The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Use netstat -tuln to see TCP and UDP listening sockets with numeric addresses and ports. Add -p when you need the owning process, use -r for routes, -i for interface counters, and -s for protocol statistics. On current Linux systems, ss is the preferred socket-inspection tool: the net-tools manual calls netstat “mostly obsolete” and identifies ss as its replacement. Netstat is still worth knowing for existing scripts, older systems and troubleshooting instructions that use its familiar output.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What netstat does
netstat is a net-tools utility that reports several parts of the Linux networking subsystem. Depending on its mode, it can list open sockets, show the kernel routing table, display interface statistics, list multicast memberships, report masqueraded connections and summarize protocol counters. With no mode argument, it displays open sockets. The complete option descriptions and examples are in the netstat(8) manual (manual date May 10, 2026; upstream snapshot observed August 4, 2026).
As an Amazon Associate I earn from qualifying purchases.
It is important to separate what netstat observes from what it proves. A listening socket is a local kernel state. It does not by itself prove that a service can be reached from the public internet: the bound local address, host firewall, upstream firewall and network path also matter. Similarly, a missing process name does not prove that no process owns a socket.
Command syntax and the flags you will use most
Options can be combined in the compact form shown in the examples. Protocol selectors and display modes answer different questions, so read a command from left to right: select a protocol, select listening or all sockets, choose numeric output, then request process information if necessary.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
| Option | What it selects or changes | Typical use |
|---|---|---|
-t |
TCP sockets | netstat -tuln together with -u shows TCP and UDP listeners |
-u |
UDP sockets | Combine with -t when checking both common transport protocols |
-l |
Listening sockets | Limit the view to services waiting for connections |
-a |
Listening and non-listening sockets | netstat -tuan includes active UDP and TCP entries |
-n |
Numeric addresses and ports; suppresses name and service resolution | Use for exact output and faster, script-friendly inspection |
-p |
Owning program and process ID, where permitted | netstat -tulpn |
-r |
Routing table mode | netstat -rn prints numeric routes |
-i |
Interface statistics and counters | netstat -i |
-e |
Extended interface detail | Combine with -i when the basic counters are insufficient |
-g |
Multicast memberships | Inspect interfaces joined to multicast groups |
-s |
Protocol summary statistics | Use alone or narrow it with a protocol selector such as -t or -u |
The meanings above follow the net-tools manual. If you omit -n, netstat may resolve an address to a host name and translate a numeric port into a service name. That can make output easier to read for a person, but it can also obscure the exact value and introduce lookup delays.
Check which ports are listening
List numeric TCP and UDP listeners
Start with:
netstat -tuln
This selects TCP (-t) and UDP (-u), limits the result to listening sockets (-l) and keeps addresses and ports numeric (-n). Numeric output is usually the best first diagnostic because you can compare the displayed port directly with a configuration file, firewall rule or incident report.
Free tools Windows power users keep installed
One-click scans. No signup required.
The result normally contains a protocol column and endpoint columns such as Local Address and Foreign Address. A TCP listener may show a local address and port with a wildcard or otherwise non-specific foreign endpoint. UDP commonly has no meaningful TCP-style state value. The exact formatting varies with the net-tools build and the protocol family, so interpret the headings rather than relying on column widths.
Include process names and PIDs
When the question is “which process is listening on port 8080?”, use:
netstat -tulpn
The -p flag requests the owning program and process ID. The manual’s process-oriented example notes that listing process PIDs requires root privileges. Run the command with the appropriate administrative privileges for your system and security policy. A privileged invocation improves visibility, but the manual warns that process attribution is not fully reliable.
If the program column contains a dash or is otherwise empty, do not conclude that the port is unused. Permission restrictions, kernel-owned sockets and a process that exited while you were inspecting the table can all affect attribution. Confirm the socket with another observation and investigate the service manager or application configuration before stopping anything.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Check one port without being misled by name resolution
Netstat does not provide a dedicated “single port” option in the material documented here. Use numeric output, then filter the displayed text with a tool already present on your system if your workflow requires a single port. Keep the unfiltered command available as a baseline: filtering can hide a second listener bound to another local address or protocol.
