Commands matching netstat (161)

  • Written for linux, the real example is how to produce ascii text graphs based on a numeric value (anything where uniq -c is useful is a good candidate). Show Sample Output


    52
    netstat -an | grep ESTABLISHED | awk '{print $5}' | awk -F: '{print $1}' | sort | uniq -c | awk '{ printf("%s\t%s\t",$2,$1) ; for (i = 0; i < $1; i++) {printf("*")}; print "" }'
    knassery · 2009-04-27 22:02:19 7
  • This command is more portable than it's cousin netstat. It works well on all the BSDs, GNU/Linux, AIX and Mac OS X. You won't find lsof by default on Solaris or HPUX by default, but packages exist around the web for installation, if needed, and the command works as shown. This is the most portable command I can find that lists listening ports and their associated pid. Show Sample Output


    29
    lsof -Pan -i tcp -i udp
    atoponce · 2010-06-07 15:22:44 0

  • 25
    netstat -ant | awk '{print $NF}' | grep -v '[a-z]' | sort | uniq -c
    himynameisthor · 2009-02-05 18:02:59 6
  • Command binds a set of commands to the F12 key. Feel free to alter the dashboard according to your own needs. How to find the key codes? Type read Then press the desired key (example: F5) ^[[15~ Try bind '"\e[15~"':"\"ssh su@ip-address\C-m""" or bind '"\e[16~"':"\"apachectl -k restart\C-m""" Show Sample Output


    18
    bind '"\e[24~"':"\"ps -elF;df -h;free -mt;netstat -lnpt;who -a\C-m"""
    Neo23x0 · 2009-06-21 23:57:20 28
  • It's not my code, but I found it useful to know how many open connections per request I have on a machine to debug connections without opening another http connection for it. You can also decide to sort things out differently then the way it appears in here. Show Sample Output


    18
    watch "netstat -plan|grep :80|awk {'print \$5'} | cut -d: -f 1 | sort | uniq -c | sort -nk 1"
    ik_5 · 2010-03-15 09:27:43 2
  • Particularly useful on OS X where netstat doesn't have -p option. Show Sample Output


    18
    lsof -i -P | grep -i "listen"
    patko · 2010-10-14 09:37:51 3
  • find all computer connected to my host through TCP connection. Show Sample Output


    16
    netstat -lantp | grep ESTABLISHED |awk '{print $5}' | awk -F: '{print $1}' | sort -u
    bitbasher · 2011-07-21 21:23:10 6
  • -p Tell me the name of the program and it's PID -l that is listening -u on a UDP port. -n Give me numeric IP addresses (don't resolve them) -t oh, also TCP ports Show Sample Output


    15
    netstat -plunt
    JamesGreenhalgh · 2009-02-06 06:04:32 2
  • Here is a command line to run on your server if you think your server is under attack. It prints our a list of open connections to your server and sorts them by amount. BSD Version: netstat -na |awk '{print $5}' |cut -d "." -f1,2,3,4 |sort |uniq -c |sort -nr Show Sample Output


    14
    netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
    tiagofischer · 2009-03-28 21:02:26 5

  • 14
    watch -n 1 "netstat -tpanl | grep ESTABLISHED"
    klipz · 2009-04-13 20:40:41 4
  • usefull in case of abuser/DoS attacks. Show Sample Output


    12
    netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | sed s/::ffff:// | cut -d: -f1 | sort | uniq -c | sort -n
    dt · 2009-02-15 09:16:16 2
  • credit to tumblr engineering blog @ http://engineering.tumblr.com/ Show Sample Output


    8
    netstat -tn | awk 'NR>2 {print $6}' | sort | uniq -c | sort -rn
    evandrix · 2011-09-12 23:29:39 1
  • While `lsof` will work, why not use the tool designed explicitly for this job? (If not run as root, you will only see the names of PID you own) Show Sample Output


    8
    netstat -plnt
    DopeGhoti · 2011-09-30 19:56:32 0
  • See connection's tcp timers Show Sample Output


    8
    netstat -town
    ioggstream · 2012-10-08 13:10:04 7
  • This is a very powerful command line tool to gather statistics for a Linux system. http://dag.wieers.com/home-made/dstat/ Show Sample Output


    7
    dstat -ta
    vutcovici · 2009-04-02 14:19:12 1
  • Show apps that use internet connection at the moment. Can be used to discover what programms create internet traffic. Skip the part after awk to get more details, though it will not work showing only unique processes. This version will work with other languages such as Spanish and Portuguese, if the word for "ESTABLISHED" still contain the fragment "STAB"(e.g. "ESTABELECIDO") Show Sample Output


    7
    netstat -lantp | grep -i stab | awk -F/ '{print $2}' | sort | uniq
    ProMole · 2009-09-19 14:54:31 0
  • see the TIME_WAIT and ESTABLISHED nums of the network Show Sample Output


    7
    netstat -n | awk '/^tcp/ {++B[$NF]} END {for(a in B) print a, B[a]}'
    healthly · 2010-04-24 12:11:52 0
  • Displays a connection histogram of active tcp connections. Works even better under an alias. Thanks @Areis1 for sharing this one.


