Commands matching netstat (162)

  • Written for linux, the real example is how to produce ascii text graphs based on a numeric value (anything where uniq -c is useful is a good candidate). Show Sample Output


    52
    netstat -an | grep ESTABLISHED | awk '{print $5}' | awk -F: '{print $1}' | sort | uniq -c | awk '{ printf("%s\t%s\t",$2,$1) ; for (i = 0; i < $1; i++) {printf("*")}; print "" }'
    knassery · 2009-04-27 22:02:19 12
  • This command is more portable than it's cousin netstat. It works well on all the BSDs, GNU/Linux, AIX and Mac OS X. You won't find lsof by default on Solaris or HPUX by default, but packages exist around the web for installation, if needed, and the command works as shown. This is the most portable command I can find that lists listening ports and their associated pid. Show Sample Output


    29
    lsof -Pan -i tcp -i udp
    atoponce · 2010-06-07 15:22:44 4

  • 25
    netstat -ant | awk '{print $NF}' | grep -v '[a-z]' | sort | uniq -c
    himynameisthor · 2009-02-05 18:02:59 10
  • Command binds a set of commands to the F12 key. Feel free to alter the dashboard according to your own needs. How to find the key codes? Type read Then press the desired key (example: F5) ^[[15~ Try bind '"\e[15~"':"\"ssh su@ip-address\C-m""" or bind '"\e[16~"':"\"apachectl -k restart\C-m""" Show Sample Output


    18
    bind '"\e[24~"':"\"ps -elF;df -h;free -mt;netstat -lnpt;who -a\C-m"""
    Neo23x0 · 2009-06-21 23:57:20 75
  • It's not my code, but I found it useful to know how many open connections per request I have on a machine to debug connections without opening another http connection for it. You can also decide to sort things out differently then the way it appears in here. Show Sample Output


    18
    watch "netstat -plan|grep :80|awk {'print \$5'} | cut -d: -f 1 | sort | uniq -c | sort -nk 1"
    ik_5 · 2010-03-15 09:27:43 2
  • Particularly useful on OS X where netstat doesn't have -p option. Show Sample Output


    18
    lsof -i -P | grep -i "listen"
    patko · 2010-10-14 09:37:51 3
  • find all computer connected to my host through TCP connection. Show Sample Output


    16
    netstat -lantp | grep ESTABLISHED |awk '{print $5}' | awk -F: '{print $1}' | sort -u
    bitbasher · 2011-07-21 21:23:10 8
  • -p Tell me the name of the program and it's PID -l that is listening -u on a UDP port. -n Give me numeric IP addresses (don't resolve them) -t oh, also TCP ports Show Sample Output


    15
    netstat -plunt
    JamesGreenhalgh · 2009-02-06 06:04:32 5
  • Here is a command line to run on your server if you think your server is under attack. It prints our a list of open connections to your server and sorts them by amount. BSD Version: netstat -na |awk '{print $5}' |cut -d "." -f1,2,3,4 |sort |uniq -c |sort -nr Show Sample Output


    14
    netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
    tiagofischer · 2009-03-28 21:02:26 10

  • 14
    watch -n 1 "netstat -tpanl | grep ESTABLISHED"
    klipz · 2009-04-13 20:40:41 65
  • usefull in case of abuser/DoS attacks. Show Sample Output


    12
    netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | sed s/::ffff:// | cut -d: -f1 | sort | uniq -c | sort -n
    dt · 2009-02-15 09:16:16 3

  • 9
    netstat -ntu|awk '{print $5}'|cut -d: -f1 -s|sort|uniq -c|sort -nk1 -r
    dbiesecke · 2022-03-08 11:52:18 67
  • credit to tumblr engineering blog @ http://engineering.tumblr.com/ Show Sample Output


    8
    netstat -tn | awk 'NR>2 {print $6}' | sort | uniq -c | sort -rn
    evandrix · 2011-09-12 23:29:39 8
  • While `lsof` will work, why not use the tool designed explicitly for this job? (If not run as root, you will only see the names of PID you own) Show Sample Output


    8
    netstat -plnt
    DopeGhoti · 2011-09-30 19:56:32 0
  • See connection's tcp timers Show Sample Output


    8
    netstat -town
    ioggstream · 2012-10-08 13:10:04 34
  • This is a very powerful command line tool to gather statistics for a Linux system. http://dag.wieers.com/home-made/dstat/ Show Sample Output


    7
    dstat -ta
    vutcovici · 2009-04-02 14:19:12 5
  • Show apps that use internet connection at the moment. Can be used to discover what programms create internet traffic. Skip the part after awk to get more details, though it will not work showing only unique processes. This version will work with other languages such as Spanish and Portuguese, if the word for "ESTABLISHED" still contain the fragment "STAB"(e.g. "ESTABELECIDO") Show Sample Output


    7
    netstat -lantp | grep -i stab | awk -F/ '{print $2}' | sort | uniq
    ProMole · 2009-09-19 14:54:31 2
  • see the TIME_WAIT and ESTABLISHED nums of the network Show Sample Output


    7
    netstat -n | awk '/^tcp/ {++B[$NF]} END {for(a in B) print a, B[a]}'
    healthly · 2010-04-24 12:11:52 0
  • Displays a connection histogram of active tcp connections. Works even better under an alias. Thanks @Areis1 for sharing this one.


