Insight: Diving into Network Connections with the Linux netstat Command

Insight: Diving into Network Connections with the Linux netstat Command

Welcome, Ubuntu explorers! As you venture deeper into the world of Linux, you'll discover powerful tools that give you incredible insight into your system. Today, we're going to explore one of these essential utilities: the netstat command. Think of it as your window into the network activity happening on your Ubuntu machine.

What Exactly Does netstat Do?

At its core, netstat (short for network statistics) displays information about network connections, routing tables, interface statistics, masquerade connections, and multicast1 memberships. In simpler terms, it helps you see:

• What network connections your computer is currently making or listening for.
• Which programs are associated with those connections.
• The status of your network interfaces (like your Wi-Fi or Ethernet card).
• How network traffic is being routed.

While newer tools like ss are gradually becoming more common, netstat is still widely used and understanding it can be incredibly beneficial.

Getting Started: Basic Usage

Open up your Ubuntu terminal (you can usually do this by pressing Ctrl+Alt+T). The simplest way to run netstat is to just type:

Bash

netstat   

This will give you a list of active internet connections. You'll likely see columns like:

• Proto: The protocol being used (e.g., tcp, udp).
• Local Address: The IP address and port number your computer is using for the connection.
• Foreign Address: The IP address and port number of the remote computer you're connected to.
• State: The status of the connection (e.g., ESTABLISHED, LISTEN).

Unlocking More Information with Options

The real power of netstat comes from its various options. Here are a few of the most useful for beginners:

-n (Numeric): This option tells netstat to display IP addresses and port numbers numerically, rather than trying to resolve hostnames. This can be faster and more direct.

Bash

netstat -n   

-a (All): This shows all listening sockets and established connections. Listening sockets are used by programs waiting for incoming connections.

Bash

netstat -a   

-t (TCP) and -u (UDP): These options allow you to filter the output to show only TCP or UDP connections, respectively.

Bash

netstat -t netstat -u  

-l (Listening): This displays only listening sockets. It's useful for seeing which services are waiting for incoming connections on your system.

Bash

netstat -l   

-p (Program): This is a very handy option that shows the process ID (PID) and the name of the program associated with each network connection. You'll likely need to use sudo with this option as it often requires elevated privileges.

Bash

sudo netstat -p   

-r (Routing Table): This displays the kernel's routing table, which determines how network packets are directed.

Bash

netstat -r   

-i (Interfaces): This shows statistics for each network interface, such as the number of packets received and transmitted.

Bash

netstat -i   

Putting It All Together: Practical Examples

Let's look at a few scenarios where netstat can be helpful:

Finding the program using a specific port: Suppose you know a service is running on port 8080, and you want to know which program it is. You could use:

Bash

sudo netstat -tulnp | grep :8080   

Here, we're using -tulnp to show TCP and UDP listening sockets with program information and then using grep to filter the output for port 8080.


Checking active TCP connections: To see all established TCP connections:

Bash

netstat -at   

Viewing network interface statistics: To see how much traffic is going through your Wi-Fi interface (let's say it's named wlan0):

Bash

netstat -i | grep wlan0   

A Stepping Stone to Network Understanding

The netstat command is a powerful tool in your Ubuntu arsenal. While it might seem a bit daunting at first, experimenting with the different options and understanding the output will give you valuable insights into how your system interacts with the network. Keep practicing, and you'll be a network navigation expert in no time!

Further Exploration

As you become more comfortable, you might want to explore the ss command, which offers similar functionality and is often considered more modern and efficient. However, the knowledge you gain from understanding netstat will serve you well regardless of the specific tool you use.

Happy exploring!

Need Ubuntu Expertise?

We'd love to help you with your Ubuntu projects.  Feel free to reach out to us at info@pacificw.com.

Written by Aaron Rose, software engineer and technology writer at Tech-Reader.blog.