    7
    netstat -an | grep ESTABLISHED | awk '\''{print $5}'\'' | awk -F: '\''{print $1}'\'' | sort | uniq -c | awk '\''{ printf("%s\t%s\t",$2,$1); for (i = 0; i < $1; i++) {printf("*")}; print ""}'\''
    mramos · 2010-07-09 00:25:45 3
  • Shows updated status in a terminal window for connections to port '80' in a human-friendly form. Use 'watch -n1' to update every second, and 'watch -d' to highlight changes between updates. If you wish for status updates on a port other than '80', always remember to put a space afterwards so that ":80" will not match ":8080". Show Sample Output


    7
    watch 'netstat -anptu |egrep "^Proto|:80 "'
    Mozai · 2011-05-18 15:05:52 4
  • Uses lsof to list open network connections (file descriptors), grepping for only those in an established state


    6
    lsof -i -n | grep ESTABLISHED
    systemj · 2009-02-05 15:28:11 8
  • -p PID and name of the program -u on a UDP port. -t also TCP ports -o networking timer -n numeric IP addresses (don't resolve them) -a all sockets


    6
    netstat -putona
    starchox · 2009-02-16 19:14:35 7

  • 6
    netstat -ntauple
    luqmanux · 2009-07-02 20:18:26 2
  • The -W switch of netstat makes it print complete URL of the connections, which otherwise by default is truncated to fit its default column size. Now to compensate for irregular column sizes, pipe the output to column (-t switch of column prints in tabular form). The only downside to this part is that the very first row, the header, goes pear shape. Show Sample Output


    6
    netstat -tup -W | column -t
    b_t · 2014-01-08 22:39:01 0
  • I often have to google this so I put it here for quick reference.


    6
    netstat -np | grep -v ^unix
    UnklAdM · 2015-11-09 17:22:30 5

  • 6
    declare -a array=($(tail -n +2 /proc/net/tcp | cut -d":" -f"3"|cut -d" " -f"1")) && for port in ${array[@]}; do echo $((0x$port)); done
    andreisid · 2016-01-12 10:24:44 17
  •  1 2 3 >  Last ›

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands


Check These Out

use vim to get colorful diff output
:q to quit

Mount SMB share with password containing special characters
If the password for the share your trying to mount contains special characters you can use URL escape characters. The above command uses an example as follows: username: user password: p@ss URL Encoded password: p%40ss All credit goes to Richard York: http://www.smilingsouls.net/Blog/20110526100731.html Also check out this URL Decoder/Encoder to convert your passwords. http://meyerweb.com/eric/tools/dencoder/

Find top 10 largest files in /var directory (subdirectories and hidden files included )
Should work even when very large files exist.

Multi line grep using sed and specifying open/close tags
Working with log files that contains variable length messages wrapped between open and close tags it may be useful to filter the messages upon a keyword. This works fine with GNU sed version 4.2 or higher, so pay attention to some unix distros (solaris, hp-ux, etc.). Linux should be ok.

Prints any IP out of a file

Symlink all files from a base directory to a target directory
Symlinks all files in the base directory to the target directory then lists all of the created symlinks.

Get AWS temporary credentials ready to export based on a MFA virtual appliance
You might want to secure your AWS operations requiring to use a MFA token. But then to use API or tools, you need to pass credentials generated with a MFA token. This commands asks you for the MFA code and retrieves these credentials using AWS Cli. To print the exports, you can use: `awk '{ print "export AWS_ACCESS_KEY_ID=\"" $1 "\"\n" "export AWS_SECRET_ACCESS_KEY=\"" $2 "\"\n" "export AWS_SESSION_TOKEN=\"" $3 "\"" }'` You must adapt the command line to include: * $MFA_IDis ARN of the virtual MFA or serial number of the physical one * TTL for the credentials

Recursive find and replace file extension / suffix (mass rename files)
Find recursively all files in ~/Notes with the extension '.md' and pipe that via xargs to rename command, which will replace every '.md' to '.txt' in this example (existing files will not be overwritten).

return external ip
Get your ip address, hostname, ASN and geolocation information. If you want just one field as a text response you can also get that,eg curl ipinfo.io/ip

Get AWS temporary credentials ready to export based on a MFA virtual appliance
You might want to secure your AWS operations requiring to use a MFA token. But then to use API or tools, you need to pass credentials generated with a MFA token. This commands asks you for the MFA code and retrieves these credentials using AWS Cli. To print the exports, you can use: `awk '{ print "export AWS_ACCESS_KEY_ID=\"" $1 "\"\n" "export AWS_SECRET_ACCESS_KEY=\"" $2 "\"\n" "export AWS_SESSION_TOKEN=\"" $3 "\"" }'` You must adapt the command line to include: * $MFA_IDis ARN of the virtual MFA or serial number of the physical one * TTL for the credentials


Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for: