Show List of Listening Services in Linux using netstat

Posted on

To be able to list for available service which is listening on Linux operating system distribution, it can be done by executing the appropriate command executed in any command line interface or terminal as long as it is being recognized by the shell.

The most popular command which can be used is ‘netstat’. The other one is by using ‘ss’. While netstat is more general on printing network connections, routing tables, interface statistics, etc, on the other hand ss is more specifically intended as a utility to investigate sockets.

In this article, we will discuss ‘netstat’ command usage with specific parameter. Below are theparameter usage passed to netstat command . First of all, the  a netstat executed command in command line interface is typed as follow :

netstat -tulpn

The above executed command can be shown as follows :

root@hostname:/opt# netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 29067/mysqld
tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN 2296/smbd
tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN 1385/redis-server 1
tcp 0 0 127.0.0.1:11211 0.0.0.0:* LISTEN 1250/memcached
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 947/rpcbind
tcp 0 0 0.0.0.0:50000 0.0.0.0:* LISTEN 1552/monetdbd
tcp 0 0 0.0.0.0:58324 0.0.0.0:* LISTEN 1291/rpc.mountd
tcp 0 0 127.0.1.1:53 0.0.0.0:* LISTEN 28139/dnsmasq
tcp 0 0 192.168.122.1:53 0.0.0.0:* LISTEN 2313/dnsmasq
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1248/sshd
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 8790/cupsd
tcp 0 0 127.0.0.1:3128 0.0.0.0:* LISTEN 1515/cntlm
tcp 0 0 127.0.0.1:5432 0.0.0.0:* LISTEN 1128/postgres
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 3261/master
tcp 0 0 0.0.0.0:5433 0.0.0.0:* LISTEN 1247/postgres
tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN 2296/smbd
tcp 0 0 0.0.0.0:42688 0.0.0.0:* LISTEN 1291/rpc.mountd
tcp 0 0 0.0.0.0:2049 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:5666 0.0.0.0:* LISTEN 1581/nrpe
tcp 0 0 0.0.0.0:39043 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:55683 0.0.0.0:* LISTEN 1291/rpc.mountd
tcp 0 0 127.0.0.1:27017 0.0.0.0:* LISTEN 1474/mongod
tcp6 0 0 :::139 :::* LISTEN 2296/smbd
tcp6 0 0 :::6379 :::* LISTEN 1516/redis-server *
tcp6 0 0 :::53291 :::* LISTEN 1291/rpc.mountd
tcp6 0 0 :::51758 :::* LISTEN 1291/rpc.mountd
tcp6 0 0 :::111 :::* LISTEN 947/rpcbind
tcp6 0 0 :::80 :::* LISTEN 1966/apache2
tcp6 0 0 :::56432 :::* LISTEN 1291/rpc.mountd
tcp6 0 0 :::22 :::* LISTEN 1248/sshd
tcp6 0 0 ::1:631 :::* LISTEN 8790/cupsd
tcp6 0 0 :::25 :::* LISTEN 3261/master
tcp6 0 0 :::5433 :::* LISTEN 1247/postgres
tcp6 0 0 :::443 :::* LISTEN 1966/apache2
tcp6 0 0 :::445 :::* LISTEN 2296/smbd
tcp6 0 0 :::2049 :::* LISTEN -
tcp6 0 0 :::5666 :::* LISTEN 1581/nrpe
tcp6 0 0 :::46280 :::* LISTEN -
udp 0 0 192.168.1.100:49930 0.0.0.0:* 7316/dleyna-rendere
udp 0 0 0.0.0.0:49994 0.0.0.0:* 1552/monetdbd
udp 0 0 0.0.0.0:50000 0.0.0.0:* 1552/monetdbd
udp 0 0 172.17.0.1:54117 0.0.0.0:* 7316/dleyna-rendere
udp 0 0 0.0.0.0:33767 0.0.0.0:* 1291/rpc.mountd
udp 0 0 127.0.0.1:50375 0.0.0.0:* 7316/dleyna-rendere
udp 0 0 0.0.0.0:5353 0.0.0.0:* 20149/libpepflashpl
udp 0 0 0.0.0.0:5353 0.0.0.0:* 998/avahi-daemon: r
udp 0 0 0.0.0.0:42770 0.0.0.0:* -
udp 0 0 239.255.255.250:1900 0.0.0.0:* 7316/dleyna-rendere
udp 0 0 192.168.1.100:1900 0.0.0.0:* 7316/dleyna-rendere
udp 0 0 239.255.255.250:1900 0.0.0.0:* 7316/dleyna-rendere
udp 0 0 192.168.122.1:1900 0.0.0.0:* 7316/dleyna-rendere
udp 0 0 239.255.255.250:1900 0.0.0.0:* 7316/dleyna-rendere
udp 0 0 172.17.0.1:1900 0.0.0.0:* 7316/dleyna-rendere
udp 0 0 239.255.255.250:1900 0.0.0.0:* 7316/dleyna-rendere
udp 0 0 192.168.1.130:1900 0.0.0.0:* 7316/dleyna-rendere
udp 0 0 239.255.255.250:1900 0.0.0.0:* 7316/dleyna-rendere
udp 0 0 127.0.0.1:1900 0.0.0.0:* 7316/dleyna-rendere
udp 0 0 0.0.0.0:2049 0.0.0.0:* -
udp 0 0 192.168.122.1:59466 0.0.0.0:* 7316/dleyna-rendere
udp 0 0 127.0.0.1:11211 0.0.0.0:* 1250/memcached
udp 0 0 0.0.0.0:52485 0.0.0.0:* 1291/rpc.mountd
udp 0 0 0.0.0.0:44369 0.0.0.0:* 998/avahi-daemon: r
udp 0 0 192.168.1.130:53027 0.0.0.0:* 7316/dleyna-rendere
udp 0 0 127.0.1.1:53 0.0.0.0:* 28139/dnsmasq
udp 0 0 192.168.122.1:53 0.0.0.0:* 2313/dnsmasq
udp 0 0 0.0.0.0:67 0.0.0.0:* 2313/dnsmasq
udp 0 0 0.0.0.0:68 0.0.0.0:* 5321/dhclient
udp 0 0 0.0.0.0:68 0.0.0.0:* 5307/dhclient
udp 0 0 0.0.0.0:111 0.0.0.0:* 947/rpcbind
udp 0 0 192.168.1.100:123 0.0.0.0:* 5841/ntpd
udp 0 0 192.168.1.130:123 0.0.0.0:* 5841/ntpd
udp 0 0 127.0.0.1:123 0.0.0.0:* 5841/ntpd
udp 0 0 0.0.0.0:123 0.0.0.0:* 5841/ntpd
udp 0 0 192.168.1.255:137 0.0.0.0:* 2110/nmbd
udp 0 0 192.168.1.130:137 0.0.0.0:* 2110/nmbd
udp 0 0 192.168.1.255:137 0.0.0.0:* 2110/nmbd
udp 0 0 192.168.1.100:137 0.0.0.0:* 2110/nmbd
udp 0 0 192.168.122.255:137 0.0.0.0:* 2110/nmbd
udp 0 0 192.168.122.1:137 0.0.0.0:* 2110/nmbd
udp 0 0 172.17.255.255:137 0.0.0.0:* 2110/nmbd
udp 0 0 172.17.0.1:137 0.0.0.0:* 2110/nmbd
udp 0 0 0.0.0.0:137 0.0.0.0:* 2110/nmbd
udp 0 0 192.168.1.255:138 0.0.0.0:* 2110/nmbd
udp 0 0 192.168.1.130:138 0.0.0.0:* 2110/nmbd
udp 0 0 192.168.1.255:138 0.0.0.0:* 2110/nmbd
udp 0 0 192.168.1.100:138 0.0.0.0:* 2110/nmbd
udp 0 0 192.168.122.255:138 0.0.0.0:* 2110/nmbd
udp 0 0 192.168.122.1:138 0.0.0.0:* 2110/nmbd
udp 0 0 172.17.255.255:138 0.0.0.0:* 2110/nmbd
udp 0 0 172.17.0.1:138 0.0.0.0:* 2110/nmbd
udp 0 0 0.0.0.0:138 0.0.0.0:* 2110/nmbd
udp 0 0 0.0.0.0:45314 0.0.0.0:* 1291/rpc.mountd
udp 0 0 0.0.0.0:631 0.0.0.0:* 1142/cups-browsed
udp 0 0 0.0.0.0:699 0.0.0.0:* 947/rpcbind
udp6 0 0 :::46283 :::* 1291/rpc.mountd
udp6 0 0 :::5353 :::* 998/avahi-daemon: r
udp6 0 0 :::51118 :::* 1291/rpc.mountd
udp6 0 0 :::2049 :::* -
udp6 0 0 :::43520 :::* 1291/rpc.mountd
udp6 0 0 :::35714 :::* 998/avahi-daemon: r
udp6 0 0 :::52906 :::* -
udp6 0 0 :::111 :::* 947/rpcbind
udp6 0 0 fe80::2e0:4cff:fe53:123 :::* 5841/ntpd
udp6 0 0 fe80::5e51:4fff:fe7:123 :::* 5841/ntpd
udp6 0 0 fd08:63aa:7554:1:5e:123 :::* 5841/ntpd
udp6 0 0 fd08:63aa:7554:1:25:123 :::* 5841/ntpd
udp6 0 0 ::1:123 :::* 5841/ntpd
udp6 0 0 :::123 :::* 5841/ntpd
udp6 0 0 :::699 :::* 947/rpcbind
root@hostname:/opt#

