Examining Network Port Status from the Command Line

Understanding Network Ports and Command-Line Tools

Network ports are essential for communication between computers on a network. Each application or service that communicates over a network uses a specific port number. Sometimes, you need to verify if a particular port is being used by a process, if a service is listening on that port, or to diagnose network connectivity issues. Fortunately, command-line tools provide a powerful way to inspect port status directly.

Using netstat

The netstat utility is a classic tool for displaying network connections, routing tables, interface statistics, masquerade connections, and multicast memberships. While netstat is considered legacy on some systems, it remains widely available and useful for quick port checks.

The basic syntax for using netstat to examine a specific port is:

netstat -an | grep <port_number>   # Linux/macOS
netstat -ano | findstr "<port_number>" # Windows

Let’s break down the command:

• netstat -an: This part instructs netstat to display all active network connections and listening ports in numerical format. The -a option shows all connections, and the -n option prevents netstat from resolving port numbers to service names (e.g., 80 becomes http), making the output cleaner and faster.
• |: This is the pipe operator. It sends the output of netstat as input to the next command.
• grep <port_number> (Linux/macOS) or findstr "<port_number>" (Windows): This command filters the output of netstat, displaying only lines that contain the specified <port_number>. The double quotes around the port number in findstr are important to ensure the command works correctly.

Example:

To check if anything is listening on port 8080, you would use:

netstat -an | grep 8080  # Linux/macOS
netstat -ano | findstr "8080" # Windows

The output will show any connections or listening sockets associated with that port.

Identifying the Process Using the Port

Sometimes you need to know which process is using a specific port. The -o option of netstat (Windows) and the inclusion of the PID within the output can help with this.

On Windows:

netstat -ano | findstr "<port_number>"

This command will display the Process Identifier (PID) of the process using the port. You can then use Task Manager or other process monitoring tools to identify the process associated with that PID.

Additional netstat Options

• -p: (Linux/macOS) Displays the PID and program name for each socket.
• -t: Displays TCP connections.
• -u: Displays UDP connections.
• -l: Displays only listening sockets.

Modern Alternatives

While netstat is a valuable tool, newer alternatives like ss (socket statistics) are becoming more prevalent on Linux systems. ss is generally faster and more informative than netstat.

Example using ss:

ss -tulnp | grep <port_number>

• -t: Show TCP sockets.
• -u: Show UDP sockets.
• -l: Show listening sockets.
• -n: Show numerical addresses.
• -p: Show process using socket.