    7
    netstat -an | grep ESTABLISHED | awk '\''{print $5}'\'' | awk -F: '\''{print $1}'\'' | sort | uniq -c | awk '\''{ printf("%s\t%s\t",$2,$1); for (i = 0; i < $1; i++) {printf("*")}; print ""}'\''
    mramos · 2010-07-09 00:25:45 6
  • Shows updated status in a terminal window for connections to port '80' in a human-friendly form. Use 'watch -n1' to update every second, and 'watch -d' to highlight changes between updates. If you wish for status updates on a port other than '80', always remember to put a space afterwards so that ":80" will not match ":8080". Show Sample Output


    7
    watch 'netstat -anptu |egrep "^Proto|:80 "'
    Mozai · 2011-05-18 15:05:52 4
  • Uses lsof to list open network connections (file descriptors), grepping for only those in an established state


    6
    lsof -i -n | grep ESTABLISHED
    systemj · 2009-02-05 15:28:11 14
  • -p PID and name of the program -u on a UDP port. -t also TCP ports -o networking timer -n numeric IP addresses (don't resolve them) -a all sockets


    6
    netstat -putona
    starchox · 2009-02-16 19:14:35 26

  • 6
    netstat -ntauple
    luqmanux · 2009-07-02 20:18:26 4
  • The -W switch of netstat makes it print complete URL of the connections, which otherwise by default is truncated to fit its default column size. Now to compensate for irregular column sizes, pipe the output to column (-t switch of column prints in tabular form). The only downside to this part is that the very first row, the header, goes pear shape. Show Sample Output


    6
    netstat -tup -W | column -t
    b_t · 2014-01-08 22:39:01 1
  • I often have to google this so I put it here for quick reference.


    6
    netstat -np | grep -v ^unix
    UnklAdM · 2015-11-09 17:22:30 7
  •  1 2 3 >  Last ›

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands


Check These Out

Get AWS temporary credentials ready to export based on a MFA virtual appliance
You might want to secure your AWS operations requiring to use a MFA token. But then to use API or tools, you need to pass credentials generated with a MFA token. This commands asks you for the MFA code and retrieves these credentials using AWS Cli. To print the exports, you can use: `awk '{ print "export AWS_ACCESS_KEY_ID=\"" $1 "\"\n" "export AWS_SECRET_ACCESS_KEY=\"" $2 "\"\n" "export AWS_SESSION_TOKEN=\"" $3 "\"" }'` You must adapt the command line to include: * $MFA_IDis ARN of the virtual MFA or serial number of the physical one * TTL for the credentials

Get your commandlinefu points (upvotes - downvotes)
This will calculate the your commandlinefu votes (upvotes - downvotes). Hopefully this will boost my commandlinefu points.

prints message in given argument on on center of screen
$ function echox { echo `tput cup $(($(tput lines))) $(( ($(tput cols) - $(echo "${#1}"))/2 ))`"$1"`tput cup $(tput lines) $(( $(tput cols)-1 ))`; } echox prints given argument on bottom line center screen in terminal $ function echoxy { echo `tput cup $(($(tput lines)/2)) $(( ($(tput cols) - $(echo "${#1}"))/2))`"$1"`tput cup $(tput lines) $(( $(tput cols)-1 ))`; } exhoxy prints given argument center screen $ function echos { echo `tput cup $(($(tput lines)-2)) $(($(tput cols)-$(echo ${#1})))&&tput sc`"$1"`tput cup $(($(tput lines)-2)) 0 && tput rc`; } $ while [ 1 ]; do echos "`date`"; done echos prints date and time on second from last line (used as status message) you can easily use these functions by placing them in your .bashrc file, make sure to source your .bashrc once you do

View facebook friend list [hidden or not hidden]
There's no need to be logged in facebook. I could do more JSON filtering but you get the idea... Replace u=4 (Mark Zuckerberg, Facebook creator) with desired uid. Hidden or not hidden... Scary, don't you?

attach to bash shell in the last container you started

Find usb device in realtime
Using this command you can track a moment when usb device was attached.

Get AWS temporary credentials ready to export based on a MFA virtual appliance
You might want to secure your AWS operations requiring to use a MFA token. But then to use API or tools, you need to pass credentials generated with a MFA token. This commands asks you for the MFA code and retrieves these credentials using AWS Cli. To print the exports, you can use: `awk '{ print "export AWS_ACCESS_KEY_ID=\"" $1 "\"\n" "export AWS_SECRET_ACCESS_KEY=\"" $2 "\"\n" "export AWS_SESSION_TOKEN=\"" $3 "\"" }'` You must adapt the command line to include: * $MFA_IDis ARN of the virtual MFA or serial number of the physical one * TTL for the credentials

Query Wikipedia via console over DNS
Query Wikipedia by issuing a DNS query for a TXT record. The TXT record will also include a short URL to the complete corresponding Wikipedia entry.You can also write a little shell script like: $ $ cat wikisole.sh $ #!/bin/sh $ dig +short txt ${1}.wp.dg.cx and run it like $ ./wikisole.sh unix were your first option ($1) will be used as search term.

Disassemble some shell code
This one liner takes the shell code that you can grab off of the web and disassemble it into readable assembly so you can validate the code does what it says, before using it. The shell code in the above example is from http://www.shell-storm.org/shellcode/files/shellcode-623.php You can replace "-s intel" with "-s att" to get AT&T format disassembly.

From Vim, run current buffer in python


Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for: