netstat is a network utility that displays a variety of statistics relating to network connections on the system on which it is running. For example, it displays incoming and outgoing connections, routing tables, and much more. It is still available in Windows, but in Linux, netstat is considered deprecated. You are advised to use dss, part of the iproute2 package, instead. netstat may still work under Linux, depending on which distribution you are using.

If you do not specify any command-line arguments for netstat, it will display a list of active sockets for each network protocol. Under Linux, netstat will also display a list of active Unix domain sockets. As with pfTop, netstat uses abbreviations at the top of its columns. Proto stands for protocol; 6 denotes use of IPv6. Recv-Q indicates how many packets have not yet been copied from the socket buffer by the application using the socket, whereas Send-Q tells you how many packets have been sent, but for which ACK packets have not yet been received. Local Address indicates the IP address/hostname and port of the local end of the connection. Foreign address indicates the IP address/hostname and port of the remote end. State indicates the state of the socket.

Active Unix domain sockets will have several additional columns of information. RefCnt, or reference count, is the number of attached processes connected via this socket. The Flags column, as you may have guessed, contains a number of flags used on both connected and unconnected sockets. The Type column indicates the type of socket access; DGRAM (datagram) is a socket in connectionless mode; STREAM indicates the socket is a connection socket; and RAW indicates a raw socket. The State column indicates the state; FREE is an unallocated socket; and LISTENING is a socket listening for a connection request. CONNECTING means the socket is about to establish a connection. CONNECTED indicates the socket is already connected. Finally, DISCONNECTING indicates that the socket is disconnecting. The I-Node and Path columns show both the inode and path of the file object the represents the process which is attached to the socket.