Applies to: Debian 13 (net-tools 2.10, iproute2 6.15), Ubuntu 24.04, AlmaLinux 9 (iproute 6.17) and Alpine 3.24; tested on all four

netstat: command not found means the net-tools package isn’t installed. Current distributions don’t install it by default; its replacement, ss from iproute2, is normally already there. You can install net-tools in one command, or use ss and nstat, which do the same jobs.

Install netstat

# Debian and Ubuntu
sudo apt update && sudo apt install net-tools

# AlmaLinux, Rocky Linux, RHEL and Fedora
sudo dnf install net-tools

# Arch Linux
sudo pacman -S net-tools

In our tests Debian 13 installed net-tools 2.10 and Ubuntu 24.04 version 2.10-0.1ubuntu4.4; on AlmaLinux 9 dnf provides netstat pointed to net-tools-2.0-0.64.20160912git.el9 from BaseOS. We didn’t test Arch Linux; the package name comes from the Arch package database (net-tools 2.10 in the core repository). On Alpine, netstat is already there as part of BusyBox.

The same package also brings back ifconfig, route and arp.

Show listening ports

The most common use is finding which program listens on which port:

$ sudo netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      418/nginx: master p
tcp6       0      0 :::80                   :::*                    LISTEN      418/nginx: master p

-t TCP, -u UDP, -l listening only, -p show the program (needs sudo for other users’ processes), -n numbers instead of names.

The same with ss (no install needed)

ss takes the same letters:

$ sudo ss -tulpn
Netid State  Recv-Q Send-Q Local Address:Port Peer Address:Port Process
tcp   LISTEN 0      511          0.0.0.0:80        0.0.0.0:*    users:(("nginx",pid=418,fd=5))
tcp   LISTEN 0      511             [::]:80           [::]:*    users:(("nginx",pid=418,fd=6))

It can also filter, for example only port 80: sudo ss -tlnp 'sport = :80'. On Debian and Ubuntu, iproute2 has priority “important” and net-tools “optional”, and on AlmaLinux 9 iproute is in the Core group, so ss is on normal server installs. Very small container images may have neither.

netstat commands and their replacements

  • netstat -tulpn (listening ports): ss -tulpn
  • netstat -tan (all TCP connections): ss -tan
  • netstat -s (protocol statistics): nstat -a or ss -s for a summary
  • netstat -rn (routing table): ip route
  • netstat -i (interface counters): ip -s link

What nstat is

nstat is part of iproute2 and shows the kernel’s network counters, the same numbers as netstat -s, but by their SNMP names. Without options it prints what changed since you last ran it; -a shows absolute values and -z includes counters that are zero. You can name the counters you want:

$ nstat -az TcpRetransSegs TcpExtListenDrops TcpActiveOpens
#kernel
TcpActiveOpens                  2                  0.0
TcpRetransSegs                  0                  0.0
TcpExtListenDrops               0                  0.0

Run it twice, a minute apart, to see how fast a counter grows: a quickly rising TcpRetransSegs (resent TCP segments) usually points to packet loss on the path.

More on ports

Four ways to find which ports are listening, find the process on a port, many connections in CLOSE_WAIT and ifconfig compared with ip.

Official documentation: ss(8) and nstat(8).

Ucartz services for this topic

Was this answer helpful? 0 Users Found This Useful (0 Votes)