What is netstat?
Learn what netstat is, its key flags, and how to use it to inspect connections and listening ports — with interview questions answered.
Expected Interview Answer
netstat is a command-line utility that displays active network connections, listening ports, routing tables, and per-protocol statistics on a host, making it a first-line tool for diagnosing what a machine is talking to and what it is listening on.
Run without flags, netstat lists established TCP and UDP connections along with local and remote addresses and ports. Adding "-l" restricts output to sockets in a listening state, "-p" shows the owning process ID and name (useful for finding what bound a port), "-n" skips DNS and service-name resolution for faster output, and "-r" prints the kernel routing table instead of connections. On many modern Linux distributions netstat ships as part of the deprecated net-tools package and is being replaced by “ss”, which reads the same kernel socket tables far more efficiently, though the concepts and most flag conventions carry over directly.
- Shows which local ports are open and listening
- Reveals active connections with remote address and state
- Maps sockets back to owning process IDs
- Displays routing table and per-protocol statistics
AI Mentor Explanation
netstat is like a scoreboard operator who can instantly list every fielder currently marked “in position” on the ground, which gate each spectator entered through, and which turnstiles are still open for entry. A captain checking that board sees exactly who is active and where, instead of walking the entire ground to look. Calling for the listening-only view is like asking only for open turnstiles, ignoring everyone already seated. This instant listing is exactly what netstat gives an administrator about network sockets.
Step-by-Step Explanation
Step 1
Run the command
Execute “netstat” with flags appropriate to the question being asked (connections, listeners, routes).
Step 2
Filter by state
Use "-l" to see only listening sockets, or omit it to see all active connections.
Step 3
Resolve ownership
Add "-p" (often with sudo) to map each socket to the owning process ID and name.
Step 4
Interpret output
Read local address:port, remote address:port, and connection state (LISTEN, ESTABLISHED, TIME_WAIT, etc.).
What Interviewer Expects
- Explains netstat shows connections, listening ports, and routes
- Knows key flags: -l (listening), -p (process), -n (numeric), -r (routes)
- Aware netstat is legacy and ss is its modern replacement on Linux
- Can describe a real debugging scenario (e.g., finding what is using a port)
Common Mistakes
- Confusing netstat output states like TIME_WAIT with an actual problem
- Forgetting "-p" often requires elevated privileges to show the process name
- Not knowing "-n" avoids slow reverse-DNS lookups
- Assuming netstat is guaranteed to be preinstalled on modern Linux systems
Best Answer (HR Friendly)
“netstat is a command-line tool that shows what is happening on a computer’s network connections right now — which ports are open, who is connected to what, and which process owns each connection. I use it when I need to quickly check whether a service is actually listening on the port I expect, or to find what is hogging a port during troubleshooting.”
Code Example
# Show all listening TCP ports with owning process (needs sudo)
sudo netstat -tlnp
# Show all active TCP connections, numeric addresses only
netstat -tn
# Show the kernel routing table
netstat -r
# Example output for listening sockets
# Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program
# tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 812/sshd
# tcp 0 0 0.0.0.0:5432 0.0.0.0:* LISTEN 1904/postgresFollow-up Questions
- What is the difference between netstat and ss?
- How would you find which process is using port 8080?
- What does the TIME_WAIT state mean and why does it happen?
- How do you view UDP-only connections with netstat?
MCQ Practice
1. Which netstat flag restricts output to listening sockets only?
"-l" filters netstat output to sockets that are currently in a listening state.
2. What is the modern Linux replacement for netstat?
ss reads the same kernel socket information as netstat but is faster and actively maintained.
3. Which flag shows the owning process ID alongside each socket?
"-p" maps each listed socket to its owning process ID and name, often requiring elevated privileges.
Flash Cards
What is netstat? — A command-line tool that lists active network connections, listening ports, and routes on a host.
netstat -l does what? — Filters output to show only sockets in a listening state.
What replaced netstat on Linux? — ss, which reads the same kernel socket tables more efficiently.
How to find a port’s owning process? — Use netstat -p (often with sudo) to see the PID/program column.