Page 1 of 1

How to read netstat -n result?

PostPosted: Fri Mar 31, 2006 11:21 am
by needip
ok, i was directly connected to another user.

i did a NETSTAT command:

here are my results, im not asking for anyone to find this person, i just need to know which of these IP addresses should i be focusng on? The first row? the last row? 2nd to last? etc etc

Local address Foreign address
. 127.xx

would the other person be at the


Re: How to read netstat -n result?

PostPosted: Fri Mar 31, 2006 12:48 pm
by robocoder
Focus your attention on the IP addresses in the foreign address column. Ignore IP addresses that look like (this is your machine's loopback address) or your own IP address (I'm guessing this is the address you posted). In your example, this would be the,,,, and addresses.

TCP is inherently a direct connection -- how long the connection lasts depends on the application (which you can oftentimes determine from the port number). Here you'll see the IP address, followed by a colon and then the port number, e.g.,


In case you don't already know, port 80 is typically for web servers. In my example, these are connections made by simply browsing the site Thus, I'd probably only be interested in the line showing someone from connected to my machine's ssh port.

Disclaimer: your mileage may vary.