Commands tagged netstat (50)
-
100lsof -P -i -n
-
for one line per process:
ss -p | catfor established sockets only:ss -p | grep STAfor just process names:ss -p | cut -f2 -sd\"orss -p | grep STA | cut -f2 -d\"53ss -p -
This command is more portable than it's cousin netstat. It works well on all the BSDs, GNU/Linux, AIX and Mac OS X. You won't find lsof by default on Solaris or HPUX by default, but packages exist around the web for installation, if needed, and the command works as shown. This is the most portable command I can find that lists listening ports and their associated pid. Show Sample Output
29lsof -Pan -i tcp -i udp -
Here is a command line to run on your server if you think your server is under attack. It prints our a list of open connections to your server and sorts them by amount. BSD Version:
netstat -na |awk '{print $5}' |cut -d "." -f1,2,3,4 |sort |uniq -c |sort -nrShow Sample Output14netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n -
While `lsof` will work, why not use the tool designed explicitly for this job? (If not run as root, you will only see the names of PID you own) Show Sample Output
8netstat -plnt -
Show apps that use internet connection at the moment. Can be used to discover what programms create internet traffic. Skip the part after awk to get more details, though it will not work showing only unique processes. This version will work with other languages such as Spanish and Portuguese, if the word for "ESTABLISHED" still contain the fragment "STAB"(e.g. "ESTABELECIDO") Show Sample Output
7netstat -lantp | grep -i stab | awk -F/ '{print $2}' | sort | uniq -
Shows updated status in a terminal window for connections to port '80' in a human-friendly form. Use 'watch -n1' to update every second, and 'watch -d' to highlight changes between updates. If you wish for status updates on a port other than '80', always remember to put a space afterwards so that ":80" will not match ":8080". Show Sample Output
7watch 'netstat -anptu |egrep "^Proto|:80 "' -
The -W switch of netstat makes it print complete URL of the connections, which otherwise by default is truncated to fit its default column size. Now to compensate for irregular column sizes, pipe the output to column (-t switch of column prints in tabular form). The only downside to this part is that the very first row, the header, goes pear shape. Show Sample Output
6netstat -tup -W | column -t -
Show TCP Listen ports sorted by number (bugs: IPV6 addresses not supported) Show Sample Output
5netstat -tlpn | sort -t: -k2 -n -
This corrects duplicate output from the previous command. Show Sample Output
4netstat -lantp | grep -i establ | awk -F/ '{print $2}' | sort | uniq -
4netstat -ntu | awk ' $5 ~ /^[0-9]/ {print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
-
3netstat -lnp
-
Fast and easy way to find all established tcp connections without using the netstat command.
2lsof -i -n | grep ESTABLISHED -
This takes all of the tab spaces, and uses column to put them into the appropriately sized table. Show Sample Output
2netstat -pnut -W | column -t -s $'\t' -
Counts TCP states from Netstat and displays in an ordered list. Show Sample Output
1netstat -an | awk '/tcp/ {print $6}' | sort | uniq -c -
1netstat -rn | grep UG | tr -s " " | cut -d" " -f2
-
Check open TCP and UDP ports Show Sample Output
1netstat -plntu -
1netstat -tn | awk '($4 ~ /:22\s*/) && ($6 ~ /^EST/) {print substr($5, 0, index($5,":"))}'
-
1netstat -tulpn
-
Same as the rest, but handle IPv6 short IPs. Also, sort in the order that you're probably looking for. Show Sample Output
1netstat -ntu | awk ' $5 ~ /^(::ffff:|[0-9|])/ { gsub("::ffff:","",$5); print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr -
Works only on Linux. Last option (n) turn name of service resolving (/etc/services) off. Show Sample Output
0netstat -ltun -
0netstat -in
-
count connections, group by IP and port
0netstat -nt | awk -F":" '{print $2}' | sort | uniq -c -
0sudo netstat|head -n2|tail -n1 && sudo netstat -a|grep udp && echo && sudo netstat|head -n2|tail -n1 && sudo netstat -a|grep tcp
-
See who is using a specific port. Especially when you're using AIX. In Ubuntu, for example, this can easily be seen with the netstat command. Show Sample Output
0netstat -Aan | grep .80 | grep -v 127.0.0.1 | grep EST | awk '{print $6}' | cut -d "." -f1,2,3,4 | sort | uniq - 1 2 >
What's this?
commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.
Check These Out
Stay in the loop…
- Follow the Tweets.
-
Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.
» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10 - Subscribe to the feeds.
-
Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):
Subscribe to the feed for:
- » all commands
- » commands with 3 up-votes (commandlinefu3)
- » commands with 10 up-votes (commandlinefu10)
- » commands tagged netstat