Linux Networking: netstat (Network Statistics) Examples on Linux

Linux Networking: Network Statistics Examples on Linux

Monitoring network activity is a crucial part of managing Linux systems, whether for performance tuning or troubleshooting connectivity issues. In this article, we’ll explore various examples and commands to check network statistics on Linux, providing insights into traffic, bandwidth, and connections to help you stay in control of your network.

Introduction

The netstat (Network Statistics) command is a powerful network utility available on Linux that provides a variety of network-related information. This tool is essential for network administrators and users who need to monitor and troubleshoot network connections.

Prerequisites

• Sudo Privileges
  • You should have a user account with administrative (sudo) privileges. Certain options in netstat may require elevated permissions.
• Install netstat Utility
  • The netstat command is part of the net-tools package, which is not pre-installed in modern Ubuntu versions. Install it with the following commands:

sudo apt update
sudo apt install net-tools

Display Active Connections

The netstat command provides details about the network connections, routing tables, interface statistics, masquerade connections, and multicast memberships. Here’s an explanation of a typical output section:

netstat

Output:

Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp6       0     64 nginx:ssh               _gateway:62720          ESTABLISHED
Active UNIX domain sockets (w/o servers)

Breakdown of the Output

• Proto: The protocol (e.g., tcp, udp, or tcp6 for IPv6).
• Recv-Q: The number of bytes not yet copied by the receiving process.
• Send-Q: The number of bytes not yet acknowledged by the remote host.
• Local Address: The local address and port number (e.g., 192.168.10.10:22).
• Foreign Address: The remote address and port number (e.g., 192.168.34.22:54124).
• State: The connection state (e.g., ESTABLISHED, LISTEN, CLOSE_WAIT).
• PID/Program name: The PID and program name associated with the socket.

Show Network Interfaces

The netstat -i command shows a list of network interfaces and their statistics.

netstat -i

Output:

Kernel Interface table
Iface             MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
enp0s3           1500     1695      0      0 0           449      0      0      0 BMRU
lo              65536      142      0      0 0           142      0      0      0 LRU

Display Routing Table

The netstat -r command displays the kernel’s routing table, providing information about how data is routed through the network. Below is an example output and explanation of its components:

netstat -r

Output:

Display Listening Ports

The netstat -l command shows all the currently listening ports on the system. It provides details about services waiting for incoming connections.

netstat -l

This command lists all listening ports. For a detailed view, including TCP and UDP ports, use:

netstat -ltu

Show Network Statistics

The netstat -s command provides a summary of statistics for various network protocols. It breaks down data for TCP, UDP, ICMP, IP, and more.

netstat -s

Find a Specific Port

netstat -an | grep <port_number>

Viewing Listening Services

netstat -tuln

This command lists all the listening services along with their respective ports in numeric form.

More examples how to use netstat command you can find at the link.

defencedev.com