Skip to content
Search

Netstat

lastmod 2025-12-26created 2014-11-0424 edits

Lets you check the network status.

Categories

Options

State filtering:

  • -a - Print all states
  • -l - Listen state

Filtering and adjusting output fields:

  • -n - Number of port. Print well-known ports as numbers instead of names.
  • -t - TCP
  • -t4 - IPv4 TCP
  • -t6 - IPv6 TCP
  • -u - UDP
  • -p - Program name / PID

Separate output modes:

  • -i - Check the number of normal/error/dropped sent and received packets per Ethernet card
  • -r - Routing table
  • -s - Network statistics

List of State

State

Description

CLOSED

The connection is completely terminated

CLOSING

Uncommon; mainly when an acknowledgment message was lost in transit

CLOSE_WAIT

The TCP connection is waiting for connection termination from the upper application level

ESTABLISHED

Acknowledged. A session connection has been established between server and client and communication is taking place (the client received the server's SYN and the session is connected)

FIN_WAIT1

The client has requested the server to close the connection (FIN sent)

FIN_WAIT2

The server is waiting for the connection termination response from the client (after the server first receives FIN from the client and sends ACK to the client

LAST_ACK

The host is waiting for the remote host to acknowledge the connection termination request (state after the server sends FIN to the client)

LISTEN

The server daemon is up and waiting for connection requests from clients

SYN_SENT

(SYN signal sent) The client has requested a connection to the server

SYN_RECEIVED

The server received a connection request (SYN) from the client and responded to the client (SYN/ACK), but has not yet received the acknowledgment message (ACK) from the client.
<strong style="color:red;">(If there are a great many SYN_RECV, it may be a TCP SYN Flooding attack)

TIME_WAIT

The connection is terminated but the socket is kept open for a while; about 1 minute, and it disappears after that time

UNKNOWN

The socket state is unknown

Windows

Notes on how to use netstat on Windows.

Check the process using a specific Port

Check the PID of port 8080: 

$ netstat -ano | find "8080"

Find the process whose PID is 2952 

$ tasklist /FI "PID eq 2952"

Stop the process on that port (task kill) 

$ for /f "tokens=5" %p in (' netstat -ano ^| find ":8080" ') do taskkill /F /PID %p

How to directly check the process using that port (task list) 

$ for /f "tokens=5" %p in (' netstat -ano ^| find ":8080" ') do tasklist /FI "PID eq %p"

Unix

Notes on how to use netstat on Unix.

Check connected users 

## LISTEN 되는 모든 포트
$ netstat -l
## 또는
$ netstat -nap | grep LISTEN
## 모든 서비스 동시 접속자 수
$ netstat -nap | grep ESTABLISHED | wc -l
## 웹 동시 접속자 수
$ netstat -nap | grep :80 | grep ESTABLISHED | wc -l
## 웹서버 커넥션수 체크
$ netstat -n|grep -F :80|egrep '(ESTAB|SYN)'|awk '{print $5}'|sed 's/:[0-9]*//'|sort -u|wc -l
## Active Internet connections (only servers)
$ netstat -tulpn

What "@" means

See Unix Domain Socket#Abstract Domain Socket.

See also

Favorite site

References

  1. How_to_check_route_table.pdf ↩

author Zer0 sitemap