Using netstat to Inspect Connections
- Networking Fundamentals & OSI Model
- TCP/IP Model
- Network Topologies
- IP Addressing & Subnetting
- Routing Algorithms & Protocols
- Switching Concepts
- Transport Layer Protocols (TCP & UDP)
- Application Layer Protocols
- Network Security & Firewalls
- Wireless Networking & Wi-Fi
- Network Address Translation (NAT)
- DNS Deep Dive
- Congestion Control & Flow Control
- Error Detection & Correction
- Network Devices
- VPN & Tunneling
- Load Balancing & CDN Networking
- Socket Programming
- Network Troubleshooting Tools
- Physical Layer & Transmission Media
- Data Link Layer & MAC Addressing
- Ethernet Protocol
- ARP (Address Resolution Protocol)
- ICMP Protocol
- Unicast, Multicast, Broadcast and Anycast
- Proxy Servers
- Port Numbers Reference
- Network Performance Metrics
- Quality of Service (QoS)
- Software-Defined Networking (SDN)
- HTTP/2 and HTTP/3 Overview
- 5G and Mobile Networks
- IoT Networking Basics
- VoIP Networking Basics
What netstat Shows You
While ping and traceroute investigate connectivity to a remote destination, netstat looks inward - showing all the active network connections and listening ports on your own local device right now.
$ netstat -an
Proto Local Address Foreign Address State
TCP 192.168.1.10:51000 93.184.216.34:443 ESTABLISHED
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING
UDP 0.0.0.0:53 *:*Understanding Connection States
| State | Meaning |
|---|---|
| LISTENING | A service is running and waiting for incoming connections on this port |
| ESTABLISHED | An active, currently open connection to a remote address |
| TIME_WAIT | A connection that recently closed, still briefly held before fully clearing |
Checking What's Actually Running on This Device
Seeing which ports are in a LISTENING state reveals exactly which services are currently active and reachable on a device - useful both for legitimate troubleshooting (confirming a web server is actually running) and for basic security auditing (spotting an unexpected, unrecognized service listening that shouldn't be there).
Diagnosing "Why Won't This Connect?"
If an application is failing to connect and netstat shows no LISTENING entry for the expected port at all, that's an immediate, strong clue: the service itself likely isn't running, rather than the problem being anywhere in the network path between the two devices.
Modern Alternatives on Some Systems
On several modern operating systems, netstat has been effectively replaced by newer tools offering similar (and often more detailed) information - though the underlying concept of inspecting local connections and listening ports remains exactly the same regardless of which specific tool is used.