The output of the above command’s execution will be explained generally as follows :

Protocol : The first column explains the protocol used to transfer data which can be called as description of transfer protocol. There are two types of transfer protocol which is commonly used to be able transfer data over network. The first one is TCP (Transmission Control Protocol) and the latter is UDP (User Datagram Protocol). Both of them have their version 4 and version 6 respectively. It is marked with tcp for TCP protocol to support IP version 4, tcp6 for TCP protocol to support IP Version 6.  And then udp for UDP protocol to support IP version 4, the last one is udp6 for UDP protocol to support IP version 6.

Recv-Q : It tells how much data waiting to be received for that socket. Normally it is zero, if it is non-zero there may be some trouble regarding application or program which is connected to the socket.

Send-Q : It tells how much data waiting to be sent for that socket. Normally it is also zero, when it is non-zero it represents data which cannot be processed by this host, server or workstation through the socket.

Local Address : Local end of the socket which is the address of the host, workstation, server or computer where netstat is running.

Foreign Address : Remote end of the socket which is the address of and the foreign end is about the other computer (could be somewhere in the local network or somewhere on the internet).

State : The state of the socket and there are several values for it.

PID/Program : It is the PID and also the name of the program to which each socket belongs.

There will be extraction of several output which is going to be explained further :

tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN 2296/smbd

The above line shows that there is a service named smbd and it has PID number 2296. It is using protocol TCP and it actually listen in all interfaces in the local workstation, host or server. The state of the local socket is listening on port 139.

tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 29067/mysqld

On the other hand, the above line can be read that there is a service named mysqld and it has PID number 29067. It is using protocol TCP and it actually listen only in loopback interface or only on local interface in the local workstation, host or server. The state of the local socket is listening on port 3306.

One thought on “Show List of Listening Services in Linux using netstat

Leave a Reply