Video summary
The video introduces the `netstat` command as a versatile tool for gathering network information on Linux systems, utilizing a VirtualBox environment with a client, router, and server to demonstrate its capabilities. The presenter explains that `netstat` provides various sets of data including network connection details, interface statistics, and routing tables, noting that while other commands like `route` or `ip` can perform similar functions, `netstat` offers a consolidated view that is useful for understanding the historical context of different networking tools. One of the primary uses highlighted is viewing interface statistics with the `-i` flag, which displays metrics such as received and transmitted bytes and packets, allowing administrators to monitor the health and activity levels of specific network interfaces.
Beyond simple interface stats, the command offers deep insights into the TCP/IP stack through the `-s` option, which prints detailed statistics on IP packets, ICMP messages, and transport layer protocols like TCP and UDP. The output dynamically changes based on active communications, showing segments received or sent, as well as specific extension information that may not be displayed by default. This level of detail is particularly valuable for diagnosing network performance issues or understanding the flow of data across a system, making it an essential utility for anyone managing Linux servers where monitoring packet counts and protocol-specific metrics is necessary for troubleshooting.
A critical feature demonstrated is the ability to view active connections using the `-t` flag for TCP sockets, often combined with the `-n` option to display numeric addresses rather than resolving hostnames. This mode reveals established connections, such as a secure shell session between the client and server on port 22, helping users identify which external machines are currently communicating with their local services. Additionally, the `-l` flag allows administrators to see listening ports, effectively showing which services like SSH or web servers are ready to accept incoming connections, while the tool also supports IPv6 addresses, ensuring comprehensive visibility across different network protocols.
The video concludes by summarizing how `netstat` serves as a comprehensive alternative to specialized commands like `route`, capable of displaying routing tables, interface details, and statistical data all in one place. Although some UDP activity might not show up if no packets are being exchanged, the command remains a powerful starting point for network diagnostics due to its flexibility in handling both TCP and UDP communications. By exploring these various options, users can gain a clear picture of their network's current state, from active sockets and listening services to underlying protocol statistics, making it an indispensable tool for Linux system administration and security monitoring.
Read the full video transcript
we've got three Linux machines a client
router and server inside VirtualBox set
up in a small Internet let's have a look
at the command netstat on those machines
and we'll see the different options of
this providers nets that actually
provides many different sets of
information network connection
information network statistics we know
that I have config for example shows us
statistics for a particular interface
simple things like received bytes we
receive packets and so on mitts that has
a number of different options or modes
- I mode shows us interface information
so similarly information - I of conflict
but in a tabular format but mess that
shows us other information for example
we know the routing table can be viewed
using the route command the - end to
show the numeric addresses yes that has
a yes that has a - a routing table
information and it's identical
information to the rap demand so as as
the case with Linux a lot of times you
can do the same thing or similar things
using different tools and that's because
of historical reasons people have
developed different tools to do similar
things they have different trade-offs so
that information would normally seen one
other another useful option for netstat
and three - that is to show statistics
of the tcp/ip stack and that just prints
out statistics and I'll first scroll up
and show you those it shows IP
statistics packets received IP packets
received Internet control message
protocol statistics ICMP like 10
messages different message types and
then TCP and UDP transport layer
statistics and this will change as you
run your machine
and there's different communications
taking place TCP segments received sent
out UDP packets received and some
extension information about TCP and IP
IP which are not included by default so
if you want to see information about
packets sent then netstat minus s is a
good starting point so as we've seen
that that has different modes like
interfaces routing tables statistics we
look at the main page you can go through
and read about those different modes so
the routing table interfaces there's
other things like groups masquerade for
network address translation statistics
and the other useful one is to see TCP
and UDP connections or sockets let's
have a look at that let's that minus T
for TCP minus n for numeric addresses
this shows active TCP connections
ongoing or established in this case that
my client is involved with and
importantly it's showing that my IP
address 10 dot 0 dot 2.15 which is my
net interface and port number 22 which
is my secure shell server has an
established TCP connection with 10.0 2.2
and port 3 for 7:35 and a second
connection also with secure shell server
so with net stat minus T we can see
current connections to our server or
connections from our or from our
machine out to other servers and this is
useful if we're running TCP
secure shell servers web servers and
other servers on a machine you can see
the service that we're running all that
that we're listening on using a minus L
option this is saying that my machine
has a server listening on port 22
it also supports TCP or IP version 6
which is the second row there but this
one is saying I've got a secure shelters
serval waiting to receive packets on
port 22 if I was running a web server
then maybe I ought to have another entry
on listening on port 80 there's a
similar option for the UDP
communications although that's recorded
at a slightly different and in my case I
have nothing happening with UDP so
there's no interesting information shown
there so read through the next step men
pay to try some of those options to view
information primarily the minus T option
- you a common routing table if you
don't want to use the route command
interfaces some additional information
and the statistics and if you scroll
through it explains a lot of the
information included in the net step out