Displaying Connections

Netstat supports a set of options to display active or passive sockets. The options -t, -u, -w, and -x show active TCP, UDP, RAW, or UNIX socket connections. If you provide the -a flag in addition, sockets that are waiting for a connection (i.e. listening) are displayed as well. This will give you a list of all servers that are currently running on your system.

Invoking netstat -ta on vlager produces:

           $ netstat -ta
           Active Internet connections
           Proto Recv-Q Send-Q Local Address    Foreign Address    (State)
           tcp        0      0 *:domain         *:*                LISTEN
           tcp        0      0 *:time           *:*                LISTEN
           tcp        0      0 *:smtp           *:*                LISTEN
           tcp        0      0 vlager:smtp      vstout:1040        ESTABLISHED
           tcp        0      0 *:telnet         *:*                LISTEN
           tcp        0      0 localhost:1046   vbardolino:telnet  ESTABLISHED
           tcp        0      0 *:chargen        *:*                LISTEN
           tcp        0      0 *:daytime        *:*                LISTEN
           tcp        0      0 *:discard        *:*                LISTEN
           tcp        0      0 *:echo           *:*                LISTEN
           tcp        0      0 *:shell          *:*                LISTEN
           tcp        0      0 *:login          *:*                LISTEN

This shows most servers simply waiting for an incoming connection. However, the fourth line shows an incoming SMTP connection from vstout, and the sixth line tells you there is an outgoing telnet connection to vbardolino.

Using the -a flag all by itself will display all sockets from all families.