The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Use netstat -tuln to see numeric TCP and UDP listening sockets. Add -p (usually with root privileges) to request the owning process, use -a to include established and other non-listening sockets, and switch to ss for new scripts or hosts with many sockets. This guide explains every useful mode, how to read the output, why process names can be missing, and which ip or ss command replaces each task.
What netstat does
netstat is the net-tools utility for viewing information from Linux’s networking subsystem. Depending on its mode, it prints open sockets, listening services, routing tables, interface counters, multicast memberships, masqueraded connections, or protocol statistics. With no mode argument, it displays open sockets. The netstat(8) manual documents these modes and options.
It reports local kernel state; it does not by itself prove that a service is reachable from the public internet. The bound local address, host firewall, upstream firewall, routing, and network path all affect reachability.
The commands you need first
List TCP and UDP listeners
netstat -tuln-tselects TCP sockets.-uselects UDP sockets.-llimits the result to listening sockets.-nkeeps addresses and ports numeric instead of resolving hostnames or service names.
Numeric output is normally the best starting point for troubleshooting and scripting. A line such as 0.0.0.0:22 means a service is bound to all IPv4 local addresses on port 22; 127.0.0.1:8080 is restricted to local connections. An IPv6 wildcard commonly appears as :::port.
#1 Best Overall
- Intel Core i5-1335U Processor (12M Cache, 12 Threads, up to 4.6 GHz) - 256GB Solid State Drive - 16GB DDR4 SDRAM
- 15.6" FHD (1920x1080) Non-Touch Anti-Glare Display - Intel UHD 620 Integrated Graphics - Stereo Speakers
- 720p HD Webcam with Privacy Shutter. Integrated Microphone - Intel Dual Band Wireless-AC (2x2) 8265, Bluetooth Version 4.2
- I/O Ports: 2x USB 3.0, 1x USB 3.1 Type-C 3.1, Headphone/Mic Combo Port, 4-in-1 Card Reader, HDMI, Kensington Mini-Lock Slot
- Linux Mint (Cinnamon) 64-Bit - Keyboard with Full NumberPad - Fast Charging
Show the process and PID behind a socket
sudo netstat -tulpnThe -p option requests the owning program and process ID. The manual’s process-oriented example requires root to list PIDs, so run it with appropriate privileges when you need attribution. A missing name or a dash is not proof that no process owns the socket: permissions, kernel-owned sockets, and a process exiting between sampling and display can all affect attribution. The manual also cautions that -p attribution is not fully reliable.
For the practical question “which process is listening on port 8080?”, inspect the Local Address and PID/Program name columns, then verify the process with your normal service-management or process tools before stopping anything.
Include active and non-listening sockets
netstat -tuanAdding -a includes both listening and non-listening sockets. This is useful when investigating outbound connections, established sessions, or connection setup and teardown. Keep -n when you need unambiguous numeric endpoints.
How to read netstat output
| Column | Meaning | What to check |
|---|---|---|
| Proto | Protocol, such as TCP or UDP. | Confirm you are looking at the protocol used by the application. |
| Recv-Q / Send-Q | Queued data or backlog values reported for the socket. | Persistent growth can indicate a consumer, peer, or application bottleneck; investigate with application-specific metrics. |
| Local Address | The local IP address and port. | Distinguish loopback-only, one-interface, and all-address bindings. |
| Foreign Address | The remote endpoint when one exists. | For a listener this may be a wildcard; for a connection it identifies the peer. |
| State | TCP connection state. | ESTABLISHED indicates an active TCP session; setup and teardown states show where a connection is in its lifecycle. |
| PID/Program name | Requested process ID and program name when available. | Interpret blanks or dashes in light of permissions and the manual’s attribution warning. |
UDP commonly has no meaningful value in the State column. Without -n, netstat may perform reverse-DNS lookups and translate ports to service names; slow or misleading name resolution is a common reason to prefer numeric output while diagnosing a problem.
Use the other netstat modes
Inspect the routing table
netstat -rn-r selects routes and -n keeps gateway and destination addresses numeric. Check the default route, destination, gateway, mask, and interface when a host cannot reach another network. The corresponding modern command is:
Rank #2
- Intel Core i5-10210U (up to 4.2GHz) - 1TB PCIe NVMe + 1TB HDD - 32GB DDR4 SDRAM
- 17.3" HD+ (1600x900) Display, Intel UHD Graphics 620
- Built in HD 720p Webcam with Microphone - Bluetooth Version4.2
- I/O Ports: 2x USB 3.1 (Data Only), 1x USB 2.0, 1x HDMI, 1x Headphone/Microphone Combo Jack
- Linux Mint Cinnamon 64-Bit - 6-Row Keyboard w/ Full Numberpad
ip routeInspect interfaces and counters
netstat -i
netstat -ie-i displays interfaces and counters. Add -e for extended detail. Look for the interface carrying the traffic and for receive or transmit errors, drops, or an unexpectedly low MTU, then corroborate findings with current interface tools. The net-tools manual maps this task to ip -s link.
