# Netstat
**netstat** (network statistics) is a command-line utility that displays network connections, listening ports, routing tables, interface statistics, and protocol statistics on [Unix-like](https://www.edgepedia.org/unix-like) systems and Windows. It first appeared in 4.2BSD, the 1983 release of the [Berkeley Software Distribution](https://www.edgepedia.org/berkeley-software-distribution) that introduced the BSD TCP/IP implementation, and it remains present on Windows, macOS, the BSDs, and Linux.[1](https://man.openbsd.org/OpenBSD-current/man1/netstat.1) • [2](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat)
| Key fact | Detail |
|---|---|
| Origin | The netstat command appeared in 4.2BSD; IPv6 support was added by the WIDE/KAME project.[1](https://man.openbsd.org/OpenBSD-current/man1/netstat.1) |
| Default output | With no options, Windows netstat displays active TCP connections; BSD netstat shows all active network connections and sockets.[2](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat) • [1](https://man.openbsd.org/OpenBSD-current/man1/netstat.1) |
| Windows scope | Displays active TCP connections, listening ports, Ethernet statistics, the IP routing table, IPv4 statistics (IP, ICMP, TCP, UDP), and IPv6 statistics (IPv6, ICMPv6, TCP over IPv6, UDP over IPv6).[2](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat) |
| Process mapping | Windows `-o` adds the process ID (PID) per connection; `-b` names the executable that created each connection or listening port and requires sufficient permissions.[2](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat) |
| Linux status | The Linux net-tools netstat is documented as mostly obsolete; replacements are `ss` for sockets, `ip route` for `-r`, `ip -s link` for `-i`, and `ip maddr` for `-g`.[3](https://man7.org/linux/man-pages/man8/netstat.8.html) |
| Common recipe | `netstat -tulpn` lists all open TCP and UDP ports with the owning process's PID (requires root), answering "which process is listening on port 8080?".[3](https://man7.org/linux/man-pages/man8/netstat.8.html) |
| Repeated display | A trailing interval argument makes Windows netstat redisplay the selected information every interval seconds until stopped with CTRL+C.[2](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat) |
## What it reports
The information netstat can show falls into a few groups. The default display lists active sockets: for each connection the local and foreign address and port, the protocol, and the connection state. On Windows, the state column reports TCP states such as CLOSE_WAIT, CLOSED, ESTABLISHED, FIN_WAIT_1, FIN_WAIT_2, LAST_ACK, LISTEN, SYN_RECEIVED, SYN_SEND, and TIMED_WAIT.[2](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat) Beyond connections, the tool can print the kernel routing table (`-r`, equivalent to `route print` on Windows), per-interface statistics, multicast group memberships, and summary statistics per protocol.[2](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat) • [3](https://man7.org/linux/man-pages/man8/netstat.8.html)
Names versus numbers is a recurring distinction. By default addresses and ports are shown symbolically, resolved through databases such as /etc/hosts; the `-n` option suppresses name resolution and prints addresses and port numbers numerically, which is faster and avoids sending DNS queries while troubleshooting.[2](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat) • [7](https://man.freebsd.org/cgi/man.cgi?manpath=macOS+13.6.5&query=netstat&sektion=1)
## Platform variants
**Windows.** The Windows netstat is available only when the TCP/IP protocol is installed as a component of a network adapter. Its parameters include `-a` (all connections and listening TCP and UDP ports), `-b` (the executable behind each connection or port), `-e` (Ethernet statistics such as bytes and packets sent and received), `-n` (numeric addresses), `-o` (PIDs), `-p ` (tcp, udp, tcpv6, or udpv6, or with `-s` also icmp, ip, icmpv6, ipv6), `-q` (connections, listening ports, and bound nonlistening TCP ports), `-r` (routing table), and `-s` (per-protocol statistics). The `-b` option can be time-consuming and fails without sufficient permissions, so it is normally run from an elevated command prompt.[2](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat)
**BSD and macOS.