4. netstat

Well Known Ports

We've discussed data transmission through ports on our machine, let's look at some well known ports.

You can get a list of well-known ports by looking at the file /etc/services:

ftp 21/tcp
ssh 22/tcp
smtp 25/tcp
domain 53/tcp # DNS
http 80/tcp
https 443/tcp

The first column is the name of the service, then the port number and the transport layer protocol it uses.


An extremely useful tool to get detailed information about your network is netstat. Netstat displays various network related information such network connections, routing tables, information about network interfaces and more, it's the swiss army knife of networking tools. We will focus mostly on one feature netstat has and that's the status of network connections. Before we look at an example, let's talk about sockets and ports first. A socket is an interface that allows programs to send and receive data while a port is used to identify which application should send or receive data. The socket address is the combination of the IP address and port. Every connection between a host and destination requires a unique socket. For example, HTTP is a service that runs on port 80, however we can have many HTTP connections and to maintain each connection a socket gets created per connection.

pete@icebox:~$ netstat -at
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 icebox:domain *:* LISTEN
tcp 0 0 localhost:ipp *:* LISTEN
tcp 0 0 icebox.lan:44468 TIME_WAIT
tcp 0 0 icebox.lan:34751 TIME_WAIT
tcp 0 0 icebox.lan:34604 economy.canonical.:http TIME_WAIT
tcp6 0 0 ip6-localhost:ipp [::]:* LISTEN
tcp6 1 0 ip6-localhost:35094 ip6-localhost:ipp CLOSE_WAIT
tcp6 0 0 ip6-localhost:ipp ip6-localhost:35094 FIN_WAIT2

The netstat -a command shows the listening and non-listening sockets for network connections, the -t flag shows only tcp connections.

The columns are as follows from left to right:

  • Proto: Protocol used, TCP or UDP.

  • Recv-Q: Data that is queued to be received

  • Send-Q: Data that is queued to be sent

  • Local Address: Locally connected host

  • Foreign Address: Remotely connected host

  • State: The state of the socket

See the manpage for a list of socket states, but here are a few:

  • LISTENING: The socket is listening for incoming connections, remember when we make a TCP connection our destination has to be listening for us before we can connect.

  • SYN_SENT: The socket is actively attempting to establish a connection.

  • ESTABLISHED: The socket has an established connection

  • CLOSE_WAIT: The remote host has shutdown and we're waiting for the socket to close

  • TIME_WAIT: The socket is waiting after close to handle packets still in the network


Look at the manpage for netstat and learn all the features it has to offer.


What port is used for HTTPS?