Netstat command

netstat command is available on most Unix and Windows platforms. It's a very useful utility which supports various command line switches depending on the platform. On the CS server wyvern (137.140.7.220) you can run man netstat to see the man pages.

netstat -a -t (or netstat -at) shows all the TCP connections on the host.

netstat -ad and netstat -au shows UDP and Unix socket connections.

For example, here's an edited session on wyvern:

wyvern:~$ netstat -ant
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 137.140.7.220:80        137.140.21.100:37522  TIME_WAIT
tcp        0      0 137.140.7.220:80        137.140.21.100:37519  TIME_WAIT
tcp        0    768 137.140.7.220:22        69.160.182.170:56963  ESTABLISHED
tcp        0      0 137.140.7.220:33138     137.140.7.101:636     ESTABLISHED
tcp        0      0 137.140.7.220:797       137.140.7.101:2049    CLOSE_WAIT

The -n switch suppresses names and gives only IP addresses. The -t switch shows TCP connections. The numbers following the colons after each IP number is the port number of that connection. State of a connection is a concept we will see later.

Port numbers 0 to 1023 are termed well-known ports, and are reserved for special applications that people commonly use. For example the SSH server listens for connections on TCP port 22, and the HTTP server listens on TCP port 80. Internet Assigned Numbers Authority (IANA) manages reserved numbers for various protocols above the link layer. They have an online database at http://www.iana.org/assignments/port-numbers which replaced an earlier RFC 1700. This database lists well-known port numbers. Port numbers 1024 to 49151 are called Registered ports, and can be used by application/client processes. Looking at this list shows that the last entry in the example above is an NFS (network file system) operation.