DEV Community

Sovrab Roy
Sovrab Roy

Posted on

Mastering Netstat: The Linux Command That Separates Beginners from Real Infrastructure Engineers

#devops #systemdesign #cloudcomputing

In the era of Kubernetes, cloud-native architectures, and microservices, many engineers focus on high-level abstractions. But when a production server starts behaving unexpectedly, a service fails to bind to a port, or suspicious network activity appears, experienced engineers often turn to one of the most fundamental networking tools available:

netstat

Despite being considered a legacy utility on some modern Linux distributions, netstat remains one of the most valuable commands for understanding what's happening on a system in real time.

Why Netstat Still Matters

Tools come and go, but networking fundamentals remain unchanged.

Whether you're a:

  • Linux Administrator
  • DevOps Engineer
  • Site Reliability Engineer (SRE)
  • Security Analyst
  • Cloud Engineer

Understanding network connections at the operating system level is a critical skill.

Netstat provides visibility into:

  • Active network connections
  • Listening ports
  • Routing tables
  • Network interface statistics
  • Protocol-level activity

When applications fail, netstat often reveals the root cause within seconds.

1. Viewing All Active Connections 

netstat -a
Enter fullscreen mode Exit fullscreen mode

This command displays:

  • TCP connections
  • UDP connections
  • Listening sockets
  • Established sessions

Example output:

Proto Recv-Q Send-Q Local Address       Foreign Address      State
tcp        0      0 0.0.0.0:22          0.0.0.0:*            LISTEN
tcp        0      0 server:443          client:51234         ESTABLISHED
Enter fullscreen mode Exit fullscreen mode

This immediately tells you:

  • Which services are listening
  • Which clients are connected
  • The current state of each connection

2. Finding Open Listening Ports 

netstat -l
Enter fullscreen mode Exit fullscreen mode

Every open port represents an exposed service.

During infrastructure audits, this command helps answer a critical question:

What services are actually reachable from the network?

Many security incidents start with forgotten services listening on unexpected ports.

3. Displaying TCP Listening Services 

netstat -lt
Enter fullscreen mode Exit fullscreen mode

Example:

tcp   0   0 0.0.0.0:22    0.0.0.0:*   LISTEN
tcp   0   0 0.0.0.0:80    0.0.0.0:*   LISTEN
tcp   0   0 0.0.0.0:443   0.0.0.0:*   LISTEN
Enter fullscreen mode Exit fullscreen mode

From a quick glance, you can identify:

  • SSH
  • HTTP
  • HTTPS

running on the server.

4. Viewing UDP Services 

netstat -lu
Enter fullscreen mode Exit fullscreen mode

Unlike TCP, UDP does not establish persistent connections.

This command is useful for identifying services such as:

  • DNS
  • DHCP
  • NTP
  • Syslog

Understanding UDP listeners is essential when troubleshooting service discovery and time synchronization issues.

5. Identifying Which Process Owns a Port

One of the most useful commands in production environments:

netstat -tulpn
Enter fullscreen mode Exit fullscreen mode

Example:

Proto Local Address     PID/Program name
tcp   0.0.0.0:80        1245/nginx
tcp   0.0.0.0:3306      2210/mysqld
Enter fullscreen mode Exit fullscreen mode

This instantly reveals:

  • Port 80 → Nginx
  • Port 3306 → MySQL

When an application fails to start because a port is already in use, this command is often the fastest way to identify the culprit.

6. Investigating a Specific Port

Suppose your application cannot bind to port 8080.

netstat -tulpn | grep 8080
Enter fullscreen mode Exit fullscreen mode

Output:

tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN 3521/java
Enter fullscreen mode Exit fullscreen mode

Now you know exactly which process owns the port.

No guesswork required.

7. Analyzing Network Interfaces 

netstat -i
Enter fullscreen mode Exit fullscreen mode

Example:

Iface   MTU RX-OK TX-OK
eth0    1500 152345 130987
Enter fullscreen mode Exit fullscreen mode

This provides insight into:

  • Packet transmission
  • Interface errors
  • Network throughput
  • Hardware-level issues

A useful command when diagnosing networking bottlenecks.

8. Viewing the Routing Table 

netstat -rn
Enter fullscreen mode Exit fullscreen mode

Example:

Destination Gateway     Genmask
0.0.0.0     10.0.0.1    0.0.0.0
Enter fullscreen mode Exit fullscreen mode

The routing table determines how traffic leaves the server.

Misconfigured routes can cause:

  • Connectivity failures
  • Asymmetric routing
  • Unexpected latency

Understanding routing is one of the hallmarks of a strong infrastructure engineer.

9. Security and Incident Response

One of the most overlooked uses of netstat is threat hunting.

Display all active TCP connections:

netstat -antp
Enter fullscreen mode Exit fullscreen mode

Focus on established sessions:

netstat -antp | grep ESTABLISHED
Enter fullscreen mode Exit fullscreen mode

Questions worth asking:

  • Why is this server communicating with that IP?
  • Is this connection expected?
  • Does this process belong here?

Many security investigations begin with network visibility.

Understanding TCP Connection States

A mature engineer doesn't just read netstat output—they understand connection behavior.

State Meaning
LISTEN Waiting for incoming connections
ESTABLISHED Active connection
TIME_WAIT Connection recently closed
CLOSE_WAIT Remote side closed connection
SYN_SENT Connection initiation in progress
SYN_RECV Handshake underway

A large number of TIME_WAIT or CLOSE_WAIT connections can indicate application-level problems that may impact performance.

Netstat vs SS

Modern Linux distributions often recommend:

ss -tulpn
Enter fullscreen mode Exit fullscreen mode

because it is faster and more efficient.

However, experienced engineers know both tools.

Real-world environments still contain:

  • Legacy servers
  • Older distributions
  • Long-running enterprise systems

Knowing netstat remains valuable.

Final Thoughts

Junior engineers use netstat to check ports.

Intermediate engineers use it to troubleshoot services.

Senior engineers use it to understand system behavior.

Security engineers use it to investigate threats.

Infrastructure architects use it to visualize communication patterns across systems.

Netstat is not just a command—it is a window into the live network state of a machine.

"Logs tell you what happened. Metrics tell you what changed. Netstat tells you what is happening right now."

Linux #DevOps #SysAdmin #Networking #CloudComputing #SRE #Infrastructure #CyberSecurity #Netstat #LinuxAdministration #OpenSource #PlatformEngineering #TechOps #ServerManagement #CommandLine #DevTo

Top comments (0)