Inspect open sockets, listening ports and routing information with a single, classic Linux command. 15.04.2026 | reading time: 2 min Open a terminal and ask: which services listen, which connections are established and which process owns a socket; netstat answers this quickly and directly. A quick live demo Run a command and read the output to learn: `sudo netstat -tunap` produces real-time socket information, for example: ``` Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1023/sshd tcp 0 0 192.168.1.10:22 192.168.1.200:53422 ESTABLISHED 2048/ssh udp 0 0 0.0.0.0:68 0.0.0.0:* 512/dhclient ``` and from this he can tell which ports are listening, which remote host is connected and which PID owns the socket. Flags that matter Use `-t` for TCP, `-u` for UDP, `-l` for listening sockets and `-n` for numeric addresses; add `-p` as root to map sockets to processes, `-r` to show the routing table and `-i` to inspect interface statistics, which lets him switch focus quickly between connection lists and network diagnostics. When netstat reaches its limits netstat is part of the older net-tools collection and is sometimes missing on minimal systems; for high-performance filtering and richer output use `ss` and for address and route manipulation use `ip`, while `lsof -i` helps when the process view is primary. Where to go next Practice by hunting down unexpected listeners and tracing connections, then broaden the skillset with `ss`, `ip` and `tcpdump` to form a complete toolkit; consider formal study for CompTIA Linux+ or LPIC-1 and check out bitsandbytes.academy for intensive exam preparation. Join Bits & Bytes Academy First class LINUX exam preparation. network utilities troubleshooting security
