Netstat Commands Explained: Windows and Linux Syntax, Plus the Modern ss Tool

The original version of this article promised that netstat's syntax "is different between" Windows and Linux, then never actually showed either one — just a list of things the tool can supposedly do, with no commands attached. This guide fills in what was missing: the real flags, on both platforms, mapped directly to each capability from that list, plus the modern Linux tool that's quietly replaced netstat on most current systems.

Windows: netstat and Its Flags

On Windows, a handful of flags cover everything the original list described:

• netstat -a — shows every connection and listening port, TCP and UDP, not just established ones. This is the command for "see what ports are in a listening state."
• netstat -n — displays addresses and ports numerically instead of resolving hostnames and service names, which makes the output return almost instantly. Almost always combined with -a, as netstat -an.
• netstat -o — adds the owning process ID (PID) to each connection. Pair it with tasklist /FI "PID eq <number>" to turn that PID into an actual process name — this is how you answer "see what process established the connection."
• netstat -b — shows the executable name directly, skipping the PID lookup step, plus the DLLs it loaded. It's the more direct route to the same answer as -o, but it requires an elevated (administrator) command prompt and runs noticeably slower, since Windows has to inspect every running process to build the list.
• netstat -e — displays Ethernet statistics: bytes and packets sent and received at the interface level.
• netstat -r — prints the routing table, identical to route print.
• netstat -p tcp (or udp) — restricts output to one protocol, useful once -a output gets long.

The combination worth memorizing is netstat -ano: every connection and listening port, numeric, with the PID attached. That single command answers four of the seven items on the original list at once.

Linux: netstat's Flags, and Why They May Not Work

Classic Linux netstat uses a different flag set entirely, inherited from BSD conventions rather than Windows:

• -t and -u — limit output to TCP or UDP sockets.
• -l — listening sockets only.
• -n — numeric addresses and ports, same purpose as on Windows.
• -p — shows the owning program name and PID, though viewing processes owned by other users requires running as root.
• -r — the routing table.
• -a — all sockets, listening and established.

The combination that mirrors Windows' -ano is sudo netstat -tulpn: TCP and UDP listening sockets, numeric, with process information.

Here's the catch the original stub missed entirely: on most current Linux distributions, that command may not exist at all. Linux netstat ships in the net-tools package, which is no longer maintained and isn't installed by default on a clean Debian, Ubuntu, Fedora, or RHEL system — the same situation covered for ifconfig in our ifconfig vs ip guide, because both tools come from the same deprecated package.

The Modern Replacement: ss

Where Linux has moved on, it's moved to ss (socket statistics), part of the actively maintained iproute2 package and installed by default on virtually every current distribution. It reads socket information directly from the kernel over Netlink rather than parsing /proc, which makes it noticeably faster on a system with a large number of connections.

The flags map almost one-to-one onto netstat's, which makes the transition easy:

• ss -t / ss -u — TCP or UDP sockets.
• ss -l — listening only.
• ss -n — numeric output.
• ss -p — owning process name and PID (again, sudo needed for processes you don't own).

And the combination to know cold: sudo ss -tulpn — the direct, modern equivalent of netstat -tulpn, and the one you should actually reach for first on a current Linux box. For the full list of command-line tools that have shifted from the old net-tools package to iproute2 — ip route replacing route, ip neigh replacing arp — see the ifconfig vs ip guide linked above, and our broader Linux Commands guide for the rest of the command-line toolkit tested on A+ and Linux+.

Answering the Original List, Command by Command

Mapping the stub's seven bullet points onto real syntax:

• Listening TCP/UDP ports — netstat -an (Windows) or ss -tuln (Linux).
• Which computers are involved in active connections — netstat -an on either platform; the foreign-address column names the remote host and port.
• Whether anything is connected before a reboot — netstat -an, scanning for ESTABLISHED entries rather than LISTENING ones.
• What process established a connection — netstat -ano + tasklist (Windows) or sudo ss -tulpn (Linux).
• Ethernet statistics — netstat -e (Windows only; Linux uses ip -s link for the equivalent counters).
• Owning process ID — the -o flag on Windows, the -p flag on Linux netstat and ss.
• Routing table — netstat -r on either platform, or ip route on current Linux.

Reading that output also assumes you recognize the port numbers in it — our Port Numbers guide covers the ones the exam expects you to identify on sight.

Why This Matters Beyond the Command Line

This isn't just a syntax-memorization exercise. An unexpected entry in LISTENING state — a port nobody on the team can account for — is one of the simplest indicators of compromise available, and it costs nothing but a single command to check. Combined with the owning PID, netstat and ss turn "something feels wrong with this server" into "process 4812, listening on port 4444, started by an account that shouldn't be running anything" in under a minute, before any log analysis or more invasive tooling comes into play.

Key Takeaways

• Windows: netstat -ano covers listening ports, active connections, and owning PID in one command; -b names the executable directly but needs elevation; -e and -r cover Ethernet stats and the routing table.
• Linux: classic netstat uses -tulpn for the same information, but it lives in the deprecated net-tools package and often isn't installed by default.
• ss is the modern Linux replacement — part of iproute2, faster because it reads from the kernel via Netlink, and sudo ss -tulpn is the command to reach for first.
• Both tools' flags map closely onto each other once you know the translation: -a/-n mean the same thing on both; PID ownership is -o on Windows and -p on Linux.
• An unrecognized listening port with its owning process identified is one of the fastest, lowest-cost indicators of compromise a defender has.