There are a lot (and i mean, A LOT) of tools you can use to see what’s happening on a computer’s network. However, netstat allows you to gather some quick info about the network connections, on the spot. The most common set of options is ‘-atpn‘.
Running this command as user will only show the network connections for that user, while running it as root will show global network connections.
Shows both listening and non-listening sockets.
Shows only TCP connections
Shows the PID and name of the program to which each socket belongs.
Shows IPs instead of trying to resolve them to hostnames (faster)
The same thing can be obtained with lsof (list open files):
(only works as superuser so either run it as root or add ‘sudo’ in front of the command)
You can also watch the network connections in real-time as they are being made and closed:
(update every 5s)
watch -n5 'netstat -atpn'