** The BSD netstat "symbolically displays the contents of various network-related data structures" and has forms for active sockets, interface statistics at intervals, per-protocol statistics, memory-management (mbuf) statistics, and routing tables. macOS inherits this BSD implementation, which is why its flags differ from Linux's.[7](https://man.freebsd.org/cgi/man.cgi?manpath=macOS+13.6.5&query=netstat&sektion=1)
**Linux.** Linux netstat comes from the net-tools package, which also provides ifconfig, route, arp, and related tools. The upstream net-tools project released version 2.10 on 7 January 2021, consisting mostly of bug fixes reported by Linux distributions, and the source is mirrored on GitHub.[4](https://sourceforge.net/p/net-tools/news/) The Linux manual page states plainly that the program is mostly obsolete and directs users to the netlink-based `ss` command, noting that netstat's performance is low when listing large numbers of sockets on busy servers.[3](https://man7.org/linux/man-pages/man8/netstat.8.html)
## Successors on Linux
On Linux the iproute2 suite has absorbed netstat's roles. `ss` dumps socket statistics and replaces netstat for connection and listening-port questions; `ip route` replaces `netstat -r`; `ip -s link` replaces `netstat -i`; and `ip maddr` replaces `netstat -g`.[3](https://man7.org/linux/man-pages/man8/netstat.8.html) The replacement continues to gain capabilities: [Red Hat Enterprise Linux](https://www.edgepedia.org/red-hat-enterprise-linux) 9.4 release notes describe an `ss` enhancement that lets the kernel dump TCP bound-inactive sockets, which are attached to an [IP address](https://www.edgepedia.org/ip-address) and port but neither connected nor listening, viewable with `ss --all` or `ss --bound-inactive`.[6](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/pdf/9.4_release_notes/deprecated-functionality)
## Typical uses
Netstat answers a small set of practical questions about a host's network state: what is listening, which TCP sessions are open, and which process owns a socket. Finding the process behind a port is the most common task; on Linux `netstat -tulpn` combines TCP and UDP, listening sockets, numeric display, PID, and program name in one invocation, and on Windows `netstat -ano` followed by matching the PID in Task Manager serves the same purpose.[3](https://man7.org/linux/man-pages/man8/netstat.8.html) • [2](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat) When an application reports "bind: address already in use", netstat is a direct way to identify the occupying process.[5](https://oneuptime.com/blog/post/2026-03-20-netstat-process-port-listen/view)
Two cautions apply when reading its output. The Linux manual page also notes that occasionally strange information may appear if a socket changes while it is being viewed.[3](https://man7.org/linux/man-pages/man8/netstat.8.html)
## References
1. [netstat(1) - OpenBSD manual pages](https://man.openbsd.org/OpenBSD-current/man1/netstat.1)
2. [netstat | Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat)
3. [netstat(8) - Linux manual page](https://man7.org/linux/man-pages/man8/netstat.8.html)
4. [net-tools / News, SourceForge](https://sourceforge.net/p/net-tools/news/)
5. [How to Find Which Process Is Listening on a Specific Port with Netstat, OneUptime](https://oneuptime.com/blog/post/2026-03-20-netstat-process-port-listen/view)
6. [Red Hat Enterprise Linux 9.4 Release Notes: Deprecated Functionality](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/pdf/9.4_release_notes/deprecated-functionality)
7. [netstat(1) - macOS 13.6.5 Manual Pages](https://man.freebsd.org/cgi/man.cgi?manpath=macOS+13.6.5&query=netstat&sektion=1)
8. [How to Check Listening Ports in Linux: ss, netstat, lsof, Linuxize](https://linuxize.com/post/check-listening-ports-linux/)
---
*Topic: Encyclopedia › Technology and the built world › Computing and digital systems › Networks and security › Networking fundamentals and architecture › Routing and addressing › Routing theory and algorithms*
*Initially written Sep 17, 2026 · Reviewed: Sep 30, 2026; Oct 15, 2026 · Edited: Sep 30, 2026; Oct 15, 2026 · Last review: Oct 15, 2026*
*Copyright 2026 EdgeChat AI, a subsidiary of Biostate AI.*
License: Edgepedia Community License 1.0, https://www.edgepedia.org/edgepedia/license