Commands matching netstat (161)

  • Written for linux, the real example is how to produce ascii text graphs based on a numeric value (anything where uniq -c is useful is a good candidate). Show Sample Output

    netstat -an | grep ESTABLISHED | awk '{print $5}' | awk -F: '{print $1}' | sort | uniq -c | awk '{ printf("%s\t%s\t",$2,$1) ; for (i = 0; i < $1; i++) {printf("*")}; print "" }'
    knassery · 2009-04-27 22:02:19 7
  • This command is more portable than it's cousin netstat. It works well on all the BSDs, GNU/Linux, AIX and Mac OS X. You won't find lsof by default on Solaris or HPUX by default, but packages exist around the web for installation, if needed, and the command works as shown. This is the most portable command I can find that lists listening ports and their associated pid. Show Sample Output

    lsof -Pan -i tcp -i udp
    atoponce · 2010-06-07 15:22:44 0

  • 25
    netstat -ant | awk '{print $NF}' | grep -v '[a-z]' | sort | uniq -c
    himynameisthor · 2009-02-05 18:02:59 4
  • Command binds a set of commands to the F12 key. Feel free to alter the dashboard according to your own needs. How to find the key codes? Type read Then press the desired key (example: F5) ^[[15~ Try bind '"\e[15~"':"\"ssh [email protected]\C-m""" or bind '"\e[16~"':"\"apachectl -k restart\C-m""" Show Sample Output

    bind '"\e[24~"':"\"ps -elF;df -h;free -mt;netstat -lnpt;who -a\C-m"""
    Neo23x0 · 2009-06-21 23:57:20 5
  • It's not my code, but I found it useful to know how many open connections per request I have on a machine to debug connections without opening another http connection for it. You can also decide to sort things out differently then the way it appears in here. Show Sample Output

    watch "netstat -plan|grep :80|awk {'print \$5'} | cut -d: -f 1 | sort | uniq -c | sort -nk 1"
    ik_5 · 2010-03-15 09:27:43 2
  • Particularly useful on OS X where netstat doesn't have -p option. Show Sample Output

    lsof -i -P | grep -i "listen"
    patko · 2010-10-14 09:37:51 3
  • find all computer connected to my host through TCP connection. Show Sample Output

    netstat -lantp | grep ESTABLISHED |awk '{print $5}' | awk -F: '{print $1}' | sort -u
    bitbasher · 2011-07-21 21:23:10 6
  • -p Tell me the name of the program and it's PID -l that is listening -u on a UDP port. -n Give me numeric IP addresses (don't resolve them) -t oh, also TCP ports Show Sample Output

    netstat -plunt
    JamesGreenhalgh · 2009-02-06 06:04:32 2
  • Here is a command line to run on your server if you think your server is under attack. It prints our a list of open connections to your server and sorts them by amount. BSD Version: netstat -na |awk '{print $5}' |cut -d "." -f1,2,3,4 |sort |uniq -c |sort -nr Show Sample Output

    netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
    tiagofischer · 2009-03-28 21:02:26 4

  • 14
    watch -n 1 "netstat -tpanl | grep ESTABLISHED"
    klipz · 2009-04-13 20:40:41 4
  • usefull in case of abuser/DoS attacks. Show Sample Output

    netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | sed s/::ffff:// | cut -d: -f1 | sort | uniq -c | sort -n
    dt · 2009-02-15 09:16:16 2
  • credit to tumblr engineering blog @ Show Sample Output

    netstat -tn | awk 'NR>2 {print $6}' | sort | uniq -c | sort -rn
    evandrix · 2011-09-12 23:29:39 0
  • While `lsof` will work, why not use the tool designed explicitly for this job? (If not run as root, you will only see the names of PID you own) Show Sample Output

    netstat -plnt
    DopeGhoti · 2011-09-30 19:56:32 0
  • See connection's tcp timers Show Sample Output

    netstat -town
    ioggstream · 2012-10-08 13:10:04 0
  • This is a very powerful command line tool to gather statistics for a Linux system. Show Sample Output

    dstat -ta
    vutcovici · 2009-04-02 14:19:12 1
  • Show apps that use internet connection at the moment. Can be used to discover what programms create internet traffic. Skip the part after awk to get more details, though it will not work showing only unique processes. This version will work with other languages such as Spanish and Portuguese, if the word for "ESTABLISHED" still contain the fragment "STAB"(e.g. "ESTABELECIDO") Show Sample Output

    netstat -lantp | grep -i stab | awk -F/ '{print $2}' | sort | uniq
    ProMole · 2009-09-19 14:54:31 0
  • see the TIME_WAIT and ESTABLISHED nums of the network Show Sample Output

    netstat -n | awk '/^tcp/ {++B[$NF]} END {for(a in B) print a, B[a]}'
    healthly · 2010-04-24 12:11:52 0
  • Displays a connection histogram of active tcp connections. Works even better under an alias. Thanks @Areis1 for sharing this one.

