netstat — Show network connections, listening ports, and routing tables across all 5 shells
Equivalents in every shell
ss -tunlpss -tunlpSame external binaries as bash. `ss` is the modern replacement for `netstat` on Linux.
ss -tunlpGet-NetTCPConnection -State ListenObject-oriented. Add `| Where-Object { $_.LocalPort -eq 8080 }` to filter by port.
netstat -ano`-a` all, `-n` numeric, `-o` show owning PID. Pipe `| findstr :PORT` to filter.
Worked examples
List all TCP listeners with owning PID
ss -tlnpGet-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcessnetstat -ano | findstr LISTENINGFind what process owns port 3000
ss -tlnp | grep :3000Get-NetTCPConnection -LocalPort 3000 | Select-Object LocalAddress, OwningProcessnetstat -ano | findstr :3000Show the routing table
ip routeGet-NetRouteroute printGotchas
- On Linux, `netstat` is deprecated in favor of `ss` (from `iproute2`); the legacy binary may not even be installed on minimal images.
- macOS `netstat` syntax differs from Linux: use `netstat -anv -p tcp` and `lsof -iTCP -sTCP:LISTEN -P` instead.
- Windows `netstat` is built-in and behaves like the classic Unix `netstat`, but the PowerShell `Get-NetTCPConnection` returns rich objects you can pipe further.
WSL & PowerShell Core notes
Common tasks using netstat
- Find all listening ports across every network interface
List every TCP / UDP port currently accepting connections on the local host — for security audits ("what is exposed?"), firewall rule verification, troubleshooting "address already in use" errors, and inventory of running services.
- Find which process is listening on a port
Identify the PID and process name bound to a local TCP/UDP port — for debugging "address already in use" errors, auditing what's exposed, and killing a zombie server holding port 3000.
- Kill the process listening on a port
Find and terminate whatever process is bound to a TCP/UDP port — the answer to "address already in use" when a previous run did not release the socket.
- Scan a port range on a host
Check which TCP/UDP ports are open on a target host — for service discovery, firewall validation, post-deploy "is the new server reachable?" smoke tests, or troubleshooting connectivity ahead of an SSH/HTTP call that's timing out.