Understand listeners versus active connections
Show every TCP and UDP socket
Add -a when you need both listening and non-listening entries:
netstat -tuan
This is useful when a client connection is active but the program is not itself listening, or when you need to see several connection states at once. The additional rows can be numerous on a busy host, so keep -n enabled for predictable numeric output.
Read the TCP state column
Local Address identifies the endpoint on the machine you queried. Foreign Address identifies the peer endpoint when a connection has one. TCP state values include ESTABLISHED and connection setup or teardown states. An ESTABLISHED row represents a currently established TCP connection; it is not the same thing as a listening socket. UDP is connectionless in the usual socket-reporting sense, so its state column commonly has no value comparable to TCP.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Use -l when your question is about services accepting new connections. Use -a when your question is about who is talking now, which peers are involved or whether connections are stuck during setup or teardown.
Find routes, interface counters and multicast memberships
Display the numeric routing table
Use:
netstat -rn
The -r mode selects routes and -n keeps gateway and destination values numeric. This is useful for checking the default route, directly connected networks and the interface selected for a destination. It reports the kernel’s route table at the time of the command; it does not test whether the next hop is reachable or whether a firewall will permit a packet.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
For new troubleshooting work, the net-tools manual maps this task to ip route. That command belongs to the modern iproute2 toolset and is the documented replacement for the route view, while netstat -rn remains useful when a runbook or installed legacy utility expects it.
Inspect interface statistics
Run:
netstat -i
This mode reports interface information and counters. Use:
netstat -ie
when you need extended detail in addition to the basic interface view. Counters can help reveal receive or transmit errors, dropped traffic or an interface that is not carrying the traffic you expected, but a counter alone does not identify the cause. Correlate it with link state, driver information, routing and application symptoms.
The manual’s modern equivalent is ip -s link. Choose it for new scripts and procedures when the target system provides iproute2; keep the netstat form in mind when reading older documentation.
Show multicast memberships
Use:
netstat -g
This selects multicast membership information. It can show which interfaces have joined multicast groups, which is useful for diagnosing discovery protocols and other multicast-dependent applications. The corresponding iproute2 command documented by net-tools is ip maddr.
Summarize protocol statistics
Run:
netstat -s
to request protocol summary statistics. Protocol selectors such as -t or -u can narrow the summary when you are investigating TCP- or UDP-specific counters; for example, netstat -st asks for the TCP-focused summary form supported by netstat’s option combinations. Treat these values as kernel counters, not as a complete application-level explanation. Capture a baseline, reproduce the problem and compare the change rather than interpreting one absolute value in isolation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Interpret the output without common mistakes
Numeric versus resolved names
Without -n, netstat may perform address and service-name resolution. A line that displays a service name instead of a number is not a different socket; it is the same endpoint rendered through a name database. Use -n when copying values into a firewall rule, comparing two snapshots or writing a parser.
A bound address determines scope
A service bound to a loopback address is local to the host, while a service bound to a specific interface address has a narrower scope than one bound to a wildcard address. Netstat shows the bind state; it does not by itself evaluate every route, firewall or upstream policy that affects reachability. Test from the relevant network location after identifying the local binding.
Do not over-trust process attribution
The -p output is permission-sensitive and the net-tools manual explicitly says attribution is not fully trustworthy. Kernel sockets may not map to an ordinary user-space process, and a process can disappear between the kernel snapshot and your inspection. Use the PID and program name as a lead for investigation, not as sole proof of ownership.
Expect different totals on busy machines
Socket tables change while you read them. Short-lived connections can appear or vanish between commands, and a second command with name resolution may take longer. Save the exact command, time and output when troubleshooting so another operator knows whether the two views were taken under comparable conditions.
Why netstat can be slow, and when to use ss
The current net-tools manual warns that listing process information for large numbers of sockets on busy servers has low performance and recommends the netlink-based ss command in that situation. It states verbatim: “This program is mostly obsolete. Replacement for netstat is ss.” That is a maintenance recommendation, not a claim that netstat suddenly stops working on every distribution.