    netstat -an | grep ESTABLISHED | awk '\''{print $5}'\'' | awk -F: '\''{print $1}'\'' | sort | uniq -c | awk '\''{ printf("%s\t%s\t",$2,$1); for (i = 0; i < $1; i++) {printf("*")}; print ""}'\''
    mramos · 2010-07-09 00:25:45 2
  • Shows updated status in a terminal window for connections to port '80' in a human-friendly form. Use 'watch -n1' to update every second, and 'watch -d' to highlight changes between updates. If you wish for status updates on a port other than '80', always remember to put a space afterwards so that ":80" will not match ":8080". Show Sample Output

    watch 'netstat -anptu |egrep "^Proto|:80 "'
    Mozai · 2011-05-18 15:05:52 4
  • Uses lsof to list open network connections (file descriptors), grepping for only those in an established state

    lsof -i -n | grep ESTABLISHED
    systemj · 2009-02-05 15:28:11 0
  • -p PID and name of the program -u on a UDP port. -t also TCP ports -o networking timer -n numeric IP addresses (don't resolve them) -a all sockets

    netstat -putona
    starchox · 2009-02-16 19:14:35 4

  • 6
    netstat -ntauple
    luqmanux · 2009-07-02 20:18:26 2
  • The -W switch of netstat makes it print complete URL of the connections, which otherwise by default is truncated to fit its default column size. Now to compensate for irregular column sizes, pipe the output to column (-t switch of column prints in tabular form). The only downside to this part is that the very first row, the header, goes pear shape. Show Sample Output

    netstat -tup -W | column -t
    b_t · 2014-01-08 22:39:01 0
  • I often have to google this so I put it here for quick reference.

    netstat -np | grep -v ^unix
    UnklAdM · 2015-11-09 17:22:30 3

  • 6
    declare -a array=($(tail -n +2 /proc/net/tcp | cut -d":" -f"3"|cut -d" " -f"1")) && for port in ${array[@]}; do echo $((0x$port)); done
    andreisid · 2016-01-12 10:24:44 1
  •  1 2 3 >  Last ›

What's this? is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands

Check These Out

Google dictionary of word definitions
$ wget -qO - ",de&client=te" this does the actual google dictionary query, returns a JSON string encapsulated in some fancy tag $ sed 's/dict_api\.callbacks.id100.//' here we remove the tag beginning $ sed 's/,200,null)//' and here the tag end There are also some special characters which could cause problems with some JSON parsers, so if you get some errors, this is probably the case (sed is your friend). I laso like to trim the "webDefinitions" part, because it (sometimes) contains misleading information. $ sed 's/\,\"webDefinitions.*//' (but remember to append a "}" at the end, because the JSON string will be invalid) The output also contains links to mp3 files with pronounciation. As of now, this is only usable in the English language. If you choose other than English, you will only get webDefinitions (which are crap).

Kill all processes that listen to ports begin with 50 (50, 50x, 50xxx,...)
Run netstat as root (via sudo) to get the ID of the process listening on the desired socket. Use awk to 1) match the entry that is the listening socket, 2) matching the exact port (bounded by leading colon and end of column), 3) remove the trailing slash and process name from the last column, and finally 4) use the system(…) command to call kill to terminate the process. Two direct commands, netstat & awk, and one forked call to kill. This does kill the specific port instead of any port that starts with 50. I consider this to be safer.

Factory reset your android device via commandline.

Show drive names next to their full serial number (and disk info)

What is my ip?

Apache memory usage

Count number of Line for all the files in a directory recursively

Convert seconds to [DD:][HH:]MM:SS
Converts any number of seconds into days, hours, minutes and seconds. sec2dhms() { declare -i SS="$1" D=$(( SS / 86400 )) H=$(( SS % 86400 / 3600 )) M=$(( SS % 3600 / 60 )) S=$(( SS % 60 )) [ "$D" -gt 0 ] && echo -n "${D}:" [ "$H" -gt 0 ] && printf "%02g:" "$H" printf "%02g:%02g\n" "$M" "$S" }

monitor memory usage

Recursively compare two directories and output their differences on a readable format

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.


Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for: