The netstat Command

The netstat command displays the protocol statistics and current TCP/IP connections on the local system. Used without any switches, the netstat command shows the active connections for all outbound TCP/IP connections. In addition, several switches are available that change the type of information netstat displays. Table 5 shows the various switches available for the netstat utility.

Table 5 netstat Switches




Displays the current connections and listening ports


Displays Ethernet statistics


Lists addresses and port numbers in numerical form


Shows connections for the specified protocol


Shows the routing table


Lists per-protocol statistics


Specifies the length of time to wait before redisplaying statistics

The netstat utility is used to show the port activity for both TCP and UDP connections, showing the inbound and outbound connections. When used without switches, the netstat utility has four information headings.

  • Proto Lists the protocol being used, either UDP or TCP.

  • Local address Specifies the local address and port being used.

  • Foreign address Identifies the destination address and the port being used.

  • State Specifies whether the connection is established.

In its default usage, the netstat command shows outbound connections that have been established by TCP. The following shows a sample output from a netstat command without using any switches:

Active Connections
  Proto  Local Address          Foreign Address        State
  TCP    laptop:2848            MEDIASERVICES1:1755    ESTABLISHED
  TCP    laptop:1833    ESTABLISHED
  TCP    laptop:2858         ESTABLISHED
  TCP    laptop:2860         ESTABLISHED
  TCP    laptop:2354    ESTABLISHED
  TCP    laptop:2361    ESTABLISHED
  TCP    laptop:1114    ESTABLISHED
  TCP    laptop:1959    ESTABLISHED
  TCP    laptop:1960    ESTABLISHED
  TCP    laptop:1963    ESTABLISHED
  TCP    laptop:2870            localhost:8431         TIME_WAIT
  TCP    laptop:8431            localhost:2862         TIME_WAIT
  TCP    laptop:8431            localhost:2863         TIME_WAIT
  TCP    laptop:8431            localhost:2867         TIME_WAIT
  TCP    laptop:8431            localhost:2872         TIME_WAIT

Like any other command-line utility, they are often used with switches. The following sections provide a brief explanation of the switches and a sample output from each.