2

I'm looking for a simple command that will list ALL currently active and/or otherwise bound TCP & UDP sockets, corresponding port numbers and their respective states (i.e. ESTABLISHED, LISTEN, WAIT, etc.)

Sort of like a reverse nmap scan is what I'm going for here.

4

From netstat's manual page:

The netstat command symbolically displays the contents of various network-related data structures. There are a number of output formats, depending on the options for the information presented. The first form of the command displays a list of active sockets for each protocol.

pse@Mithos:~$ netstat
Active Internet connections
Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)    
tcp4       0      0  localhost.8228         localhost.52662        ESTABLISHED
tcp4       0      0  localhost.52662        localhost.8228         ESTABLISHED
tcp4       0      0  192.168.1.30.52661     stackoverflow.co.https ESTABLISHED
tcp4       0      0  localhost.8228         localhost.52656        ESTABLISHED
tcp4       0      0  localhost.52656        localhost.8228         ESTABLISHED
tcp4       0      0  localhost.8228         localhost.52651        ESTABLISHED
...
  • This gives syntax error near unexpected token ('` – clankill3r Jan 23 at 16:08
  • @clankill3r how are you calling netstat? – nohillside Jan 23 at 16:10
  • man netstat(1) – clankill3r Jan 24 at 13:17
  • @clankill3r Try man netstat for the manual page, netstat for the command itself. – nohillside Jan 24 at 13:26
4

This is old, but came a across it when trying to find an ultra quick way of doing this to monitor a script I'm writing, so figured I'd post for your purpose in case anyone else is interested...

Another way to do it is to use lsof.

lsof -n -i | grep -e LISTEN -e ESTABLISHED

One benefit of this is it shows the process that has established the socket. To see wait, just add -e WAIT on the end of it. I know certain versions of netstat show process with the -b switch, but not the OSX/BSD one apparently...

  • 1
    You need to run this as root (i.e. use sudo) to see other users' processes. Also, you can skip the grep by telling lsof you only want sockets in those states: sudo lsof -niTCP -sTCP:LISTEN,ESTABLISHED – Gordon Davisson Nov 26 '16 at 5:54
  • Yeah sorry. Root access is required to see all ports. Good catch! – Chris Gleason Dec 15 '16 at 0:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .