{
	"id": "e0346adb-d5bf-4590-9954-013c8db0522c",
	"created_at": "2026-04-06T00:20:13.557188Z",
	"updated_at": "2026-04-10T03:35:21.34807Z",
	"deleted_at": null,
	"sha1_hash": "f7f0016ed6a22ebf8a2ba26d33cad18972933b0d",
	"title": "Netstat",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 359285,
	"plain_text": "Netstat\r\nBy Contributors to Wikimedia projects\r\nPublished: 2004-08-20 · Archived: 2026-04-05 14:59:51 UTC\r\nFrom Wikipedia, the free encyclopedia\r\nnetstat\r\nThe netstat command in Linux\r\nDevelopers Various open-source and commercial developers\r\nInitial release 1983; 43 years ago\r\nWritten in Plan 9: C\r\nOperating system Unix, Unix-like, Plan 9, Inferno, OS/2, Microsoft Windows, ReactOS\r\nPlatform Cross-platform\r\nType Command\r\nLicense\r\nOS/2, Windows: Proprietary commercial software\r\nnet-tools, ReactOS: GPLv2\r\nPlan 9: MIT License\r\nIn computing, netstat is a command-line network utility that displays open network sockets, routing tables, and a number\r\nof network interface (network interface controller or software-defined network interface) and network protocol statistics. It\r\nis available on Unix, Plan 9, Inferno, and Unix-like operating systems including macOS, Linux, Solaris and BSD. It is also\r\navailable on IBM OS/2 and on Microsoft Windows NT-based operating systems including Windows XP, Windows Vista,\r\nWindows 7, Windows 8 and Windows 10.\r\nIt is used for finding problems in the network and to determine the amount of traffic on the network as a performance\r\nmeasurement.[1] On Linux this program is mostly obsolete, although still included in many distributions.\r\nOn Linux, netstat (part of \"net-tools\") is superseded by ss (part of iproute2). The replacement for netstat -r is ip\r\nroute , the replacement for netstat -i is ip -s link , and the replacement for netstat -g is ip maddr , all of which\r\nhttps://en.wikipedia.org/wiki/Netstat\r\nPage 1 of 9\n\nare recommended instead.[2][3][4][5]\r\nStatistics provided\r\n[edit]\r\nNetstat provides statistics for the following:\r\nProto – The name of the protocol (TCP, UDP, etc.). On some systems, the protocol name may be followed by \"4\" or\r\n\"6\", depending on whether the protocol is running over IPv4 or IPv6.\r\nLocal Address – The IP address of the local computer and the port number being used. The name of the local\r\ncomputer that corresponds to the IP address and the name of the port is shown unless the -n parameter is specified.\r\nAn asterisk (*) is shown for the host if the server is listening on all interfaces. If the port is not yet established, the\r\nport number is shown as an asterisk.\r\nForeign Address – The IP address and port number of the remote computer to which the socket is connected. The\r\nnames that corresponds to the IP address and the port are shown unless the -n parameter is specified. If the port is\r\nnot yet established, the port number is shown as an asterisk (*).\r\nState – Indicates the state of a TCP connection. The possible states are as follows: CLOSE_WAIT, CLOSED,\r\nESTABLISHED, FIN_WAIT_1, FIN_WAIT_2, LAST_ACK, LISTEN, SYN_RECEIVED, SYN_SEND, and\r\nTIME_WAIT. For more information about the states of a TCP connection, see RFC 793.\r\nParameters used with this command must be prefixed with a hyphen (-) rather than a slash (/). Some parameters are not\r\nsupported on all platforms.\r\nName Description Windows ReactOS macOS BSD NetBSD FreeBSD Linux Solaris O\r\n-a\r\nDisplays all active\r\nconnections and\r\nthe TCP and UDP\r\nports on which the\r\ncomputer is\r\nlistening.\r\nYes Yes Yes Yes Yes Yes\r\n-b\r\nDisplays the binary\r\n(executable)\r\nprogram's name\r\ninvolved in\r\ncreating each\r\nconnection or\r\nlistening port.\r\n(Windows XP,\r\nWindows Server\r\n2003 and newer\r\nWindows operating\r\nsystems; not\r\nMicrosoft\r\nWindows 2000 or\r\nolder).