What is Netstat Command: Functions, Usage & Network Insights

The netstat command, short for network statistics, is an indispensable tool for network administrators, professionals, and enthusiasts alike. It unveils a wealth of information about network connections, allowing users to troubleshoot and optimize their systems for better performance.

In this article, we will delve into the intricacies of the netstat command, exploring its purpose, utility, and various options at your disposal.

Quickstart: Netstat and ss commands by OS

Windows (Command Prompt / PowerShell)

• netstat -ano | findstr LISTENING – show listening ports with PIDs.
• netstat -ano | findstr ":80" – find connections on port 80; append findstr LISTENING to show only listeners.
• netstat -s – protocol statistics.
• netstat -r – display routing table.
• netstat -ano 5 – refresh output every 5 seconds.
• powershell -NoProfile -Command "Get-NetTCPConnection -State Established | Group-Object RemoteAddress | Sort-Object Count -Descending | Select-Object -First 10 Count,Name" – top remote endpoints by number of established connections.
• PowerShell "Get-NetAdapterStatistics -Name 'Wi-Fi'" – interface byte/packet counters.

Linux (netstat and modern replacements)

On Linux, netstat belongs to the deprecated net-tools package and may not be installed by default. Prefer ss (from iproute2) for current systems.

• ss -tuln – show listening TCP/UDP sockets (replacement for netstat -tuln).
• ss -tup – include PIDs/programs (may require sudo).
• ip route – show routing table (replacement for netstat -r).
• ip -s link or netstat -i – interface counters.
• watch -n1 'ss -s' – refresh summary every second.
• ss -ant state established | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head – count established peers by remote IP.

macOS (BSD-derived)

• lsof -nP -iTCP -sTCP:LISTEN – show listening TCP ports with processes.
• lsof -nP -iTCP:80 -sTCP:LISTEN – find which process is using port 80.
• netstat -anp tcp | grep LISTEN – list TCP listeners (note: -p selects protocol on macOS).
• netstat -rn – routing table; route -n get default for default route.
• netstat -ib or netstat -I en0 -w 1 – interface counters/continuous view.
• nettop -m tcp -p – live per-connection view.

What is Netstat Command?

The netstat (short for network statistics) command is a command-line tool used for monitoring and managing network connections, interfaces, and routing tables on computer systems.

It displays valuable information related to network connections, listening ports, routing tables, and interface statistics for various network protocols such as TCP, UDP, and ICMP.

Netstat works on major operating systems, including Windows, Linux, and macOS. On Linux specifically, netstat is part of the deprecated net-tools package and may not be installed by default. For modern distributions, prefer the ss command (from iproute2) for socket information and ip for routing/interface details.

System administrators and network professionals use the netstat command to diagnose and troubleshoot network-related issues, monitor network performance, and identify potential security risks. By using different options with the netstat command, you can customize the output to display specific information relevant to your needs.

How to use netstat on Windows, Linux, and macOS?

To use the netstat command on Windows, Linux, and macOS systems, open the command prompt or terminal on your respective operating system and enter the netstat command followed by the desired options.

Here’s a brief overview of how to access the command prompt or terminal on each operating system:

1. Windows:
   • Press Win + R to open the Run dialog.
   • Type cmd and press Enter to open the Command Prompt.
2. Linux:
   • Press Ctrl + Alt + T to open the Terminal (this may vary depending on the Linux distribution).
3. macOS:
   • Press Cmd + Space to open Spotlight Search.
   • Type Terminal and press Enter to open the Terminal app.

After opening the command prompt or terminal, you can use the netstat command with various options to obtain network-related information. The options differ between operating systems.

Please note that for some commands, administrative privileges may be required. In such cases, open the command prompt or terminal with administrator/root privileges.

• On Windows, right-click on the Command Prompt in the Start menu and choose “Run as administrator.”
• On Linux and macOS, prepend the command with sudo and provide your password when prompted.

Keep in mind that the netstat command and its options may vary between operating systems, so it’s essential to refer to the specific documentation for your system.

You can also use netstat --help (Linux/macOS) or netstat /? (Windows) to view the available options and their descriptions.

Netstat Command Syntax and Options

General Syntax

The netstat command generally follows per‑OS syntax conventions. Windows supports an optional trailing interval (e.g., netstat -ano 5), Linux commonly uses -c for continuous refresh (where available), and macOS/BSD variants use -w <wait> for repeating output.

Common Options

There are several options available with the netstat command, each providing distinct insights into network activity. Some common options include:

• -a: Lists all active connections and listening ports.
• -n: Displays numerical addresses instead of resolving hostnames.
• -p: On Linux shows the PID/program (may require sudo); on macOS it selects the protocol (e.g., -p tcp).
• -r: Displays the system’s routing table.
• -s: Provides network protocol statistics.

