netstat commands for Windows, Linux, and Mac at a glance

If you want to obtain information about the network status using netstat commands, you only need to access the command line tool of your operating system in order to do this. In Windows, Linux, and macOS, the procedure required for this differs, as does the application of some netstat commands in the respective operating system.

Hosting with IONOS — Fast, Flexible, Secure

Discover fast and secure hosting for any project.

We've got your code covered, whether you're on the backend, frontend, or the frontlines.


How to use the netstat network tool?

In all common operating systems, both netstat and a corresponding command line tool for running the network service are available by default. In Windows systems you use the well-established command prompt, in Linux distributions and on Mac devices you use the terminal.

Access netstat in Windows

First use the Windows key+ [R] key combination. Use this shortcut to access the “Run” tool. Now type “cmd” and confirm the entry via “OK” to start the command prompt.

You can then type any netstat command directly into the command prompt and confirm with the Enter key.

Access netstat in Linux

As a Linux user, you enter netstat commands in the terminal. In the popular distribution Ubuntu, there is a factory-assigned key combination to access netstat:

[Ctrl] + [Alt] +[T]

netstat is pre-installed up to Ubuntu 16.04 as part of the net-tools package. In newer versions of the Linux distribution, you first have to install the package. To do this, execute the following command: “sudo apt-get install net-tools”.

Other distributions like Debian do not have a shortcut by default. However, you can easily search for and launch the command line tool using the search function in the “Show applications” menu (also works in Ubuntu). To do this, simply type “terminal”.

Once the terminal is open, you can execute the desired netstat commands.

Activate netstat in macOS

The terminal is also the command line tool of choice on Mac devices when it comes to executing netstat commands. You have two convenient options for accessing it: The Spotlight Search and the “Utilities” menu.

Using Spotlight search works as follows:

  1. Open the Spotlight Search by clicking on the magnifying glass icon in the menu bar or using the key combination [Cmd] + [Space].
  2. Enter “Terminal” in the search field.
  3. Start the tool by double-clicking on the corresponding search result.

Via the Utilities menu, start the terminal as follows:

  1. Switch to your desktop.
  2. Click on the “Go to” item in the menu bar.
  3. Select “Utilities”.
  4. Open the terminal by double-clicking on the corresponding entry.

These useful netstat commands are available for Windows, Linux, and Mac

Many netstat commands are applicable across systems, since syntax and required parameters do not differ. Here and there, however, there are differences in the commands in Windows, Linux, and macOS. In the following tables we have listed all the important netstat commands for the individual systems.

netstat commands for Windows

[OPTION] Command Description  
  netstat List of all active connections  
info netstat info Starts the netstat overview menu  
-a netstat -a Lists the open sockets in addition to active connections  
-b netstat -b Displays the executable file involved in creating a connection or listening port (listener) (requires administrator privileges)  
-e netstat -e Ethernet statistics (bytes received and sent, data packets, etc.)  
-f netstat -f Returns the ((fully-qualified domain name (FQDN) domains/domainverwaltung/fqdn-fully-qualified-domain-name/)) of remote addresses
-i netstat -i Shows how long a ((TCP server/knowhow/tcp-vorgestellt/)) connection has spent in its current state
-n netstat -n Displays addresses and port numbers numerically  
-o netstat -o Presents connections with the associated process ID in each case  
-p protocol netstat -p TCP Shows the connections for the specified protocol, in this case TCP; also possible: ((UDP server/knowhow/udp-user-datagram-protocol/)), TCPv6, or UDPv6
-q netstat -q Lists all connections: all listening TCP sockets/ports and all open TCP ports that are not listening  
-r netstat -r Shows the contents of the routing table  
-s netstat -s Gets statistics about the main network protocols; default: IP, IPv6, ((ICMP server/knowhow/was-ist-das-icmp-protokoll-und-wie-funktioniert-es/)), ICMPv6, TCP, TCPv6, UDP, UDPv6
-t netstat -t Shows the offload status (TCP offload to relieve the main processor) of active connections  
-x netstat -x Informs about all connections, listeners, and shared endpoints for NetworkDirect  
-y netstat -y Shows the TCP connection templates of all active connections  
Interval netstat -p 10 Displays the respective statistics again after a selected number of seconds (here 10); can be combined as desired (here with -p), [CTRL] + [C] terminates the interval display  

