How to use the netstat command on Linux for network connections

Understanding the role of netstat

When a server shows latency or unexpected behavior, the first question an administrator asks is: what exactly is happening with the network? The netstat (network statistics) command is the classic answer to that query. It allows you to see detailed statistics about active connections, routing tables, and interfaces, serving as an X-ray of your system's communications.

In practice, netstat helps us understand who is talking to whom. By listing connections, it reveals the protocol used, such as TCP or UDP, and the status of each flow. If you need to know which ports are listening, this command is your entry-level tool, functioning almost like a simplified traffic analyzer for network diagnostics.

How to list open connections with netstat

To get useful information, just typing the command isn't enough; we need to use 'flags' or arguments that filter out excess data. The netstat -tulpn combination is the most recommended for anyone seeking to understand the current state of a Linux server. Each letter here serves a clear purpose in filtering the data we want to observe.

Here is what each argument does in practice:

• -t: Shows TCP connections (the standard protocol for stable communication).
• -u: Shows UDP connections (used for fast services like DNS or streaming).
• -l: Filters only listening ports, meaning services awaiting connections.
• -p: Displays the program name or Process ID (PID) that opened the port.
• -n: Displays numerical addresses (IPs) instead of attempting to resolve domain names, which significantly speeds up response time.

Interpreting connection states

When running the command, you will see important columns like Local Address, Foreign Address, and State. The connection state says a lot about what is happening: 'LISTEN' means a service is ready to receive connections; 'ESTABLISHED' indicates an active conversation with another machine. If you see many connections in 'TIME_WAIT', it might mean your system is processing a high load of fast connections and closing them immediately afterward.

Knowing how to identify what each state represents allows you to distinguish between normal operations and network exhaustion attacks. Furthermore, if you need to validate specific flows, you can complement your diagnostics with port testing with netcat, ensuring both the software and the transport layer are aligned.

Identifying processes consuming network bandwidth

The most powerful part of the command is the -p option. Without it, you know a port is open, but you have no idea which program is using it. With it, netstat queries the system to tell you exactly which binary is tied to that port. If you notice a strange port open, it is that specific process you need to investigate.

To search for something specific, we can combine the command with grep. For example, if you want to see if the Nginx web server is running and listening correctly, you can use the following procedure: To explore these architectural concepts further in production, see our related technical analysis on How to optimize WebP images in CSS for faster loading.

1. Open the terminal with superuser privileges to view all processes.
2. Execute the command:

   sudo netstat -tulpn | grep nginx

3. Analyze the output to confirm the IP address and the port associated with the process.

Conclusion: The power of observability

Netstat remains a survival skill for any system administrator. Although tools like ss or ip are becoming the standard, the knowledge of how netstat interprets network data is universal and applicable in almost any Linux environment, whether it's physical hardware or containers.

Mastering these basic tools is what separates an operator who just restarts services from an engineer who solves root-cause issues. By actively monitoring your ports, you not only improve security but also gain a deep understanding of the network architecture that supports your applications every day.