What does Netstat do? – Practical Applications of the Netstat Command

The netstat command is used to print network connections, routing tables, interface statistics, and other network-related information on Linux and Windows systems.

Some of the main functions of netstat include:

• Displaying active TCP/UDP connections, raw IP sockets, and listening ports. This allows you to see what connections are currently established on your system and what local ports are listening for incoming connections.
• Showing network interface statistics such as the number of bytes and packets sent and received. This can be useful for basic network monitoring and performance analysis.
• Displaying the routing table, which provides details on network routes and gateways being used for outbound connectivity.
• Identifying the PROCESS ID (PID) and program name associated with each active network connection. This is important for detecting unauthorized connections or troubleshooting network issues related to a specific application.
• Monitoring incoming and outgoing traffic totals for specific network interfaces. Netstat exposes interface counters (not per‑connection throughput); for detailed bandwidth, use tools like Get-NetAdapterStatistics (Windows) or ip -s link (Linux).
• Detecting potential malware or intrusions by displaying connections to unknown hosts or unusual listening ports. Netstat is often used as a first step in investigating anomalous network activity on a system.
• Analyzing your network configuration by displaying information on IP addresses, ports, protocols, and connection states. Netstat output provides a view into how your network settings are applied at an operating system level.
• Troubleshooting connectivity issues by identifying refused connections, timeouts, or high volumes of retransmissions and errors. Netstat can be a useful tool for pinpointing network problems.

Some additional examples (for Windows):

• Display TCP and UDP connections on port 80 (HTTP):
  netstat -ano | findstr ":80" → This pipeline filters lines containing :80. To show only listeners on that port, add | findstr LISTENING.

• Show only listening ports:
  netstat -ano | findstr LISTENING
• Monitor inbound and outbound traffic on interface Wi‑Fi (PowerShell):
  PowerShell "Get-NetAdapterStatistics -Name 'Wi-Fi'"
• Sort connections (note: netstat does not expose per‑connection byte counts):
  netstat -anbo | powershell -NoP -C "$input | Sort-Object" → For throughput, use adapter statistics or performance counters.
• Continuously refresh netstat output every 5 seconds:
  netstat -ano 5
• Save netstat output to a file:
  netstat -an > connections.txt
• Filter connections for a specific PID:
  netstat -ano | findstr "PID_GOES_HERE"
• Spot remote endpoints with many established connections (PowerShell):
  powershell -NoProfile -Command "Get-NetTCPConnection -State Established | Group-Object RemoteAddress | Sort-Object Count -Descending | Select-Object -First 20 Count,Name"

For Mac and Linux:

ss -ant state established | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head

For Windows:

Get-NetTCPConnection -State Established | Group-Object -Property RemoteAddress | Sort-Object -Property Count -Descending

To run this command in your command prompt, type powershell and press Enter to switch to the PowerShell environment. Then, copy and paste the command above and press Enter to execute it.

This command retrieves TCP connections, filters them to show those with an Established state, groups the results by the remote address, and sorts the output in descending order based on the count of connections per remote address.

These are just a few examples to demonstrate the useful applications of the netstat command on Windows.

Netstat Alternatives and Complementary Tools

Netstat Alternatives

While netstat remains a widely used utility, other tools, such as ss (socket statistics) and iproute2 on Linux, offer similar functionality with additional features and improved performance.

Netstat Complementary Tools

Netstat can be supplemented with utilities like tcpdump, Wireshark, and nmap to provide a more comprehensive understanding of network activity and security.

ss vs netstat: quick mapping (Linux)

• netstat -tuln → ss -tuln
• netstat -tunap → ss -tup
• netstat -s → ss -s
• netstat -r → ip route
• netstat -i → ip -s link

Conclusion

The netstat command is an invaluable resource for anyone seeking to understand, troubleshoot, or optimize their network connections. With its multitude of options and detailed output, netstat offers a powerful means of assessing network health and identifying potential issues. In a world increasingly reliant on connectivity, mastering the netstat command—and knowing when to use modern alternatives like ss and ip—can be the key to maintaining a secure, efficient, and responsive network environment.

FAQs

• About
• Latest Posts

Afroz Ahmad

I'm Afroz, a Network Engineer and CCIE with more than 18 years of experience in Computer Networking, Data Centers, Telecom, Internet Services and ISPs. Currently, I work as a Network Designer for a leading ISP equipment vendor. I share my expertise through my blog and courses, aiming to share my knowledge and simplify complex networking concepts for both beginners and experienced professionals.

Latest posts by Afroz Ahmad (see all)

• MikroTik CRS305-1G-4S+ Review: The Ultimate Budget SFP+ Switch Guide - December 25, 2025
• 10 Best Network Switches for Home Networks in 2026 (Top Picks) - December 24, 2025
• 7 Best Budget Routers For Small Business Networks (Under $200) - December 22, 2025