\r\nYes No N\r\n-b\r\nCauses -i to report\r\nthe total number of\r\nbytes of traffic.\r\nNo Yes Yes N\r\nhttps://en.wikipedia.org/wiki/Netstat\r\nPage 2 of 9\n\nName Description Windows ReactOS macOS BSD NetBSD FreeBSD Linux Solaris O\r\n-e\r\nDisplays ethernet\r\nstatistics, such as\r\nthe number of\r\nbytes and packets\r\nsent and received.\r\nThis parameter can\r\nbe combined with -\r\ns.\r\nYes Yes N\r\n-f\r\nDisplays fully\r\nqualified domain\r\nnames \u003cFQDN\u003e\r\nfor foreign\r\naddresses (only\r\navailable on\r\nWindows Vista and\r\nnewer operating\r\nsystems).\r\nYes No N\r\n-f\r\nAddress\r\nFamily\r\nLimits display to a\r\nparticular socket\r\naddress family,\r\nunix, inet, inet6\r\nNo Yes N\r\n-g\r\nDisplays multicast\r\ngroup membership\r\ninformation for\r\nboth IPv4 and IPv6\r\n(may only be\r\navailable on newer\r\noperating systems)\r\nNo No Yes\r\n-i\r\nDisplays network\r\ninterfaces and their\r\nstatistics\r\nNo No Yes Yes Yes Yes Yes\r\n-m\r\nDisplays the\r\nmemory statistics\r\nfor the networking\r\ncode (STREAMS\r\nstatistics on\r\nSolaris).\r\nNo No Yes Yes Yes Yes Yes\r\n-n Displays active\r\nTCP connections,\r\nhowever, addresses\r\nand port numbers\r\nare expressed\r\nnumerically and no\r\nYes Yes Yes Yes Yes Yes Yes Yes\r\nhttps://en.wikipedia.org/wiki/Netstat\r\nPage 3 of 9\n\nName Description Windows ReactOS macOS BSD NetBSD FreeBSD Linux Solaris O\r\nattempt is made to\r\ndetermine names.\r\n-o\r\nDisplays active\r\nTCP connections\r\nand includes the\r\nprocess id (PID)\r\nfor each\r\nconnection. You\r\ncan find the\r\napplication based\r\non the PID in the\r\nProcesses tab in\r\nWindows Task\r\nManager. This\r\nparameter can be\r\ncombined with -a, -\r\nn, and -p. This\r\nparameter is\r\navailable on\r\nMicrosoft\r\nWindows XP,\r\nWindows Server\r\n2003, and\r\nWindows 2000 if a\r\nhotfix is applied.[6]\r\nYes No N\r\n-p\r\nprotocol\r\nShows connections\r\nfor the protocol\r\nspecified by\r\nprotocol. In this\r\ncase, protocol can\r\nbe tcp, udp, tcpv6,\r\nor udpv6. If this\r\nparameter is used\r\nwith -s to display\r\nstatistics by\r\nprotocol, protocol\r\ncan be tcp, udp,\r\nicmp, ip, tcpv6,\r\nudpv6, icmpv6, or\r\nipv6.\r\nYes Yes Yes Yes Yes Yes\r\n-p Show which\r\nprocesses are using\r\nwhich sockets\r\n(similar to -b under\r\nWindows) (you\r\nNo No Yes\r\nhttps://en.wikipedia.org/wiki/Netstat\r\nPage 4 of 9\n\nName Description Windows ReactOS macOS BSD NetBSD FreeBSD Linux Solaris O\r\nmust be root to do\r\nthis)\r\n-P\r\nprotocol\r\nShows connections\r\nfor the protocol\r\nspecified by\r\nprotocol. In this\r\ncase, protocol can\r\nbe ip, ipv6, icmp,\r\nicmpv6, igmp,\r\nudp, tcp, or rawip.\r\nNo No Yes\r\n-r\r\nDisplays the\r\ncontents of the IP\r\nrouting table. (This\r\nis equivalent to the\r\nroute print\r\ncommand under\r\nWindows.)\r\nYes Yes Yes Yes Yes Yes Yes Yes Ye\r\n-s\r\nDisplays statistics\r\nby protocol. By\r\ndefault, statistics\r\nare shown for the\r\nTCP, UDP, ICMP,\r\nand IP protocols. If\r\nthe IPv6 protocol\r\nfor Windows XP is\r\ninstalled, statistics\r\nare shown for the\r\nTCP over IPv6,\r\nUDP over IPv6,\r\nICMPv6, and IPv6\r\nprotocols. The -p\r\nparameter can be\r\nused to specify a\r\nset of protocols.\r\nYes Yes Yes Yes Yes Yes Yes Yes\r\n-t\r\nDisplay only TCP\r\nconnections.\r\nNo Yes Ye\r\n-u\r\nDisplay only UDP\r\nconnections.\r\nNo No Yes Ye\r\n-W\r\nDisplay wide\r\noutput - doesn't\r\ntruncate hostnames\r\nor IPv6 addresses\r\nNo No Yes N\r\n-x Displays\r\nNetworkDirect\r\nYes\r\nhttps://en.wikipedia.org/wiki/Netstat\r\nPage 5 of 9\n\nName Description Windows ReactOS macOS BSD NetBSD FreeBSD Linux Solaris O\r\nconnections,\r\nlisteners, and\r\nshared endpoints.\r\n-y\r\nDisplays the TCP\r\nconnection\r\ntemplate for all\r\nconnections.Cannot\r\nbe combined with\r\nthe other options.