netstat Commands

What Is Using a Port

The most common reason either command gets run. Find the PID that owns the port, then name it.

PowerShell does it in one step, no findstr and no second command:

Get-Process -Id (Get-NetTCPConnection -LocalPort 8080 -State Listen).OwningProcess

For open files, sockets, and deleted-file handles beyond ports, see the lsof cheat sheet.

Windows netstat

netstat is not deprecated on Windows. Run these in Command Prompt or PowerShell; findstr is the Windows grep, and -b needs an elevated prompt.

netstat to ss Mapping

netstat is deprecated on Linux; ss is the replacement and takes the same flag letters for the common cases. The last two rows moved to ip instead.

The letters mean: t TCP, u UDP, l listening only, n numeric (skip DNS, always worth it), p process info (needs sudo for other users' processes), a all.

Listening Ports

If a port shows a listener bound to 127.0.0.1, it only accepts local connections; 0.0.0.0 or * means all interfaces. To test a port from the outside instead, use the SSH port checker.

Established Connections

Recipes:

# Who is connected to my web server right now, by IP:
ss -tn state established '( sport = :443 or sport = :80 )'

# Count connections by state (spot SYN floods and CLOSE_WAIT leaks):
ss -tan | awk 'NR>1 {print $1}' | sort | uniq -c | sort -rn

# Count established connections per client IP:
ss -tn state established | awk 'NR>1 {split($5,a,":"); print a[1]}' | sort | uniq -c | sort -rn

Connection States

The State column is the TCP state machine. UDP rows have no state, which is why they look empty.

ss Filters

ss filters sockets itself, no grep needed. Quote the expression, and put spaces around the parentheses and operators.

Routing Table and Stats

The parts of netstat that ss does not cover, and their modern forms.

macOS netstat

macOS ships a BSD netstat with different flags, and no -p for processes (-p selects a protocol instead). Use lsof for the process view.

netstat Flags

Two combinations cover most of it: netstat -tulpn on Linux, netstat -abno on Windows. The same letter often means something different on each.

Reading the Output

Both tools print the same columns, in the same order, on every platform.

Install netstat

Only worth doing when a script insists on it; ss is already installed everywhere.

If apt install net-tools says it cannot locate the package, run sudo apt update first; the package list in a fresh container image is usually empty.

Gotchas

• netstat: command not found on a modern distro is expected: the default answer is ss, and sudo apt install net-tools brings netstat back if a script insists on it.
• Without sudo, the -p column is blank for processes owned by other users, including every system service. No error, just missing names.
• Always add n. Without it both tools resolve every address and port name, which is slow and turns :22 into :ssh mid-scan.
• ss filter expressions are picky about spacing: '( dport = :443 )' works, '(dport=:443)' does not.
• A service bound to 127.0.0.1 will look fine in ss -tlnp but be unreachable from outside. Check the Local Address column, not just the port.
• On Windows, PID 4 is the kernel. http.sys parks ports there for IIS, WinRM, and WSL, so taskkill will not help; stop the service that registered the URL instead.
• A Windows port that refuses binds while netstat -ano shows nothing is usually inside a reserved range. netsh int ipv4 show excludedportrange protocol=tcp lists them, and Hyper-V grabs large blocks on every boot.
• Neither tool can look at another machine. Run it over SSH, or scan from outside with nmap.
• Connections you see in ss can still be invisible to clients if the firewall drops packets first. When listeners look right but connections fail, capture with tcpdump and check iptables.