Download Netstat
Michele Firmasyah
In computing, netstat (network statistics) is a command-line network utility that displays network connections for Transmission Control Protocol (both incoming and outgoing), routing tables, and a number of network interface (network interface controller or software-defined network interface) and network protocol statistics. It is available on Unix, Plan 9, Inferno, and Unix-like operating systems including macOS, Linux, Solaris and BSD. It is also available on IBM OS/2 and on Microsoft Windows NT-based operating systems including Windows XP, Windows Vista, Windows 7, Windows 8 and Windows 10.
On Linux, netstat (part of "net-tools") is superseded by ss (part of iproute2). The replacement for netstat -r is ip route, the replacement for netstat -i is ip -s link, and the replacement for netstat -g is ip maddr, all of which are recommended instead.[2][3][4][5]
Under Linux, raw data can often be obtained from the /proc/net/dev to work around the printf output corruption arising in netstat's network interface statistics summary, netstat -i, until such time as the problem is corrected.[citation needed]
On the Windows platform, netstat information can be retrieved by calling the GetTcpTable and GetUdpTable functions in the IP Helper API, or IPHLPAPI.DLL. Information returned includes local and remote IP addresses, local and remote ports, and (for GetTcpTable) TCP status codes. In addition to the command-line netstat.exe tool that ships with Windows, GUI-based netstat programs are available.
On macOS, the /System/Library/CoreServices/Applications folder (or /Applications/Utilities in OS X Mountain Lion and earlier) contains a network GUI utility called Network Utility, the Netstat tab of which runs the netstat command and displays its output in the tab.
The network statistics (netstat) command is a networking tool used for troubleshooting and configuration, that can also serve as a monitoring tool for connections over the network. Both incoming and outgoing connections, routing tables, port listening, and usage statistics are common uses for this command. Let's take a look at some of the basic usage for netstat and the most used cases.
The combination of netstat and grep are very commonly used for finding the number of listening programs on a port. We run the standard netstat -ap and then pipe to grep for a search key. For this example, we will use http:
There you have it. The netstat command is an easy to use and powerful tool that any Linux network admin can put to use. I used netstat extensively as a storage admin for troubleshooting, and I am sure that you will find some use for it, too. While in recent years netstat has been deprecated in favor of the ss command, you may still find it in your networking toolbox. For a more modern take, I will explore ss in a future article, so be sure to keep an eye out for that!
Recently I was doing an assessment in a locked down and restricted environment. One of the first actions you tend to do when landing a shell on a [linux] box is to do some reconnaissance. This is both on host and network, as you want to determine what new access this host has given you. Normally you would run netstat, ifconfig, ip route etc to determine if the compromised host is connected to any other hosts and to determine if there are other network segments you do not know about.
In this case, if you view /proc/net/tcp you will be able to get information about the current network connections (TCP). The file /proc/net/udp gives you information about UDP connections, and /proc/net/unix about unix sockets. This is probably old news to Linux regulars/grey-beards, but for someone who has always relied on netstat or lsof it was a great discovery.
This was great, I could now do some network recon and had some go to scripts for the next time this happens. You can also parse various other files in /proc/net such as /unix,/arp,/route to get unix sockets, the arp table and the route table respectively. The route table needs the same hex to dotted notation translation as the /tcp and /udp files. It also got me thinking, could we do this for all the common hacker commands (actually just admin commands), that we run when first compromising a box? The thinking being that monitoring may be setup for instances of id, netstat, ifconfig etc being run. If we run one of those, we would be alerting our target that they have just been popped. Unless of course they are Equifax.
Another thing you could try is using a port value other than 4444L (there's a massive range of ports available, see the IANA recommended ones in the netstat package source code here), for example, any of the 500 integers between 14415 and 14935 are usually free.
Hey there, I wanted to share my first project for learning Rust. Its a connection/socket monitoring tool similar to netstat and ss build using the "procfs", "termimad" and "inquire" crates. It aims to display the information in a prettier and easier manner using a table. I mainly build it for learning Rust but if there is any interest in this project I might continue it. If you have time on your hands and check it out, don't hesitate to tell me about any bad practices I have in my code :)
Netstat is a command-line tool that displays network statistics on a variety of operating systems. netstat with no options displays active TCP connections. This activity will show you how to use the default netstat command.
760c119bf3