The netstat command can be used to check network connections, routing tables, interface statistics, etc. 1. Use netstat -tuln to view TCP and UDP connections in the monitored state to help identify which services are receiving connections; 2. Use netstat -r to view the kernel routing table to troubleshoot connection problems; 3. Use netstat -i to monitor statistical information of network interfaces, such as packet loss; 4. Use grep, watch and other tools to enhance functions, but modern systems recommend using ss instead of netstat.

The netstat command shows network connections, routing tables, interface statistics, masquerade connections, and multicast memberships. It's a handy tool for checking what's happening with your system's network activity.

Check Active Network Connections

One of the most common uses of netstat is to see what active connections are open on your machine. Running something like netstat -tuln will show you TCP and UDP connections in a listening state, along with their local addresses and ports.

• -t stands for TCP
• -u for UDP
• -l lists only listening ports
• -n prevents DNS lookups (shows IPs instead of hostnames)

This can help identify which services are currently accepting connections or actively communicating.

You might see entries like:

 tcp6 0 0 :::80 :::* LISTEN

That means the web server (port 80) is listening on all IPv6 interfaces.

View Routing Table Information

Running netstat -r gives you an overview of the kernel's routing table. This is useful when troubleshooting connectivity issues or understanding how traffic is routed through the network.

You'll typically see columns like Destination, Gateway, Genmask, Flags, MSS, Window, and irtt. The Gateway column tells you where packets are being sent next — basically, your system's idea of “how to get out.”

If you're used to using ip route , this is just another way of looking at similar data but presented differently.

Monitor Network Interface Statistics

Want to know how much data has been sent or received on each interface? Try netstat -i . It gives a quick summary of packet counts, errors, and interface status.

It helps spot things like high packet loss or interface errors that might point to hardware or configuration problems. For example, if one interface shows a lot of dropped packets, it could be misconfigured or experiencing congestion.

Also, if you're debugging performance issues, seeing unusually high numbers here can be a red flag.

Combine With Other Tools for Better Insights

While netstat is powerful on its own, pairing it with tools like grep , awk , or even watch can make it more useful.

For example:

• watch netstat -tulnp lets you monitor changes over time
• netstat -antp | grep :22 filters SSH connections
• netstat -s gives you detailed protocol statistics

Keep in mind that on modern Linux systems, ss (socket statistics) is often recommended as a faster alternative. But knowing netstat still comes in handy, especially on older systems or when reading legacy documentation.

Basically that's it.

The above is the detailed content of What does the netstat command show?. For more information, please follow other related articles on the PHP Chinese website!