View protocol statistics
netstat -s
netstat -st
netstat -su-s prints protocol summary statistics. Add -t or -u to narrow the summary to TCP or UDP. These counters are cumulative kernel statistics, so compare them over a known interval rather than treating one snapshot as a rate.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →List multicast memberships
netstat -g-g selects multicast memberships. The documented modern counterpart is ip maddr.
Understand -a versus -l
-lshows listeners only.-ashows listeners and non-listening sockets.- Using neither leaves the default socket view, which can include active sockets but is less explicit for a repeatable diagnostic.
Common troubleshooting procedures
Find what owns a port
- Start with numeric listeners:
netstat -tuln. - Repeat with privileges:
sudo netstat -tulpn. - Check whether the service is bound to loopback, a specific interface, or all local addresses.
- Confirm the process independently before changing its configuration or terminating it.
Investigate a connection that should not exist
- Capture all TCP and UDP sockets numerically with
netstat -tuan. - Record the local and foreign endpoints and the TCP state.
- Request process details with
sudo netstat -tuanp, recognizing that attribution may be incomplete. - Determine whether the endpoint is expected for the application, container, proxy, or monitoring agent before blocking it.
Separate a local listener problem from a network-path problem
- No listener in netstat: the application may be stopped, listening on another protocol, bound to another address, or not yet ready.
- Listener bound only to
127.0.0.1or::1: remote hosts cannot use that socket directly. - Listener bound to an external address but remote clients fail: investigate host and upstream firewalls, routing, security groups, and the return path.
- Listener appears correct but the page or API still fails: check the application protocol, TLS configuration, and service logs; netstat only reports socket state.
Why netstat can be slow or incomplete
The net-tools manual notes that listing large numbers of sockets on busy servers has low performance and recommends the netlink-based ss command in that situation. Name lookups make the delay worse, so use -n for a fast, deterministic view. Process lookup also depends on permission and can race with short-lived processes.
Do not infer that a service is absent from a blank process column, and do not infer internet exposure from a wildcard-looking line alone. Treat netstat as one observation of the kernel’s socket table.
Rank #3
- [ULTRA-RUGGED DESIGN] MIL-STD-810G and IP65 certified. Built to survive 6-foot drops, heavy rain, and extreme vibrations. Features a magnesium alloy chassis with an integrated carry handle for maximum portability
- [4G LTE - WORK ANYWHERE] Integrated 4G LTE Multi-Carrier Mobile Broadband. Stay connected to the internet in remote areas or on the road without relying on Wi-Fi or phone hotspots. True mobile freedom for field professionals
- [1200-NIT SUNLIGHT READABLE] 13.1" XGA Touchscreen with CircuLumin technology. At 1200 nits, it is nearly 4x brighter than a standard laptop, ensuring perfect visibility under direct, intense sunlight
- [LINUX UBUNTU PRE-INSTALLED] Fast, secure, and bloatware-free. Optimized for developers, network engineers, and diagnostic software that thrives in a stable, open-source environment
- [LEGACY SERIAL PORT] Features a native RS-232 Serial Port, HDMI, and USB 3.0. Essential for connecting directly to industrial machinery, CNCs, and automotive diagnostic tools without unreliable adapter
Use ss for new Linux work
The current net-tools manual says, “This program is mostly obsolete. Replacement for netstat is ss.” The iproute2 ss(8) manual describes ss as a socket-statistics utility with information similar to netstat and more TCP and state information.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Question | netstat | Modern choice |
|---|---|---|
| Numeric TCP listeners | netstat -ltn |
ss -ltn |
| All TCP sockets | netstat -ta |
ss -t -a |
| All UDP sockets | netstat -ua |
ss -u -a |
| Process details | Add -p; permissions apply |
Add -p; permissions still apply |
| Routes | netstat -r |
ip route |
| Interface statistics | netstat -i |
ip -s link |
| Multicast memberships | netstat -g |
ip maddr |
Use netstat when an existing runbook, script, or minimal rescue environment already provides it. Prefer ss for new socket-inspection scripts, especially on busy machines. Choose ip for routes, interface counters, and multicast rather than forcing netstat into a job it was not designed to perform.
Installation and portability considerations
netstat belongs to the net-tools family, while ss and ip are part of the iproute2 toolset. Exact package names and installation commands vary by distribution and release, so first check whether the command is already present and consult that distribution’s package documentation. A script should test for the required executable and provide a clear error instead of assuming netstat exists.
Output formatting, service-name databases, IPv4 versus IPv6 defaults, and permission policies can differ between systems. For automation, combine numeric options with explicit protocol selection and parse cautiously; avoid relying on column spacing or localized service names.
Or skip the browser setup
If your network investigation also requires capturing the web page that a service returns, ScreenshotNeo provides a one-request website screenshot API. It is separate from netstat: netstat inspects the host’s sockets, while ScreenshotNeo captures a URL from the web.
