Shows all TCP connections with no DNS resolution (show IP addresses instead).

Shows only listening sockets.

Also show PID and to which program each socket belongs, e adds extra info like the user. Run
as root to see all PIDs.

Shows network statistics.

Shows kernel routing information. This is the same output as route -e.

Shows all TCP connections with no DNS resolution (show IP addresses instead).

Shows only listening sockets.

Also show PID and to which program each socket belongs, e adds extra info like the user. Run
as root to see all PIDs.

Shows network statistics.

Shows kernel routing information. This is the same output as route -e.

Windows
[edit]

On Microsoft Windows:

To display active TCP connections and the process IDs every 5 seconds, type the
following command (works on NT based systems only, or Windows 2000 with hotfix):
netstat -o 5

To display active TCP connections and the process IDs using numerical form, type the
following command (works on NT based systems only, or Windows 2000 with hotfix):
netstat -no
*nix
[edit]

Command Explanation

Shows all sockets, both listening and non-listening, all protocols like
netstat -a
TCP, UDP etc.

netstat -at Shows only TCP connections (-au shows only UDP connections)

Shows all TCP connections with no DNS resolution (show IP addresses

netstat -ant
instead).

netstat -al Shows only listening sockets.

Also show PID and to which program each socket belongs, e adds extra
netstat -aep
info like the user. Run as root to see all PIDs.

netstat -s Shows network statistics.

netstat -r Shows kernel routing information. This is the same output as route -e.

Displays a table of all network interfaces. Add -e to get output similar to

netstat -i
ifconfig.

netstat -ct Displays TCP connections continuously.

netstat -g Display multicast group membership information for IPv4 and IPv6.

Display all services listening for TCP and UDP, all free open ports on
netstat -lntu
the local machine.
 netstat -atnp |
grep ESTA
Displays all currently "established" TCP connections.

Wildcards
[edit]

Netstat uses an asterisk * as a wildcard which means "any". An example would be

Example output:
....Local Address Foreign Address State
... *:smtp *:* LISTEN

Under "Local Address" *, in *:smtp, means the process is listening on all of the network
interfaces the machine has for the port mapped as smtp (see /etc/services for service
resolution). This can also be shown as 0.0.0.0. The first *, in *:*, means connections
can come from any IP address, and the second *, in *:*, means the connection can
originate from any port on the remote machine.

Caveats
[edit]

Some versions of netstat lack explicit field delimiters in their printf-generated output,
leading to numeric fields running together and thus corrupting the output data.

Platform specific remarks

[edit]
 The ReactOS netstat command

The macOS netstat command

Under Linux, raw data can often

Windows
[edit]

On Microsoft Windows:

To display active TCP connections and the process IDs every 5 seconds, type the
following command (works on NT based systems only, or Windows 2000 with hotfix):
netstat -o 5

To display active TCP connections and the process IDs using numerical form, type the
following command (works on NT based systems only, or Windows 2000 with hotfix):
netstat -no
*nix
[edit]

Command Explanation

Shows all sockets, both listening and non-listening, all protocols like
netstat -a
TCP, UDP etc.
 netstat -at Shows only TCP connections (-au shows only UDP connections)

Shows all TCP connections with no DNS resolution (show IP addresses

netstat -ant
instead).

netstat -al Shows only listening sockets.

Also show PID and to which program each socket belongs, e adds extra
netstat -aep
info like the user. Run as root to see all PIDs.

netstat -s Shows network statistics.

netstat -r Shows kernel routing information. This is the same output as route -e.

Displays a table of all network interfaces. Add -e to get output similar to

netstat -i
ifconfig.

netstat -ct Displays TCP connections continuously.

netstat -g Display multicast group membership information for IPv4 and IPv6.

Display all services listening for TCP and UDP, all free open ports on
netstat -lntu
the local machine.

netstat -atnp |
grep ESTA
Displays all currently "established" TCP connections.

Wildcards
[edit]

Netstat uses an asterisk * as a wildcard which means "any". An example would be

Example output:
....Local Address Foreign Address State
... *:smtp *:* LISTEN

Under "Local Address" *, in *:smtp, means the process is listening on all of the network
interfaces the machine has for the port mapped as smtp (see /etc/services for service
resolution). This can also be shown as 0.0.0.0. The first *, in *:*, means connections
can come from any IP address, and the second *, in *:*, means the connection can
originate from any port on the remote machine.

Caveats
[edit]

Some versions of netstat lack explicit field delimiters in their printf-generated output,
leading to numeric fields running together and thus corrupting the output data.

Platform specific remarks

[edit]

The ReactOS netstat command

The macOS netstat command

Under Linux, raw data can often