Introduction

Network statistics command (NetStat) is a networking tool used for troubleshooting and configuration, that can also serve as a monitoring tool for connections over the network. Both incoming and outgoing connections, routing tables, port listening, and usage statistics are common uses for this command.

Further, it can be used to display all the socket connections (including TCP and UDP). Apart from connected sockets, it also displays the sockets that are pending connections. It is a good tool for network and system administrators.

Below is a detailed explanation of the NetStat command:

netstat

Terminal output of the netstat

The first list in the output displays active established internet connections on the computer. The following details are in the columns:

Proto – Protocol of the connection used by socket (TCP, UDP).
Recv-Q – Receive queue of bytes received or ready to be received.
Send-Q – Send queue of bytes ready to be sent.
Local address – Address details and port of the local connection. An asterisk (*) in the host indicates that the server is listening and that a port is not yet established.
Foreign address – Address and port number of the remote end of the socket.
State – State of the local socket, most commonly established, LISTENING, CLOSED or blank.

The second list shows all the active open sockets of the UNIX domain with the following details:

Proto – Protocol used by the socket (TCP, UDP).
RefCnt – Reference count of the number of attached processes to this socket.
Flags – Usually ACC and SO_WAITDATA (W) or SO_NOSPACE (N).
Type – Types of socket access.
State – State of the socket, most often state CONNECTED, LISTENING and other state are CONNECTING, DISCONNECTING, FREE, (empty), UNKNOWN.
I-Node – File system inode (index node) associated with this socket.
Path – System path to the socket.