Mastering Network Diagnostics with `netstat` and `ifstat`

Table of Contents#

1. netstat: Deep Dive into Network Connections
   • Key Features
   • Common Commands and Examples
   • Best Practices
2. ifstat: Monitoring Network Interface Statistics
   • Key Features
   • Common Commands and Examples
   • Best Practices
3. Modern Alternative: The ss Command
4. Comparing netstat, ss, and ifstat
5. Conclusion
6. References

netstat: Deep Dive into Network Connections#

Key Features of netstat#

netstat reveals critical network details:

• Active Connections: Lists TCP/UDP connections (e.g., ESTABLISHED, LISTENING, SYN_SENT).
• Listening Ports: Identifies open ports and the processes using them.
• Routing Tables: Displays kernel-level routing information (e.g., default gateways, subnets).
• Protocol Statistics: Provides detailed stats for TCP, UDP, ICMP, and IP (e.g., retransmissions, packet loss).
• Process Mapping: Maps network connections to processes (PID and name) (requires root).

Note: netstat is part of the deprecated net-tools package. On modern distributions, use ss for connection and socket data, ip route for routing tables, and ip -s link for interface statistics. The netstat examples below still work on systems where net-tools is installed, but ss is the recommended tool going forward.

Common netstat Commands and Examples#

1. List All Active Connections (TCP/UDP)#

netstat -a

• Includes all TCP (e.g., ESTABLISHED, LISTENING) and UDP connections.
• UDP is connectionless, so LISTENING for UDP indicates a socket bound to a port and ready to receive datagrams—not a true listening state as in TCP.

2. Filter by Protocol (TCP or UDP)#

• TCP only:

  netstat -t

• UDP only:

  netstat -u

3. Show Listening Ports (No DNS Lookups)#

Avoid slow DNS lookups (use numeric IPs/ports) and show only listening ports:

netstat -tuln

• -t: TCP, -u: UDP, -l: LISTENING, -n: Numeric (no DNS).

4. Map Connections to Processes (PID/Program)#

Requires root (or sudo) to see all processes:

sudo netstat -tulnp

• -p: Show process ID (PID) and program name.
• Example output (truncated):

  Proto Recv-Q Send-Q Local Address   Foreign Address   State       PID/Program name
  tcp        0      0 0.0.0.0:22      0.0.0.0:*         LISTEN      1234/sshd
  tcp        0      0 127.0.0.1:5432  0.0.0.0:*         LISTEN      5678/postgres
  

5. Routing Table (Kernel Routes)#

netstat -r

• Displays the kernel’s IP routing table (equivalent to ip route show or route -n).

6. Protocol Statistics (TCP, UDP, ICMP, IP)#

netstat -s

• Example (TCP snippet):

  Ip:
      Forwarding: 2
      12345 total packets received
      0 with invalid addresses
      ...
  Tcp:
      1234 active connections openings
      567 passive connection openings
      89 failed connection attempts
      ...
  

Best Practices for netstat#

1. Use -n for Speed: Skip DNS lookups with -n (faster, especially on slow DNS systems).
2. Run as Root: To view all processes (non-root users can’t see system services’ connections).
3. Combine Options: Use -tuln (TCP/UDP, LISTENING, numeric) for a quick “listening ports” check.
4. Security Audits: Regularly run netstat -tuln to ensure no unauthorized services are listening.
5. Monitor Connections: Check ESTABLISHED connections for unusual activity (e.g., unexpected outbound traffic).

ifstat: Monitoring Network Interface Statistics#

Key Features of ifstat#

ifstat focuses on interface-level metrics:

• Bandwidth Usage: Tracks incoming/outgoing (I/O) bytes, packets, and rates (Kbps, Mbps).
• Error Counts: Monitors TX/RX errors (e.g., CRC errors, dropped packets).
• Collisions: Tracks Ethernet collisions (rare in modern networks but useful for legacy setups).
• Real-Time Updates: Continuously refreshes stats (ideal for troubleshooting live issues).

Common ifstat Commands and Examples#

1. Basic Interface Stats (Default Interfaces)#

ifstat

• Output (example):

  eth0           Lo
  KB/s in  KB/s out   KB/s in  KB/s out
  0.00     0.00        0.00     0.00
  1.23     0.45        0.00     0.00
  ...
  

