How to View Network Connections and Open Ports Using netstat in Linux

When you are troubleshooting a complex network issue on a Linux server, knowing your machine’s IP address is not enough. You must understand exactly which applications are actively listening on which network ports, and what external servers they are currently communicating with. While modern distributions often use ss, the legacy netstat (network statistics) command remains one of the most powerful and widely used tools for visualizing real-time network traffic and routing tables.

How to List Active Network Connections

If you simply run netstat by itself, it will output a massive, unsorted list of every single active socket on the system, which is practically unreadable. You must use specific flags to filter the data.

To view a clean list of all active TCP and UDP connections, open your terminal and run:

netstat -tuna

Here is a breakdown of those critical flags:

• -t: Show only TCP connections.
• -u: Show only UDP connections.
• -n: Numeric mode. This forces netstat to display raw IP addresses and port numbers (e.g., 192.168.1.5:443) instead of attempting to resolve them into slow, confusing domain names.
• -a: Show ALL sockets (both actively connected sessions and ports that are simply “LISTENING” for incoming traffic).

Identifying Which Program is Using a Port

If you see a suspicious foreign IP address connected to port 8080 on your server, you need to know exactly which application is responsible for that connection. You can force netstat to reveal the Process ID (PID) and the name of the program.

Because viewing process ownership requires administrative privileges, you must run this command using sudo:

sudo netstat -tunap

The -p (program) flag adds a new column to the far right side of the output. If you look at the suspicious port 8080 line, you might see 1452/java in the final column, instantly telling you that Process ID 1452 (a Java application) is responsible for the traffic.

How to View the Kernel Routing Table

Beyond active connections, netstat can also display how your server determines where to send outbound traffic. If you cannot reach the internet, your routing table is likely broken.

To view the raw routing table, run:

netstat -rn

The -r flag displays the routing table, and the -n flag ensures it prints the raw IP addresses. Look closely at the line that has a Destination of 0.0.0.0. This is your “Default Gateway” (your router). If the IP address listed under the Gateway column is incorrect, your server will never be able to communicate with the outside world.