Install netstat on Debian 11

Like all packages belonging to the net-tools collection, the command netstat isn’t included in new Linux distributions such as Debian 11. This tutorial explains how to add the netstat command on Debian 11, its predecessors, and based Linux distributions such as Ubuntu.

Symptom:

When trying to run netstat, you get the error shown in the screenshot below.

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/09/echo/1-35.jpg" data-lazy- height="162" src="data:image/svg xml,” width=”729″>

Reason:

The net-tools collection, which includes the netstat utility, was deprecated and replaced with iproute2. The current network utility collection Iproute2 replaces netstat with the ss command. Some net-tools replacements can be found in the table below.

Solution: Installing netstat on Debian 11

Installing netstat on Debian and its distributions is as simple as installing other packages using the apt command. Just run the command below to get the net-tools collection installed.

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/09/echo/2-34.jpg" data-lazy- height="529" src="data:image/svg xml,” width=”1130″>

Now you are able to run netstat, as shown in the screenshot below.

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/09/echo/3-32.jpg" data-lazy- height="281" src="data:image/svg xml,” width=”1188″>

As you can see, netstat works now.

Understanding the netstat output:

The example above where netstat was executed without flags returned the following 6 columns:

• Proto: This column specifies the connection protocol.
• Recv-Q: This column displays the data retained in the receiving queue.
• Send-Q: This column displays the data retained in the outbound queue.
• Local Address: Our local host or IP address and the used port.
• Foreign Address: The remote host or IP address we are connected to.
• State: The connection state.

To make this tutorial complete, I also decided to add netstat instructions below.

How to use the netstat command:

After installing netstat on Debian 11, this section shows some netstat command use examples.

In the previous example, when netstat was executed without flags, it returned, among other columns, Foreign Address, which includes host addresses. By implementing the -n flag as shown in the next screenshot, you can instruct netstat to return only numerical foreign addresses.

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/09/echo/4-32.jpg" data-lazy- height="282" src="data:image/svg xml,” width=”1129″>

As you can see now, the output shows the IP of remote devices instead of their hostnames.

The following example shows how to display only TCP connections by adding the -t flag.

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/09/echo/5-30.jpg" data-lazy- height="305" src="data:image/svg xml,” width=”1158″>

As you can see, only TCP connections were printed. Contrary to the previous example, if you want to print UDP connections, replace the -t flag with -u, as shown in the next example.

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/09/echo/6-28.jpg" data-lazy- height="305" src="data:image/svg xml,” width=”1158″>

Running netstat with the -p flag, you will see a new column named PID/Program name. Under this column, you can see the processes or programs establishing connections.

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/09/echo/7-25.jpg" data-lazy- height="352" src="data:image/svg xml,” width=”1294″>

As you can see in the last column, there are PIDs and programs (chrome) behind the connections.

If followed by the -a flag, the netstat command will return all sockets, both listening and no listening.

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/09/echo/8-26.jpg" data-lazy- height="238" src="data:image/svg xml,” width=”981″>

The -s flag is used to print summary statistics for each protocol, as shown in the screenshot below.

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/09/echo/9-22.jpg" data-lazy- height="558" src="data:image/svg xml,” width=”550″>

You also can combine the -t and -s flags to show statistics on TCP connections only, as shown in the example below.

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/09/echo/10-20.jpg" data-lazy- height="559" src="data:image/svg xml,” width=”487″>

And you can combine the -s flag with -u for statistics on UDP connections, as shown below.

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/09/echo/11-18.jpg" data-lazy- height="596" src="data:image/svg xml,” width=”570″>

The netstat command can also print the route table by adding the -r flag, shown in the following screenshot.

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/09/echo/12-15.jpg" data-lazy- height="214" src="data:image/svg xml,” width=”1006″>

Finally, to end this tutorial, you can print IPv6 information using the -g flag, as shown in the image below.

<img alt="" data-lazy- data-lazy-src="https://kirelos.com/wp-content/uploads/2021/09/echo/13-13.jpg" data-lazy- height="467" src="data:image/svg xml,” width=”584″>

netstat (netstat) vs ss (socketstat):

The netstat command is considered obsolete and was deprecated and replaced by the ss command. The ss command is faster and consumes fewer resources than netstat. The ss command is faster than netstat because it reads information directly from the kernel. When netstat checks every PID under /proc, ss directly acquires the statistics information under /pro/net. It is highly recommended that Linux users adopt the new alternative (ss) over netstat and the same for all other tools included in iproute2.

Conclusion:

As you could realize by reading this tutorial, installing netstat on Debian 11 is pretty easy. It doesn’t work on default new Linux installations because it isn’t included in the net-tools packages collection. Despite this tutorial answering how to make netstat work on Debian 11 and new distributions, using the ss command instead is the correct choice. There are no netstat functionalities that weren’t included in ss. Yet many users keep using the old netstat just because they are used to ( like the ifconfig command). By adding the net-tools package whose installation was explained in this tutorial, you’ll also get classic commands like ifconfig, route, or arp.

Thank you for reading this tutorial explaining how to install netstat on Debian 11. Keep following us for more Linux tips and tutorials.