What is netstat?
netstat (short for “network statistics”) is a command‑line tool that shows you information about the network connections on a computer. It lists things like which programs are talking to other computers, what ports they’re using, and how much data is being sent or received.
Let's break it down
- Command: You type
netstat
in a terminal (Windows, macOS, Linux). - Output: A table that includes columns such as Protocol (TCP/UDP), Local Address (your computer’s IP and port), Foreign Address (the remote computer’s IP and port), State (e.g., LISTENING, ESTABLISHED), and PID/Program name (which app opened the connection).
- Options: Adding flags changes the view, e.g.,
-a
shows all connections,-n
shows numbers instead of names,-p
shows the owning process,-r
displays the routing table.
Why does it matter?
Knowing what’s happening on your network helps you:
- Detect unwanted or suspicious connections (possible malware).
- Troubleshoot why a program can’t reach the internet or a server.
- Verify that a service (like a web server) is actually listening on the correct port.
- Understand bandwidth usage and performance bottlenecks.
Where is it used?
- System administrators checking server health or security.
- Developers debugging network code or confirming that a local service started correctly.
- Security analysts scanning for rogue connections during incident response.
- Home users who want to see which apps are accessing the internet.
Good things about it
- Built‑in on most operating systems, no extra installation needed.
- Works with both IPv4 and IPv6.
- Provides real‑time snapshot of all network activity.
- Simple text output can be piped into other tools for further analysis.
- Helpful for both quick checks and detailed investigations.
Not-so-good things
- Output can be overwhelming on busy machines; you may need to filter with options or additional tools.
- Lacks a graphical interface, which can be less intuitive for beginners.
- Some modern OS versions limit the detail shown (e.g., Windows may hide PID without admin rights).
- Does not continuously monitor; you must run it repeatedly or use other tools for live tracking.