If you want to obtain in­for­ma­tion about the network status using netstat commands, you only need to access the command line tool of your operating system in order to do this. In Windows, Linux, and macOS, the procedure required for this differs, as does the ap­pli­ca­tion of some netstat commands in the re­spec­tive operating system.

$1 Domain Names – Register yours today!
  • Simple reg­is­tra­tion
  • Premium TLDs at great prices
  • 24/7 personal con­sul­tant included
  • Free privacy pro­tec­tion for eligible domains

How to use the netstat network tool?

In all common operating systems, both netstat and a cor­re­spond­ing command line tool for running the network service are available by default. In Windows systems you use the well-es­tab­lished command prompt, in Linux dis­tri­b­u­tions and on Mac devices you use the terminal.

Access netstat in Windows

First use the Windows key + [R] key com­bi­na­tion. Use this shortcut to access the “Run” tool. Now type “cmd” and confirm the entry via “OK” to start the command prompt.

You can then type any netstat command directly into the command prompt and confirm with the Enter key.

Access netstat in Linux

As a Linux user, you enter netstat commands in the terminal. In the popular dis­tri­b­u­tion Ubuntu, there is a factory-assigned key com­bi­na­tion to access netstat:

[Ctrl] + [Alt] +[T]
Note

netstat is pre-installed up to Ubuntu 16.04 as part of the net-tools package. In newer versions of the Linux dis­tri­b­u­tion, you first have to install the package. To do this, execute the following command: “sudo apt-get install net-tools”.

Other dis­tri­b­u­tions like Debian do not have a shortcut by default. However, you can easily search for and launch the command line tool using the search function in the “Show ap­pli­ca­tions” menu (also works in Ubuntu). To do this, simply type “terminal”.

Once the terminal is open, you can execute the desired netstat commands.

Activate netstat in macOS

The terminal is also the command line tool of choice on Mac devices when it comes to executing netstat commands. You have two con­ve­nient options for accessing it: The Spotlight Search and the “Utilities” menu.

Using Spotlight search works as follows:

  1. Open the Spotlight Search by clicking on the mag­ni­fy­ing glass icon in the menu bar or using the key com­bi­na­tion [Cmd] + [Space].
  2. Enter “Terminal” in the search field.
  3. Start the tool by double-clicking on the cor­re­spond­ing search result.

Via the Utilities menu, start the terminal as follows:

  1. Switch to your desktop.
  2. Click on the “Go to” item in the menu bar.
  3. Select “Utilities”.
  4. Open the terminal by double-clicking on the cor­re­spond­ing entry.

These useful netstat commands are available for Windows, Linux, and Mac

Many netstat commands are ap­plic­a­ble across systems, since syntax and required pa­ra­me­ters do not differ. Here and there, however, there are dif­fer­ences in the commands in Windows, Linux, and macOS. In the following tables we have listed all the important netstat commands for the in­di­vid­ual systems.

netstat commands for Windows

[OPTION] Command De­scrip­tion  
  netstat List of all active con­nec­tions  
info netstat info Starts the netstat overview menu  
-a netstat -a Lists the open sockets in addition to active con­nec­tions  
-b netstat -b Displays the ex­e­cutable file involved in creating a con­nec­tion or listening port (listener) (requires ad­min­is­tra­tor priv­i­leges)  
-e netstat -e Ethernet sta­tis­tics (bytes received and sent, data packets, etc.)  
-f netstat -f Returns the ((fully-qualified domain name (FQDN) domains/do­main­ver­wal­tung/fqdn-fully-qualified-domain-name/)) of remote addresses
-i netstat -i Shows how long a ((TCP server/knowhow/tcp-vorgestellt/)) con­nec­tion has spent in its current state
-n netstat -n Displays addresses and port numbers nu­mer­i­cal­ly  
-o netstat -o Presents con­nec­tions with the as­so­ci­at­ed process ID in each case  
-p protocol netstat -p TCP Shows the con­nec­tions for the specified protocol, in this case TCP; also possible: ((UDP server/knowhow/udp-user-datagram-protocol/)), TCPv6, or UDPv6
-q netstat -q Lists all con­nec­tions: all listening TCP sockets/ports and all open TCP ports that are not listening  
-r netstat -r Shows the contents of the routing table  
-s netstat -s Gets sta­tis­tics about the main network protocols; default: IP, IPv6, ((ICMP server/knowhow/was-ist-das-icmp-protokoll-und-wie-funk­tion­iert-es/)), ICMPv6, TCP, TCPv6, UDP, UDPv6
-t netstat -t Shows the offload status (TCP offload to relieve the main processor) of active con­nec­tions  
-x netstat -x Informs about all con­nec­tions, listeners, and shared endpoints for Net­workDi­rect  
-y netstat -y Shows the TCP con­nec­tion templates of all active con­nec­tions  
Interval netstat -p 10 Displays the re­spec­tive sta­tis­tics again after a selected number of seconds (here 10); can be combined as desired (here with -p), [CTRL] + [C] ter­mi­nates the interval display  

