Network statistics: connections, routing, interfaces (legacy but still widely installed).
low risk
netstat shows network connections, routing tables, interface statistics, and more. While ss is faster and more modern, netstat is more widely installed and familiar. -tlnp is the canonical one-liner for 'what's listening on what port' on servers without ss.
| Flag | Meaning |
|---|---|
-t | TCP connections |
-u | UDP connections |
-l | Listening sockets only |
-n | Numeric (don't resolve hostnames) |
-p | Show PID/program name |
-r | Display routing table |
-i | Network interface statistics |
netstat -tlnpAll listening TCP ports with process names · explain & risk-check →netstat -an | grep :80 | wc -lCount connections to port 80 · explain & risk-check →netstat -iInterface statistics (packets, errors, drops) · explain & risk-check →netstat -rnRouting table · explain & risk-check →netstat -anp | grep TIME_WAIT | wc -lCount TIME_WAIT connections · explain & risk-check →Prefer `ss -tlnp` on modern systems — netstat reads from /proc and can be slow on systems with many connections, while ss uses kernel netlink sockets and is orders of magnitude faster.
Reference text is hand-written and may be incomplete — check man netstat for your version. Test destructive commands on a non-production system first.