Network Statistics

netstat

Gives an overview of network activities and displays which ports are open or have established connections. The netstat tool is essential for discovering network problems.

Use

netstat show lists of active connections

The first list shows internet connections:
Proto – Protocol of the connection (TCP, UDP)
Recv-Q – Receive queue of bytes received or ready to be received
Send-Q – Send queue of bytes ready to be sent
Local Address – Address details and port of the local connection, an asterisk (*) in the host indicates that the server is listening and if a port is not yet established
Foreign Address– Address details and port of the remote end of the connection, an asterisk (*) appears if a port is not yet established
State – State of the local socket, most commonly ESTABLISHED, LISTENING, CLOSED or blank

The second list shows "Unix Domain" open sockets:
Proto – Protocol used by the socket (always unix)
RefCnt – Reference count of the number of attached processes to this socket
Flags – Usually ACC or blank
Type – The socket type
State – State of the socket, most often CONNECTED, LISTENING or blank
I-Node – File system inode (index node) associated with this socket
Path – System path to the socket

netstat -l list open ports
netstat -a list open ports and active connections
netstat -s show statistics for all protocols
netstat -i show interface statistics
netstat -ie show extended interface statistics

Useful Flags

-t tcp connections only
-u udp connections only
-x unix sockets only
-n numerical addresses and ports
-p display associated pid/program
-c continuous output
-r show routing table