Every netstat article usually starts with a description and some tiny code examples, but since this tool is all about OPTIONS, so this time I'll use some visual aids to do you a favor.

- netstat -nr shows the route without resolving any name (ie."link-local" would look like "169.254.0.0").

- netstat -i shows interfaces statistics (ie. TX-OK, RX-OK, MTU, etc.).

- netstat -ta or -ua shows all TCP or UDP connections.

- netstat -lotanpu shows you all you need to know, including the PID/Program name: just enlarge your terminal to at least 124!

That's should keep you going for the most part.
Keep reading for more details.

netstat -nr

netstat -nr shows the route without resolving names.

MSS (Maximum Segment Size) is the size of the largest L3 datagram the kernel will construct for transmission via this route.

Window is the maximum amount of data the system will accept on a single burst from a remote host.

irtt (initial round-trip time) is the value that the TCP protocol will use when a connection is first established.
TCP protocol keeps a running count of how long it takes for a datagram to be delivered AND an acknowledgement to be received (ie. the total time, for a packet, to go and come back), so that it knows how long to wait before assuming a datagram needs to retransmitted: round−trip time!

Flags:

G = Is a Gateway.

U = Interface is up.

 

netstat -i

netstat -i shows interfaces statistics.

The MTU and Met fields show the current MTU and metric values for that interface.

The RX−OK TX−OK are obvious: received or transmitted error−free packets.

RX−ERR and TX−ERR are how many packets were damaged.

RX−DRP and TX−DRP how many were dropped.

RX−OVR/TX−OVR) how many packets were lost because of an overrun.

FLAGS:

B = a broadcast address has been set.

M = All packets are received (aka promiscuous mode).

O = ARP is turned off for this interface.

P = This is a point−to−point connection.

R = Interface is running.

U = Interface is up.

L = this interface is a loopback device.

Rate this post