netstat Command: Audit Network Connections and Open Ports on Linux

What is netstat?

netstat (network statistics) is a command-line utility that displays active network connections, listening ports, routing tables, and network interface statistics. It has been a standard Linux networking tool for decades and remains widely available on production systems even as ss has become the modern replacement. For security auditing, the combination netstat -tulpn is one of the most commonly used commands: it shows all TCP and UDP listening ports with the owning process name and PID. This immediately answers the critical security question: what services are publicly accessible on this server, and what processes are running them? During incident response, netstat -an reveals all established connections, allowing you to identify active C2 channels, unauthorized connections to internal services, and botnet beaconing activity by looking for ESTABLISHED connections to non-standard ports or unexpected remote addresses.

Syntax

netstat -tulpn
netstat -an
netstat -an | grep ESTABLISHED
netstat -an | grep LISTEN
netstat -s
netstat -rn

The -tulpn combination is the standard security audit command: TCP (-t), UDP (-u), listening only (-l), with process info (-p), and numeric addresses (-n). The -an combination shows all connections in all states. The -rn flag displays the routing table, useful for detecting unexpected route injections.

Key Options and Flags

Common Use Cases

Audit All Listening Services and Their Owning Processes

The most important security use of netstat is establishing exactly what services are publicly accessible on a server. Every listening socket on 0.0.0.0 or :: is accessible from the internet unless blocked by a firewall. Any service you did not intentionally configure should be investigated immediately.

netstat -tulpn

Find All Established Connections to Non-Standard Ports

C2 channels frequently use high or uncommon port numbers to blend with legitimate traffic. Filtering established connections and reviewing their remote ports against a known-good baseline quickly reveals suspicious outbound activity that warrants further investigation with lsof or ss.

netstat -an | grep ESTABLISHED | awk '{print $5}' | sort | uniq -c | sort -rn

Identify Unauthorized Listening Ports Opened by Malware

Backdoors and reverse shell listeners bind to a port on the server waiting for an inbound connection. After any suspected compromise, comparing netstat -tulpn output against a known baseline of expected services will reveal any new listeners. Pay particular attention to services listening on 0.0.0.0 (all interfaces) on ports you do not recognise.

netstat -tulpn | grep -v 'sshd\|nginx\|apache\|mysql\|postgres'

Security Relevance: Detecting C2 Channels via Established Socket Audit

Practical Examples

Full listening service audit with process names

netstat -tulpn

The standard security audit command. Shows every service bound to a port, the protocol, the bind address, and the owning process. Any unfamiliar entry should be cross-referenced with ps aux and lsof.

Count and rank remote IPs by number of established connections

netstat -an | grep ESTABLISHED | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -20

Surfaces the top remote IP addresses by connection count. A single IP with an unusually high number of connections may indicate a botnet node, a DoS source, or an active data exfiltration session.

Check routing table for unexpected gateway entries

netstat -rn

Displays the kernel routing table. An unexpected default gateway or a specific route pointing to an internal IP that you did not configure can indicate ARP spoofing or a routing hijack on the local network.

Troubleshooting Common Issues

Summary

netstat remains a reliable and widely available tool for network security auditing on Linux servers. The -tulpn combination provides an immediate answer to what is listening on your server, and -an | grep ESTABLISHED surfaces active connections that may represent C2 channels or unauthorized access. On modern systems, consider using ss as a faster alternative while keeping netstat in your toolkit for systems where ss is not available.

• Run netstat -tulpn as the first network audit command on any new or suspected-compromised server
• Any ESTABLISHED connection to an IP outside your known infrastructure warrants investigation with lsof -p <pid>
• netstat requires root to show process names — always run with sudo for complete output