Linux NetStat Command


netstat is a command that can be used to check on a wide variety of network information, such as the status of network connections, the contents of the routing table, what masqueraded connections are supported by the system, and what multicast groups the system has joined.   Below are the most common parameters used to debug this sort of issues and as follows:


  # netstat --inet 


--inet 

   to limit that display to TCP/IP network connections only

-a 

   display all sockets ( not just those that are active ), and it does not have to limit the display to IP sockets.

-p 

   when netstat is run with the -p option by the root user, it displays the PID and program name of whatever is using each socket


TCP Protocol States

 

CLOSED 

   the socket is completely closed

CLOSE_WAIT 

   the remote end is shut down, but the local socket is not yet closed

CLOSING 

   both ends of the connection are shut down, but the local system still has data to send

ESTABLISHED 

   the connection is established FIN_WAIT1 the local end of the connection is shutting down

FIN_WAIT2 

   the socket is waiting for the remote end of the connection to shut down 

LAST_ACK 

   the protocol is waiting for the final acknowledgment on a closed socket

LISTEN 

   the socket is still listening for incoming connections

SYN_RECV 

   a connection request has been received

SYN_SENT 

   a connection attempt is underway

TIME_WAIT 

   the socket is closed, but is waiting to clear remaining packets from the network

UNKNOWN 

   netstat cannot determine the state of the socket