Recommended Free Tools
Rank #4
- THE POWER TO STAY PRODUCTIVE – Looking to make your everyday work and home life more manageable without breaking the bank? The Lenovo V15 Gen 4 offers long-term reliability with top-of-the-line features to make you your most productive self.
- CRUSH YOUR TO-DO LIST – The AMD Ryzen CPU pairs quiet performance and enhanced operating power to crush your high-demand workday. It optimizes performance and allows for seamless multitasking.
- TRUE-TO-LIFE VISUALS – The 15.6” FHD IPS display is anti-glare with 300 nits brightness to see your best outside or in. Its 88% screen-to-body ratio makes viewing detailed applications like spreadsheets a breeze.
- SEAMLESS COLLABORATION – Lenovo Smart Appearance enhances your camera effects to protect your privacy and to make you the focus of every video conference. Intelligent noise cancelation minimizes distraction and Dolby Audio provides an elegantly sonorous experience.
- BUILT TO WITHSTAND – Built for military-grade toughness, the V15 Gen 4 is tested to withstand harsh temperatures, pressure, humidity, vibrations and more. Keep your work safe from the board room to your living room and everywhere in between.
Before capture, ScreenshotNeo can accept cookie or consent banners and remove more than 60 known consent platforms, newsletter popups, and chat widgets; each step can be disabled. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed, and response headers identify the page verdict and billing result. Its MCP server exposes take_screenshot, get_page_info, and capture_pdf to Claude, Cursor, and other MCP clients.
For the complete parameter list, see the ScreenshotNeo API documentation. A basic cURL request is:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpThe same request in Python:
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)And in Node.js:
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);The Free plan includes 1,000 screenshots per month with no card. Paid plans start at $5 for 3,000 shots; every feature is available on every plan. Create a free ScreenshotNeo account.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Operational checklist
- Use
-nwhile diagnosing or scripting to avoid name-resolution delays. - Use
-lfor listeners and-awhen active connections matter. - Add
-pwith suitable privileges, but verify attribution independently. - Check the bound address before concluding that a service is remotely reachable.
- Use
netstat -rn,netstat -i,netstat -s, andnetstat -gfor their specific modes. - Prefer
ssfor new socket work andipfor routes, link counters, and multicast.
FAQ
Does netstat show firewall rules?
No. It shows sockets, routes, counters, and protocol information. Firewall policy must be examined with the firewall system used by the host and its network environment.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCan I use netstat to prove a port is open to the internet?
No. It can show that a local socket is listening and which address it is bound to, but only an appropriately located remote test establishes end-to-end reachability.
Why does a UDP line not show a TCP-style state?
UDP is connectionless, so it normally has no TCP lifecycle state to display. Interpret its local and foreign endpoint fields instead.
Best Value
- Powerful Linux Laptop: This IdeaPad Slim 3 Laptop comes pre-installed with Ubuntu Linux, offering fast performance, robust security, and a clean, user-friendly experience. Enjoy full customization, seamless hardware compatibility, and access to thousands of open-source apps. Whether you're working, creating, or coding, it's built to keep up with everything you do.
- A Multitasking Master: The latest AMD Ryzen 7 5825U processor (up to 4.5 GHz) delivers powerful performance with 8 cores and 16 threads for smooth multitasking. Integrated AMD Radeon Graphics provide crisp visuals for streaming, browsing, photo editing, and casual gaming. With smart machine intelligence, it adapts to your needs for a fast, responsive experience.
- 15.6" Full HD Display: The IdeaPad Slim 3 boasts an 88% screen-to-body ratio for a floating, edge-to-edge visual experience. TÜV Low Blue Light certification reduces eye strain, making it perfect for long work or study sessions.
- Military-Grade Durability: The smart IdeaPad Slim 3 combines portability and durability, letting you work, study, and play on the go. With a profile 10% slimmer than the previous generation, it's lightweight yet military-grade rugged, ready for anything, anywhere.
- Versatile Connectivity: Enjoy the security of a built-in webcam with a privacy shutter. Connect effortlessly with multiple ports: 2x USB A, 1x USB C, 1x HDMI, 1x SD Card Reader, 1x Headphone/Microphone combo. Bundle comes with Stylus Pen, 256GB Portable SSD and 5-in-1 Docking Station.
Should a script depend on the exact netstat columns?
Prefer a tool and output format intended for your distribution, select numeric protocols explicitly, and parse defensively. Service-name resolution, IPv4/IPv6 behavior, permissions, and formatting can vary across systems.
Frequently Asked Questions
Does netstat show firewall rules?
No. It reports socket and network-subsystem state, not firewall policy.
Free tools Windows power users keep installed
One-click scans. No signup required.
Can netstat prove a port is reachable from the internet?
No. A listening socket is only local evidence; remote reachability also depends on binding, firewalls, routing, and the network path.
Why is UDP missing a TCP-style state?
UDP is connectionless, so it normally has no TCP lifecycle state to display.
Should scripts parse netstat’s aligned columns?
Use explicit numeric and protocol options and parse defensively because formatting, name resolution, address-family behavior, and permissions vary by system.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
