ncnetstat - a netstat like utility that supports color and searching
ncnetstat [-a] [--drp] [-l] [-n] [--nc] [-S <sort>] [-t] [-u] [-c <CIDRs>] [--ci -p <ports>] [--pi] [-P <protocols>] [--Pi] [--ptr <PTRs>] [--ptri] [--lptr <PTRs>] [--lptri] [--rptr <PTRs>] [--rptri] [-s <states>] [--si] ...
Show all connections.
A comma seperated list of CIDRs to search for.
Invert the CIDR search.
Show the command to the first space.
Show the whole command.
A comma seperated list of commands to search for.
Invert the command search.
Show connections belonging to procs matching this CPU usage percent.
=head2--cpui
Invert the CPU search.
Don't resolve port names.
Invert the sort.
Show the listening ports.
Show connections belonging to procs matching this memory usage percent.
Invert the memory usage search.
Don't resolve the PTRs.
Don't use colors.
A comma seperated list of ports to search for.
Show memory and CPU usage of the process that has the connection.
Invert the port search.
A comma seperated list of protocols to search for.
Invert your protocol search.
A comma separated list of PIDs to search for.
Invert the pid search.
A comma seperated list of PTRs to search for.
Invert the PTR search.
A comma seperated list of regex to use for a PTR search.
Invert the RegexPTR search.
A comma seperated list of local PTRs to search for.
Invert the local PTR search.
A comma seperated list of regex to use for a local PTR search.
Invert the local RegexPTR search.
A comma seperated list of remote PTRs to search for.
Invert the remote PTR search.
A comma seperated list of states to search for.
Invert the state search.
The Net::Connection::Sort to use.
The default available sort methods are as below.
host_f foreign host host_fl foreign host, local host *default* host_l local host host_lf local host, foreign host pid process ID port_f foreign port, numerically port_fa foreign port, alphabetically port_l local port, numerically port_la local port, alphabetically proto protocol ptr_f foreign PTR ptr_l local PTR state state uid user ID user username
Show only TCP connections.
Show only UDP connections.
A comma seperated list of usernames to search for.
Invert the username search.
A comma separated list of UIDs to search for.
Invert the UID search.
Show the wait channel.
A comma separated list of regexp to use for matching wchan values.
Invert the wchan search
For some searches, the equalities below can be used, by directly prepending them to the number.
< <= > >=
So if you wanted to find every connection from a UID greater than 1000, would do '--uid \>1000'.
This is either 0 or 1. If defined it will be used for XORing the -i flag.
export CNETSTAT_invert=1 # run ncnetstat inverted ncnetstat # run it non-inverted, the opposite of what the -i flag normally is ncnetstat -i
Sets the default sort method. -S overrides this.
If this is set, The output will not be colorized. If this is set, the --nc flag is also inverted.
A space-separated list of nameservers to query used by Net::DNS::Resolver.
There are a few more possible ones, but this is the most useful one and that documentation really belongs to that module.
Used to xor the -C switch.
Set to either 0 or 1, boolean, for setting the default.
Used to xor the --Cl switch.
Used to xor the -W switch.
Used to xor the --pct switch.
ncnetstat -s established,time_wait
Return a list of connection that are in the established or time_wait state.
ncnetstat -c ::/0
Return a list of all IPv6 addresses.
ncnetstat -c ::1/128,127.0.0.1/32
Return all connections to localhost.
ncnetstat -c 192.168.15.2/32 -l
Display all connections listening explicitly on 192.168.15.2.
ncnetstat -S host_f -i
Sort the connections by the foreign host and invert the results.
ncnetstat -c 10.0.0.0/24 --ci
Show connections that are either not locally or remotely part of the 10.0.0.0/24 subnet.
ncnetstat --ptr foo.bar
Find connections to/from IPs that have a PTR record of foo.bar.
ncnetstat --ptr foo.bar --ptri
Find connections to/from IPs that do not have a PTR record of foo.bar.
ncnetstat -n --uid '>1000' --Cl
Show every connection by a user with a UID greater than 1000, do not resolve PTR info and print the whole command.
ncnetstat -U www -p 80,443 --pi
Show every connecttion by the user www that is not a HTTP or HTTPS connection.
ncnetstat --cpu '>5' --Cl --pct -W
Search for connections from procs using more than 5% of the CPU time. Show memory and CPU usage as well whole command and wait channel.
To install Net::Connection::ncnetstat, copy and paste the appropriate command in to your terminal.
cpanm
cpanm Net::Connection::ncnetstat
CPAN shell
perl -MCPAN -e shell install Net::Connection::ncnetstat
For more information on module installation, please visit the detailed CPAN module installation guide.