• Displays eth0 (Ethernet) and lo (loopback) by default.

2. Specify Interfaces (E.g., eth0, wlan0)#

ifstat -i eth0,wlan0

• Shows stats only for eth0 and wlan0.
• Use the -i flag with comma-separated interface names to monitor specific interfaces (useful for excluding the loopback interface).

3. Set Update Interval (E.g., Every 5 Seconds)#

ifstat -i eth0 5

• Updates eth0 stats every 5 seconds (the delay is a positional argument).

4. Units (KBytes/sec vs Kbits/sec)#

• Default: Reports bandwidth in KBytes/sec.
• Kbits/sec:

  ifstat -b

  • -b switches the unit from KBytes/sec to Kbits/sec.

Note: Some distributions package a different version of ifstat that supports additional flags (e.g., -k, -m for unit selection, -p for packets, -e for errors, -c for collisions). Check man ifstat on your system for the exact options available.

Best Practices for ifstat#

1. Target Interfaces: Use -i eth0 (or multiple interfaces) to focus on specific links (e.g., WAN, LAN).
2. Set Interval: For long-term monitoring, use a larger interval (e.g., ifstat -i eth0 10 for 10-second updates).
3. Use -b for Bits: Switch from KBytes/sec to Kbits/sec with -b when comparing with bandwidth specs (e.g., ISP speeds).
4. Scripting: Specify a sample count to limit output (e.g., ifstat 1 10 for 10 samples at 1-second intervals, then redirect to a file).
5. Hide Zeros: Use -z to suppress interfaces with no activity, keeping output clean.

Note: The examples above use the standalone ifstat (by Gaël Roualland), which is commonly available in distribution repositories. An alternative ifstat implementation is included in the iproute2 package with different options (e.g., -d for scan interval, -e for errors, -j for JSON output). Check which ifstat and man ifstat on your system to confirm which version you have.

Modern Alternative: The ss Command#

Since netstat is deprecated, the ss command (from the iproute2 package) is its direct replacement on modern Linux systems. ss is faster, reads directly from kernel socket structures, and supports more detailed filtering.

Common ss Commands and Examples#

1. List All Listening TCP Ports (No DNS)#

ss -tuln

• -t: TCP, -u: UDP, -l: listening, -n: numeric (no DNS).
• Direct replacement for netstat -tuln.

2. Show All TCP Connections#

ss -t -a

3. Map Connections to Processes#

sudo ss -tulnp

• -p: Show process information (requires root).

4. Display Socket Memory Usage#

ss -s

• Provides a summary of socket statistics (total, TCP, UDP).

5. Filter by State (E.g., Established)#

ss -t state established

• ss supports state-based filtering, which netstat does not.

netstat to ss Quick Reference#

Comparing netstat, ss, and ifstat#

Conclusion#

• netstat is a classic tool for connection-level insights: identifying open ports, active connections, and protocol behavior. While still functional on many systems, it is deprecated—prefer ss for new workflows.
• ss is the modern replacement for netstat, offering faster performance, richer socket detail, and state-based filtering. Use it for security audits, process-port mapping, and connection monitoring.
• ifstat excels at interface-level monitoring: tracking bandwidth usage, packet errors, and collisions. It’s perfect for capacity planning, troubleshooting network congestion, or diagnosing physical layer issues.

Together, ss and ifstat (or ip commands) provide a comprehensive view of your network—from application-level connections to raw interface performance. Experiment with these tools to troubleshoot, monitor, and secure your infrastructure.

References#

1. netstat man page: man netstat (Linux) or netstat(8) — man7.org.
2. ss man page: man ss (Linux) or ss(8) — man7.org.
3. ifstat man page: man ifstat (Linux) or ifstat(1) — Linux man page.
4. iproute2 cheatsheet — practical guide to ip, ss, and other iproute2 commands.
5. Linux Command Library — cheat sheets and examples for netstat, ss, and ifstat.
6. Red Hat: 6 deprecated Linux commands and the tools you should be using instead — background on netstat deprecation.