Ever wonder what ports are open on your Linux machine ? Did you ever want to know who was connecting to your machine and what services were they connecting to ? Netstat does just that.

To take a look at all TCP ports that are open on you system.
The use of the '-n' option will give you numerical addresses instead of determining the host. This speeds up the response of the output. The '-l' option only shows connections which are in "LISTEN" mode. And '-t' only shows the TCP connections.

netstat -nlt

[user@mymachine /home/user]# netstat -ntl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN

The above output show that I have 3 open ports (80, 3306, 22) on my sytem and are waiting for connections on all of the interfaces. The three ports are 80 => apache , 3306 => mysql, 22 => ssh.

Let's take a look at the active connections to this machine. For this you don't use the '-l' option but instead use the '-a' option. The '-a' stand for, yup, you guessed it, show all.

netstat -nat

[user@mymachine /user]# netstat -nat
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 206.112.62.102:80       204.210.35.27:3467      ESTABLISHED   
tcp        0      0 206.112.62.102:80       208.229.189.4:2582      FIN_WAIT2   
tcp        0   7605 206.112.62.102:80       208.243.30.195:36957    CLOSING     
tcp        0      0 206.112.62.102:22       10.60.1.18:3150         ESTABLISHED 
tcp        0      0 206.112.62.102:22       10.60.1.18:3149         ESTABLISHED 
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      

The above output shows I have 3 web request that are currently being made or are about to finish up. It also show I have 2 SSH connections established. Now I know which IP address are making web requests or have SSH connections open. For more info on the different states, ie "FIN_WAIT2" and "CLOSING" please consult your local man pages.

Well that was a quick tip on how to use netstat to see what TCP ports are open on your machine and who is connecting to them. Hope it was helpful. Share the knowledge !

• Adding the hostname to the XTERM titlebar - dead simple!
• Build RPMs as a User
• Netstat - What is it good for ?
• Moving Around the Console.
• RPM - Installing, Querying, Deleting your packages.
• More ways to add shortcuts to your desktop.
• Creating shortcuts under GNOME.
• How to trace what a program is doing.