\r\nYes\r\n-v\r\nWhen used in\r\nconjunction with -b\r\nit will display the\r\nsequence of\r\ncomponents\r\ninvolved in\r\ncreating the\r\nconnection or\r\nlistening port for\r\nall executables.\r\nYes No N\r\nInterval\r\nRedisplays the\r\nselected\r\ninformation every\r\nInterval seconds.\r\nPress CTRL+C to\r\nstop the redisplay.\r\nIf this parameter is\r\nomitted, netstat\r\nprints the selected\r\ninformation only\r\nonce.\r\nYes Yes N\r\n-h\r\nDisplays help at the\r\ncommand prompt.\r\nYes No Yes Yes Yes Yes Yes Yes N\r\n-?\r\nDisplays help at the\r\ncommand prompt.\r\nYes No No No No No No No Ye\r\n/?\r\nDisplays help at the\r\ncommand prompt.\r\nYes Yes No No No No No No N\r\nOn macOS, BSD systems, Linux distributions, and Microsoft Windows:\r\nTo display the statistics for only the TCP or UDP protocols, type one of the following commands:\r\nnetstat -sp tcp\r\nnetstat -sp udp\r\nOn Unix-like systems:\r\nhttps://en.wikipedia.org/wiki/Netstat\r\nPage 6 of 9\n\nTo display all ports open by a process with id pid:\r\nnetstat -aop | grep \"pid\"\r\nTo continuously display open TCP and UDP connections numerically and also which program is using them on Linux:\r\nnetstat -nutpacw\r\nOn Microsoft Windows:\r\nTo display active TCP connections and the process IDs every 5 seconds, type the following command (works on NT based\r\nsystems only, or Windows 2000 with hotfix):\r\nnetstat -o 5\r\nTo display active TCP connections and the process IDs using numerical form, type the following command (works on NT\r\nbased systems only, or Windows 2000 with hotfix):\r\nnetstat -no\r\nCommand Explanation\r\nnetstat -a Shows all sockets, both listening and non-listening, all protocols like TCP, UDP etc.\r\nnetstat -at Shows only TCP connections (-au shows only UDP connections)\r\nnetstat -ant Shows all TCP connections with no DNS resolution (show IP addresses instead).\r\nnetstat -al Shows only listening sockets.\r\nnetstat -aep\r\nAlso show PID and to which program each socket belongs, e adds extra info like the user.\r\nRun as root to see all PIDs.\r\nnetstat -s Shows network statistics.\r\nnetstat -r Shows kernel routing information. This is the same output as route -e.\r\nnetstat -i Displays a table of all network interfaces. Add -e to get output similar to ifconfig.\r\nnetstat -ct Displays TCP connections continuously.\r\nnetstat -g Display multicast group membership information for IPv4 and IPv6.\r\nnetstat -lntu Display all services listening for TCP and UDP, all free open ports on the local machine.\r\nnetstat -atnp | grep\r\nESTA\r\nDisplays all currently \"established\" TCP connections.\r\nNetstat uses an asterisk * as a wildcard which means \"any\". An example would be\r\nExample output:\r\n....Local Address Foreign Address State\r\n... *:smtp *:* LISTEN\r\nUnder \"Local Address\" *, in *:smtp , means the process is listening on all of the network interfaces the machine has for the\r\nport mapped as smtp (see /etc/services for service resolution). This can also be shown as 0.0.0.0. The first *, in *:* , means\r\nhttps://en.wikipedia.org/wiki/Netstat\r\nPage 7 of 9\n\nconnections can come from any IP address, and the second *, in *:* , means the connection can originate from any port on\r\nthe remote machine.\r\nSome versions of netstat lack explicit field delimiters in their printf-generated output, leading to numeric fields running\r\ntogether and thus corrupting the output data.\r\nThe ReactOS netstat command\r\nThe macOS netstat command\r\nUnder Linux, raw data can often be obtained from the /proc/net/dev to work around the printf output corruption arising in\r\nnetstat's network interface statistics summary, netstat -i , until such time as the problem is corrected.