netstat
Networking
Usage
netstat -tulpn | netstat -anThe old way to see sockets and the routing table; on Linux it has been handed over to ss and is often not installed at all, and although macOS keeps it, it cannot tell you which process owns a socket, so lsof answers that.
Common flags
| Flag | Meaning |
|---|---|
| -tulpn | The Linux combination: TCP, UDP, listening, with process, numeric. |
| -an | All sockets, numeric. The form that also works on macOS/BSD. |
| -r | Routing table; add -n to keep it numeric. |
| -i | Per-interface packet and error counters. |
| -s | Protocol statistics, useful for retransmit counts. |
| -v -p tcp | macOS/BSD: verbose, one protocol. macOS cannot map sockets to processes at all. |
Examples
sudo netstat -tulpnListening ports with their processes (Linux, needs root for -p).
netstat -an | grep LISTENThe listening list on macOS, where -p means something else.
netstat -rnThe routing table on either platform.
When a connection fails, these narrow down how far it got — name not resolving, no route, or a blocked port.
How to read this
- Square brackets [ ] mark a part you may leave out.
- An ellipsis … means you can list more than one.
- Flags are case-sensitive — in some commands -r and -R do different things.
Questions
Q. What does netstat do?
The old way to see sockets and the routing table; on Linux it has been handed over to ss and is often not installed at all, and although macOS keeps it, it cannot tell you which process owns a socket, so lsof answers that.
Q. How do I type it?
netstat -tulpn | netstat -an — square brackets mark the parts you can leave out.
Q. How many flags are worth knowing?
6 are listed here; the full set is in man netstat. This command sits under Networking.
Related commands
man page: man netstat