The iproute2 ss(8) manual describes ss as a socket-statistics utility with information similar to netstat and says it can display more TCP and state information. It documents -l for listening sockets, -a for listening and non-listening sockets and -n for numeric output.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
| Question | netstat command | Modern ss form | Reason to choose |
|---|---|---|---|
| Numeric TCP and UDP listeners | netstat -tuln |
ss -ltn for TCP; add a separate UDP view when needed |
Use netstat for legacy instructions; use ss for new socket work |
| All TCP sockets | netstat -tan |
ss -t -a |
The ss manual documents this all-TCP form |
| All UDP sockets | netstat -uan |
ss -u -a |
The ss manual documents this all-UDP form |
| Process details | Add -p |
Add -p where permissions allow |
Both tools remain permission-sensitive for ownership data |
| Routes | netstat -rn |
ip route |
The net-tools manual names iproute2’s route command as the replacement |
| Interface counters | netstat -i or -ie |
ip -s link |
The iproute2 form is the documented modern equivalent |
| Multicast memberships | netstat -g |
ip maddr |
Use the command mapped by the net-tools manual |
The socket commands are not perfectly interchangeable in every output detail. The manuals support the broad comparison: ss is socket-focused, exposes more TCP and state information and is preferred when a very large socket table makes netstat slow. Netstat covers additional legacy modes such as routes, interface counters and multicast memberships, for which the ip command family is the modern choice.
A practical troubleshooting workflow
When a service should be listening
- Run
netstat -tulnto see whether a TCP or UDP socket is bound to the expected port. - Check the
Local Addressvalue. A loopback or specific-interface binding may explain why a remote client cannot connect even though the port appears. - Run
netstat -tulpnwith the privileges required to request process information, then compare the reported PID and program with the service you intended to start. - If attribution is absent, treat that as an evidence limitation rather than proof that the port is free. Check permissions, kernel-socket possibilities and whether the service exited.
- After confirming the local bind, investigate host and upstream firewall rules and test from the client network. Listening status alone does not establish public reachability.
When a host has too many connections
- Use numeric output to avoid name-service delays:
netstat -tuanfor a broad TCP/UDP view. - If the table is large or the command is slow, switch to
ss, beginning withss -ltnfor TCP listeners orss -t -aandss -u -afor all TCP or UDP sockets. - Add process details only when ownership is necessary, because permissions and the cost of enumerating many sockets can limit the result.
- Record the command and timestamp before comparing snapshots; transient connections can change between reads.
When networking looks misrouted
- Use
netstat -rnto inspect the numeric kernel route table. - Use
netstat -iornetstat -ieto compare interface counters and identify the interface carrying traffic. - For a current iproute2 workflow, use
ip routeandip -s link, the replacements documented by the net-tools manual. - If the application relies on multicast, add
netstat -gor useip maddrto check memberships.
Choosing the right command for a new script
Choose ss for new socket-inspection scripts when it is available: the current net-tools documentation identifies it as netstat’s replacement, and its netlink-based design is recommended for large, busy socket tables. Use explicit protocol, state and numeric options so the output matches the question your script is answering.
Choose netstat when you are maintaining an existing script, following a runbook that specifies its output or working on a machine where that utility is already installed. The exact package name and installation command depend on the Linux distribution and release; those details are not uniform across systems, so verify them in the target distribution’s documentation rather than copying a command intended for another release.
For route, interface-counter and multicast tasks, prefer the corresponding ip commands in new procedures. Keep the netstat forms in your operational vocabulary because they remain common in older guides and can provide a quick, familiar view during incident response.
Command checklist
netstat -tuln— numeric TCP and UDP listeners.netstat -tulpn— listeners plus requested process names and PIDs, subject to privilege and attribution limits.netstat -tuan— all numeric TCP and UDP sockets, including non-listening entries.netstat -rn— numeric routing table.netstat -i— interface counters; add-efor extended detail.netstat -g— multicast memberships.netstat -s— protocol summary statistics; narrow with a protocol selector when appropriate.ss -ltn— modern numeric TCP-listener view.ss -t -aandss -u -a— all TCP or all UDP sockets with the documented ss forms.ip route,ip -s linkandip maddr— modern replacements for netstat’s route, interface and multicast modes.
The Bottom Line
Netstat remains useful for reading legacy Linux instructions and answering quick local inspection questions, but use ss for new socket work and the ip command family for routes, interface counters and multicast memberships.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