netstat commands for Linux

[OPTION] Command Description  
  netstat List of all active connections  
-h, --help netstat -h Accesses the netstat overview menu  
-r, --route netstat -r Shows routing table  
-i, --interfaces netstat -i Displays information about the network interfaces  
-g, --groups netstat -g Presents information about the interfaces’ membership in ((multicast server/knowhow/multicast/)) groups
-s, --statistics netstat -s Detailed network statistics, divided by protocols (IP, TCP, UDP, ICMP, MPTCP)  
-M, --masaquerade netstat -M Listing of all currently masked IP connections; only available if IP masking is supported by the system  
-v, --verbose netstat -v More detailed output; among other things, the netstat command outputs which address families are not configured in the system core  
-W, --wide netstat -W Prevents IP addresses from being truncated (“IP trunking”; removing the last character block)  
-n, numeric netstat -n Outputs numeric addresses instead of resolving the host name  
--numeric-hosts netstat --numeric-hosts Host names are not resolved  
--numeric-ports netstat --numeric-ports Port names are not resolved  
--numeric-users netstat --numeric-users User names are not resolved  
-N, --symbolic netstat -N Resolves hardware names  
-e, --extend netstat -e Displays extended information, for example the user that the socket belongs to  
-p, --programs netstat -p Presents process ID and program name of the respective socket (requires administrator privileges)  
-o, --timers netstat -o Shows information about timers for packet sending timeouts  
-c, --continuous netstat -c Ensures that the desired netstat display is continuously updated  
-l, --listening netstat -l Displays open network sockets/ports  
-a, --all netstat -a netstat command to show all sockets (connected and disconnected)  
-F, --fib netstat -F Shows forwarding table (also called Forwarding Information Base, FIB for short)  
-C, --cache netstat -C Presents the routing cache  
-Z, --context netstat -Z Displays the ((SELinux server/security/was-ist-selinux/)) security context for sockets
-t, --tcp netstat -t Displays only TCP sockets  
-u, --udp netstat -u Displays UDP sockets only  
-U, --udplite netstat -U Displays UDP-Lite sockets only  
-s, --sctp netstat -s Shows only ((SCTP server/knowhow/sctp-stream-control-transmission-protocol/)) sockets
-w, --raw netstat -w Displays only RAW sockets  
-x, --unix Nnetstat -x Displays only UNIX sockets  

netstat commands for Mac

[OPTION] Command Description
-A netstat -A In combination with the standard display; shows the addresses of all protocol control blocks connected to sockets
-a netstat -a In combination with the standard display; shows the status of all sockets
-b netstat -b In combination with the interface display; presents number of incoming and outgoing bytes
-c Queue netstat -c Queue In combination with the queue display -q; displays information only for the queue specified in the netstat command
-d netstat -d In combination with the interface display; informs about the number of dropped packets
-f address family netstat -f inet Limits statistics or reports on address control blocks to hits with the specified address family (here: inet or IPv4); other options: inet6, unix
-g netstat -g Presents information about the interfaces’ membership in multicast groups
-I Interface netstat -I Interface (capital i) Displays information exclusively for the specified interface
-i netstat -i Displays all available, automatically configured interfaces
-L netstat -L Displays the size of the different queues; number 1: rejected connections, number 2: rejected incomplete connections, number 3: maximum number of connections in queue
-l netstat -l (small L) Presentation of the complete IPV6 address
-m netstat -m Statistics recorded by memory management routines
-n netstat -n Numerical display of network addresses
-p protocol netstat -p TCP Displays statistics only for the specified protocol (here: TCP); a list of available protocols can be found in the /etc/protocols directory
-q netstat -q Displays the queue statistics of the network interface
-r netstat -r Presents the network routing tables
-R netstat -R Gives information about the reachability
-s netstat -s Summarizes the information for each protocol separately; if this option is repeated, counters with a status of “0” are not considered again
-v netstat -v More detailed report; among other things, the process ID for each open port is now displayed as well
-W netstat -W Prevents IP addresses from being truncated (“IP trunking”; removing the last character block)
-w waiting time netstat -w 30 Reprints network interface or protocol statistics at intervals of “X” seconds (here: 30)
-x netstat -x Presents extended link layer reachability information in addition to what is displayed via -R

netstat commands: Example

With the help of the individual parameters from the above tables you can check the status of the active connections and open or closed ports and interfaces in detail. Of course, you can also combine different netstat commands directly with each other, as in the following cross-system example:

netstat -an

By combining the -a and -n parameters, you automatically get the status of all active and inactive sockets, with all addresses rendered in numeric form.


A more detailed overview of the basics and syntax of netstat is provided in our article “Introduction to netstat””.