p>\n<p> The <code>-g<\/code> (groups) option makes <code>netstat<\/code> list the multicast group membership of sockets on each interface. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":22,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":22,\"nbrPlacementsScanned\":22,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":739} --><\/p>\n<pre>sudo netstat -g<\/pre>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":22,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":22,\"nbrPlacementsScanned\":22,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":756} --><\/p>\n<div class=\"body-img landscape \">\n<div class=\"responsive-img image-expandable img-article-item\">\n<figure><img data-recalc-dims=\"1\" decoding=\"async\" width=\"646\" height=\"337\" loading=\"lazy\" alt=\"sudo netstat -g in a terminal window\" data-img-url=\"https:\/\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567273_862_How-to-Use-netstat-on-Linux.png\" src=\"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/1725567273_862_How-to-Use-netstat-on-Linux.png?resize=646%2C337&#038;ssl=1\" style=\"height:auto;max-width:100%\" title=\"\">  <\/figure>\n<\/p><\/div>\n<\/p><\/div>\n<p><!-- Repeatable debug data: {\"injection\":\"before\",\"adPosition\":22,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":22,\"nbrPlacementsScanned\":22,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":996} --><!-- Zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"after\",\"adPosition\":23,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":23,\"nbrPlacementsScanned\":22,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"isEarlyInjection\":false,\"actualCount\":0} --><br \/>\n<!-- Repeatable debug data: {\"isEarlyInjection\":false,\"currentRuleCount\":900,\"actualCount\":0,\"hasActualCountMetThreshold\":null,\"countRemainingForInjection\":null,\"nextBlockCount\":null,\"hasCountRemainingForInjectionMetThreshold\":null} --><\/p>\n<p> The columns are quite simple: <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":23,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":23,\"nbrPlacementsScanned\":23,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":31} --><\/p>\n<ul>\n<li><strong>Interface:<\/strong> The name of the interface over which the socket is transmitting. <\/li>\n<li><strong>RefCnt:<\/strong> The reference count, which is the number of processes attached to the socket. <\/li>\n<li><strong>Group:<\/strong> The name or identifier of the multicast group. <\/li>\n<\/ul>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":23,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":23,\"nbrPlacementsScanned\":23,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":248} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":23,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":23,\"nbrPlacementsScanned\":23,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":248} --><\/p>\n<h2 id=\"the-new-kids-on-the-block\"><span class=\"ez-toc-section\" id=\"The_New_Kids_on_the_Block\"><\/span> The New Kids on the Block <span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> The <a rel=\"nofollow noopener\" target=\"_blank\" href=\"http:\/\/man7.org\/linux\/man-pages\/man8\/route.8.html\">route<\/a>, <a rel=\"nofollow noopener\" target=\"_blank\" href=\"http:\/\/man7.org\/linux\/man-pages\/man8\/ip.8.html\">ip<\/a>, <a rel=\"nofollow noopener\" target=\"_blank\" href=\"http:\/\/man7.org\/linux\/man-pages\/man8\/ifconfig.8.html\">ifconfig<\/a>, and <a rel=\"nofollow noopener\" target=\"_blank\" href=\"http:\/\/man7.org\/linux\/man-pages\/man8\/ss.8.html\">ss<\/a> commands can provide a lot of what <code>netstat<\/code> is capable of showing you. They&#8217;re all great commands and worth checking out. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":23,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":23,\"nbrPlacementsScanned\":23,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":406} --><\/p>\n<p> We&#8217;ve focused on <code>netstat<\/code> because it is universally available, regardless of which Unix-like operating system you&#8217;re working on, even the obscure ones. <\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":23,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":23,\"nbrPlacementsScanned\":23,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":566} --><\/p>\n<p><!-- No repeatable ad for zone: character count repeatable. --><!-- Repeatable debug data: {\"injection\":\"none\",\"adPosition\":23,\"startingPoint\":0,\"skipEvery\":null,\"nbrPlacementFilledEachSkip\":23,\"nbrPlacementsScanned\":23,\"ruleCount\":900,\"degradationStartingPoint\":1,\"stopAds\":null,\"actualCount\":886} --><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Key Takeaways The netstat command provides information about network connections, ports in use, and the processes using them. Netsat can take arguments to filter out unneeded information and only show the specific details you&#8217;re looking for. Run sudo netstat -i to list your network interfaces. The Linux netstat command gives you a treasure-trove of information &#8230; <a title=\"How to Use netstat on Linux\" class=\"read-more\" href=\"https:\/\/goodwriterz.com\/site\/how-to-use-netstat-on-linux\/\" aria-label=\"Read more about How to Use netstat on Linux\">\u0625\u0642\u0631\u0623 \u0627\u0644\u0645\u0632\u064a\u062f<\/a><\/p>\n","protected":false},"author":1,"featured_media":51373,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[6],"tags":[42,43],"class_list":["post-51372","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","tag-linux","tag-linux-macos-terminal"],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/goodwriterz.com\/site\/wp-content\/uploads\/2024\/09\/How-to-Use-netstat-on-Linux.jpg?fit=1920%2C1080&ssl=1","jetpack_sharing_enabled":true,"jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/goodwriterz.com\/site\/wp-json\/wp\/v2\/posts\/51372","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/goodwriterz.com\/site\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/goodwriterz.com\/site\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/goodwriterz.com\/site\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/goodwriterz.com\/site\/wp-json\/wp\/v2\/comments?post=51372"}],"version-history":[{"count":0,"href":"https:\/\/goodwriterz.com\/site\/wp-json\/wp\/v2\/posts\/51372\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/goodwriterz.com\/site\/wp-json\/wp\/v2\/media\/51373"}],"wp:attachment":[{"href":"https:\/\/goodwriterz.com\/site\/wp-json\/wp\/v2\/media?parent=51372"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/goodwriterz.com\/site\/wp-json\/wp\/v2\/categories?post=51372"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/goodwriterz.com\/site\/wp-json\/wp\/v2\/tags?post=51372"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}