[citation needed]\r\nOn the Windows platform, netstat information can be retrieved by calling the GetTcpTable and GetUdpTable functions in\r\nthe IP Helper API, or IPHLPAPI.DLL. Information returned includes local and remote IP addresses, local and remote ports,\r\nand (for GetTcpTable) TCP status codes. In addition to the command-line netstat.exe tool that ships with Windows, GUI-based netstat programs are available.\r\nOn the Windows platform, this command is available only if the Internet Protocol (TCP/IP) protocol is installed as a\r\ncomponent in the properties of a network adapter in Network Connections.\r\nOn the Windows platform running Remote Desktop Services (formerly Terminal Services) it will only show connections for\r\nthe current user, not for the whole computer.\r\nOn macOS, the /System/Library/CoreServices/Applications folder (or /Applications/Utilities in OS X Mountain Lion and\r\nearlier) contains a network GUI utility called Network Utility, the Netstat tab of which runs the netstat command and\r\ndisplays its output in the tab.\r\nss, a Linux utility to investigate sockets from iproute2 meant to replace netstat\r\nlsof -i\r\nbmon\r\n1. ^ \"IBM Systems Information Center\". ibm.com. 8 May 2007.\r\n2. ^ \"net-tools\". linuxfoundation.org. Archived from the original on 2016-06-11. Retrieved 2014-08-02.\r\n3. ^ \"Arch Linux\". archlinux.org. 8 June 2011.\r\nhttps://en.wikipedia.org/wiki/Netstat\r\nPage 8 of 9\n\n4. ^ \"Deprecated Linux networking commands and their replacements\". Doug Vitale Tech Blog. 21 December 2011.\r\n5. ^ \"netstat man page (notes section)\". Retrieved 2 August 2014. “This program is obsolete. Replacement for netstat is\r\nss. Replacement for netstat -r is ip route. Replacement for netstat -i is ip -s link. Replacement for netstat -g is ip\r\nmaddr.”\r\n6. ^ \"The netstat command can now display process IDs that correspond to active TCP or UDP connections in\r\nWindows 2000\". Archived from the original on 24 August 2007.\r\nDyson, Peter (1995). Mastering OS/2 Warp. Sybex. ISBN 978-0782116632.\r\nStanek, William R. (2008). Windows Command-Line Administrator's Pocket Consultant, 2nd Edition. Microsoft\r\nPress. ISBN 978-0735622623.\r\nnetstat(8)  – Linux Programmer's Manual – Administration and Privileged Commands\r\nnetstat(1)  – FreeBSD General Commands Manual\r\nnetstat(8)  – Solaris 11.4 System Administration Commands Reference Manual\r\nnetstat(1)  – Inferno General commands Manual\r\nMicrosoft Learn: Netstat – documentation for the Windows netstat.exe command-line program\r\nnet-tools project page on SourceForge\r\nNetstat Command Archived 2022-01-15 at the Wayback Machine: WindowsCMD.com Archived 2022-01-11 at the\r\nWayback Machine\r\nSource: https://en.wikipedia.org/wiki/Netstat\r\nhttps://en.wikipedia.org/wiki/Netstat\r\nPage 9 of 9",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://en.wikipedia.org/wiki/Netstat"
	],
	"report_names": [
		"Netstat"
	],
	"threat_actors": [
		{
			"id": "2864e40a-f233-4618-ac61-b03760a41cbb",
			"created_at": "2023-12-01T02:02:34.272108Z",
			"updated_at": "2026-04-10T02:00:04.97558Z",
			"deleted_at": null,
			"main_name": "WildCard",
			"aliases": [],
			"source_name": "ETDA:WildCard",
			"tools": [
				"RustDown",
				"SysJoker"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "256a6a2d-e8a2-4497-b399-628a7fad4b3e",
			"created_at": "2023-11-30T02:00:07.299845Z",
			"updated_at": "2026-04-10T02:00:03.484788Z",
			"deleted_at": null,
			"main_name": "WildCard",
			"aliases": [],
			"source_name": "MISPGALAXY:WildCard",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434813,
	"ts_updated_at": 1775792121,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/f7f0016ed6a22ebf8a2ba26d33cad18972933b0d.pdf",
		"text": "https://archive.orkl.eu/f7f0016ed6a22ebf8a2ba26d33cad18972933b0d.txt",
		"img": "https://archive.orkl.eu/f7f0016ed6a22ebf8a2ba26d33cad18972933b0d.jpg"
	}
}