Home·Terminal commands

netstat

Networking

Usage

netstat -tulpn | netstat -an

The old way to see sockets and the routing table; on Linux it has been handed over to ss and is often not installed at all, and although macOS keeps it, it cannot tell you which process owns a socket, so lsof answers that.

Common flags

FlagMeaning
-tulpnThe Linux combination: TCP, UDP, listening, with process, numeric.
-anAll sockets, numeric. The form that also works on macOS/BSD.
-rRouting table; add -n to keep it numeric.
-iPer-interface packet and error counters.
-sProtocol statistics, useful for retransmit counts.
-v -p tcpmacOS/BSD: verbose, one protocol. macOS cannot map sockets to processes at all.

Examples

sudo netstat -tulpn

Listening ports with their processes (Linux, needs root for -p).

netstat -an | grep LISTEN

The listening list on macOS, where -p means something else.

netstat -rn

The routing table on either platform.

When a connection fails, these narrow down how far it got — name not resolving, no route, or a blocked port.

How to read this

  • Square brackets [ ] mark a part you may leave out.
  • An ellipsis … means you can list more than one.
  • Flags are case-sensitive — in some commands -r and -R do different things.

Questions

Q. What does netstat do?

The old way to see sockets and the routing table; on Linux it has been handed over to ss and is often not installed at all, and although macOS keeps it, it cannot tell you which process owns a socket, so lsof answers that.

Q. How do I type it?

netstat -tulpn | netstat -an — square brackets mark the parts you can leave out.

Q. How many flags are worth knowing?

6 are listed here; the full set is in man netstat. This command sits under Networking.

Related commands

man page: man netstat