netstat Command Syntax, Flags & Examples: Win/Linux Reference

command netstat is the cross-platform network statistics utility that displays active TCP connections, listening ports, routing tables, and interface statistics for real-time network diagnostics.

# Windows syntax
netstat [-a] [-b] [-e] [-n] [-o] [-p <Protocol>] [-r] [-s] [<interval>]

# Linux syntax
netstat [options]

Tested on Ubuntu 22.04 with net-tools 2.10 and Windows Server 2022.

Options and Flags

Usage Examples

Example 1: Display All Listening Ports with Process Ownership

# Linux: show all listening TCP/UDP ports with PID and program name
sudo netstat -tulpn

# Windows: show all listening ports with owning PID
netstat -ano | findstr LISTEN

Critical for identifying which service is bound to a port. On Linux, -tulpn combines TCP, UDP, listening, numerical, and PID flags. On Windows, -ano shows all connections numerically with PID; pipe to findstr LISTEN isolates active listeners. Useful during port conflict resolution.

Example 2: Identify Process Binding to a Specific Port

# Linux: find which process uses port 8080
sudo netstat -tlnp | grep :8080

# Windows: find process on port 443
netstat -ano | findstr :443

When deploying a web application and port 8080 or 443 is already in use, this command isolates the offending PID. On Linux, the -p flag requires root to display process names; on Windows, -o shows PID without elevation, but -b requires admin for executable names.

Example 3: Continuous Network Connection Monitoring

# Linux: refresh active connections every 2 seconds
netstat -tuc 2

# Windows: refresh statistics every 5 seconds
netstat -e 5

Real-time monitoring of connection churn during an incident. On Linux, -c with an interval (2 seconds) provides continuous TCP/UDP output. On Windows, the trailing interval argument repeats the specified command output. Good for watching connection surges after deploying a change.

Example 4: Display Routing Table

# Linux
netstat -rn

# Windows
netstat -r

Shows the kernel IP routing table. The -n flag suppresses hostname resolution, speeding output. Compare against expected routes to detect misdirected traffic or missing static routes. Equivalent to route print on Windows and ip route on modern Linux systems.

Troubleshooting and Common Errors

# Identify the PID holding the connection
netstat -ano | grep CLOSE_WAIT
# Kill the stuck process (Windows)
taskkill /PID <PID> /F

# Windows: check port range
netsh int ipv4 show dynamicport tcp
# Linux: check and reduce TIME_WAIT via sysctl
sysctl net.ipv4.tcp_fin_timeout=15

# Verify remote reachability
ping <remote-ip>
# Check local firewall status
sudo ufw status verbose

# Count stuck connections
netstat -ano | grep FIN_WAIT | wc -l
# Adjust keepalive on Linux
sysctl net.ipv4.tcp_keepalive_time=600

# Ubuntu/Debian
sudo apt install net-tools -y
# RHEL/CentOS
sudo yum install net-tools -y

# Alternative: use ss
ss -tuln

# Re-run with sudo
sudo netstat -tulpn

Exit Codes

Note: netstat does not expose granular exit-code documentation in the official vendor pages for Windows or Linux. Codes above reflect standard Unix exit conventions and common observed behavior. For production automation, always check $? immediately after the command.

Closing Tip

For automated connection monitoring in production, replace netstat with ss on Linux and Get-NetTCPConnection on Windows for structured, scriptable output that integrates directly with monitoring pipelines.

Multi-Cloud Comparison

netstat is a local OS command running inside compute instances. No cloud provider exposes a subcommand equivalent. Cloud-native network diagnostics are handled at the VPC/subnet level through separate services.

Frequently Asked Questions

# Show only TCP listening sockets
netstat -tln

# Show all UDP sockets (including non-listening)
netstat -uan

# List all listening TCP ports with PID and process name (requires root)
sudo netstat -tlnp

# Debian/Ubuntu
sudo apt-get update && sudo apt-get install net-tools

# RHEL/CentOS/Amazon Linux 2
sudo yum install -y net-tools

# Fastest pure netstat: numeric, no DNS, only listening
sudo netstat -tulpn --numeric-hosts | grep LISTEN

# Alternatively, using ss (faster overall)
sudo ss -tulpn