How to see all connections to your system with netstat

This is part of the Semicolon&Sons Code Diary - consisting of lessons learned on the job. You're in the networking category.

Last Updated: 2021-05-16

I wanted to see how my phone talked to a Rails server (on port 3000) on the same network.

Start by using netstat to monitor the TCP traffic:

$ netstat TCP

Active Internet connections
Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)
tcp4       0      0  jacks-computer.local.55405  do-11.lastpass.c.https SYN_SENT
tcp4       0      0  jacks-computer.local.hbci   honor_10-abababa.57284 ESTABLISHED
tcp4       0      0  jacks-computer.local.hbci   honor_10-abababa.57282 ESTABLISHED

In this case:

  hbci            3000/udp    # HBCI

hbci corresponds to Home Banking Computer Interface. This has nothing to do with my Rails server - it's just what this file believes port 3000 is normally used for. By seeing how these names for port 3000 services diverge, it should hopefully be clear that one should not rely on these conversions of ports into symbolic names by netstat.

If the HTTP port is 80, why am I connected on 55969 below according to netstat?

tcp4       0    517  jacks-computer.local.55969  stackoverflow.http ESTABLISHED

Because port 80 is only for the HTTP requests on the server side. On my computer, any port can be used. Indeed Google Chrome opens a different port for each tab.