Netstat

netstat– to display TCP/UDP connections/interface statistics/routing table

By default, this command displays all open sockets only.

Options:

-r: to display routing table

-g: to display multicast group

-i : to display all network interfaces

-s: to display IP, ICMP, TCP, UDP statistics

-n: to show numeric address

-c: to display the output continuously

-p: to display which program opens the sockets

-l: to show only listening sockets

-a: to show all sockets

<number>: to display the interface after ‘number’ sec delay

Outputs states:

ESTABLISHED – the TCP connection is established.

LISTEN – The socket is listening on that port#

CLOSED – the connections is closed

SYN_SENT, SYN_RECV,FIN_WAIT1,FIN_WAIT1 – States when SYN/FIN messages are sent to open/close the connection

• “cat /etc/protocols” displays all port number – protocol mapping.
• All outputs are taken from specific file in “/proc/net” folder