netstat commands for Linux

[OPTION] Command De­scrip­tion  
  netstat List of all active con­nec­tions  
-h, --help netstat -h Accesses the netstat overview menu  
-r, --route netstat -r Shows routing table  
-i, --in­ter­faces netstat -i Displays in­for­ma­tion about the network in­ter­faces  
-g, --groups netstat -g Presents in­for­ma­tion about the in­ter­faces’ mem­ber­ship in ((multicast server/knowhow/multicast/)) groups
-s, --sta­tis­tics netstat -s Detailed network sta­tis­tics, divided by protocols (IP, TCP, UDP, ICMP, MPTCP)  
-M, --masa­que­r­ade netstat -M Listing of all currently masked IP con­nec­tions; only available if IP masking is supported by the system  
-v, --verbose netstat -v More detailed output; among other things, the netstat command outputs which address families are not con­fig­ured in the system core  
-W, --wide netstat -W Prevents IP addresses from being truncated (“IP trunking”; removing the last character block)  
-n, numeric netstat -n Outputs numeric addresses instead of resolving the host name  
--numeric-hosts netstat --numeric-hosts Host names are not resolved  
--numeric-ports netstat --numeric-ports Port names are not resolved  
--numeric-users netstat --numeric-users User names are not resolved  
-N, --symbolic netstat -N Resolves hardware names  
-e, --extend netstat -e Displays extended in­for­ma­tion, for example the user that the socket belongs to  
-p, --programs netstat -p Presents process ID and program name of the re­spec­tive socket (requires ad­min­is­tra­tor priv­i­leges)  
-o, --timers netstat -o Shows in­for­ma­tion about timers for packet sending timeouts  
-c, --con­tin­u­ous netstat -c Ensures that the desired netstat display is con­tin­u­ous­ly updated  
-l, --listening netstat -l Displays open network sockets/ports  
-a, --all netstat -a netstat command to show all sockets (connected and dis­con­nect­ed)  
-F, --fib netstat -F Shows for­ward­ing table (also called For­ward­ing In­for­ma­tion Base, FIB for short)  
-C, --cache netstat -C Presents the routing cache  
-Z, --context netstat -Z Displays the ((SELinux server/security/was-ist-selinux/)) security context for sockets
-t, --tcp netstat -t Displays only TCP sockets  
-u, --udp netstat -u Displays UDP sockets only  
-U, --udplite netstat -U Displays UDP-Lite sockets only  
-s, --sctp netstat -s Shows only ((SCTP server/knowhow/sctp-stream-control-trans­mis­sion-protocol/)) sockets
-w, --raw netstat -w Displays only RAW sockets  
-x, --unix Nnetstat -x Displays only UNIX sockets  

netstat commands for Mac

[OPTION] Command De­scrip­tion
-A netstat -A In com­bi­na­tion with the standard display; shows the addresses of all protocol control blocks connected to sockets
-a netstat -a In com­bi­na­tion with the standard display; shows the status of all sockets
-b netstat -b In com­bi­na­tion with the interface display; presents number of incoming and outgoing bytes
-c Queue netstat -c Queue In com­bi­na­tion with the queue display -q; displays in­for­ma­tion only for the queue specified in the netstat command
-d netstat -d In com­bi­na­tion with the interface display; informs about the number of dropped packets
-f address family netstat -f inet Limits sta­tis­tics or reports on address control blocks to hits with the specified address family (here: inet or IPv4); other options: inet6, unix
-g netstat -g Presents in­for­ma­tion about the in­ter­faces’ mem­ber­ship in multicast groups
-I Interface netstat -I Interface (capital i) Displays in­for­ma­tion ex­clu­sive­ly for the specified interface
-i netstat -i Displays all available, au­to­mat­i­cal­ly con­fig­ured in­ter­faces
-L netstat -L Displays the size of the different queues; number 1: rejected con­nec­tions, number 2: rejected in­com­plete con­nec­tions, number 3: maximum number of con­nec­tions in queue
-l netstat -l (small L) Pre­sen­ta­tion of the complete IPV6 address
-m netstat -m Sta­tis­tics recorded by memory man­age­ment routines
-n netstat -n Numerical display of network addresses
-p protocol netstat -p TCP Displays sta­tis­tics only for the specified protocol (here: TCP); a list of available protocols can be found in the /etc/protocols directory
-q netstat -q Displays the queue sta­tis­tics of the network interface
-r netstat -r Presents the network routing tables
-R netstat -R Gives in­for­ma­tion about the reach­a­bil­i­ty
-s netstat -s Sum­ma­rizes the in­for­ma­tion for each protocol sep­a­rate­ly; if this option is repeated, counters with a status of “0” are not con­sid­ered again
-v netstat -v More detailed report; among other things, the process ID for each open port is now displayed as well
-W netstat -W Prevents IP addresses from being truncated (“IP trunking”; removing the last character block)
-w waiting time netstat -w 30 Reprints network interface or protocol sta­tis­tics at intervals of “X” seconds (here: 30)
-x netstat -x Presents extended link layer reach­a­bil­i­ty in­for­ma­tion in addition to what is displayed via -R

netstat commands: Example

With the help of the in­di­vid­ual pa­ra­me­ters from the above tables you can check the status of the active con­nec­tions and open or closed ports and in­ter­faces in detail. Of course, you can also combine different netstat commands directly with each other, as in the following cross-system example:

netstat -an

By combining the -a and -n pa­ra­me­ters, you au­to­mat­i­cal­ly get the status of all active and inactive sockets, with all addresses rendered in numeric form.

Tip

A more detailed overview of the basics and syntax of netstat is provided in our article “In­tro­duc­tion to netstat””.

Go to Main Menu