netstat / ss — Network Connections
Built-in on Linux and Windows — list listening ports, active connections, and owning PIDs. Use on shells when you need services not visible from external Nmap.
OSCP use: Dual-homed host → find internal listeners · verify Port Forwarding / Chisel · spot DB/app on localhost only · Windows PrivEsc / Linux enum.
PowerShell equivalent: Get-NetTCPConnection — see PowerShell Cmdlets
📌 Linux — listeners & connections
ss -nltp # TCP listening + numeric + process (common on shells)
ss -tulpn # TCP + UDP listen + PID/program
ss -tlnp # TCP listen only
netstat -tulpn # Classic — same idea (needs root for -p)
netstat -antp # All TCP + PIDs
netstat -an # All connections (no resolve)
lsof -i -P -n # Open sockets (alternative)
# Localhost-only services (pivot targets)
ss -nltp | grep 127.0.0.1
ss -tlnp | grep LISTEN
netstat -tulpn | grep LISTENss flag | Meaning |
|---|---|
-n | Numeric addresses/ports (no DNS) |
-l | Listening sockets only |
-t | TCP |
-u | UDP |
-p | Show process using socket |
-a | All sockets |
Note:
ss -nltpvsss -ntlp— flag order does not matter; both are-n -l -t -p.
📌 Linux — processes (ps)
Pair listeners (ss) with processes (ps) to identify what is running.
ps aux # All processes — full listing
ps -ef # POSIX format
ps aux | grep mysql # Hunt specific service
ps aux --forest # Process tree
# Match PID from ss/netstat to process name
ss -nltp | grep 3306
ps aux | grep PIDSee Basic Commands · Linux · Process - EveryRuns
📌 Windows (CMD)
netstat -ano REM All connections + PID
netstat -an REM Numeric
netstat -ano | findstr LISTENING
netstat -ano | findstr :445
netstat -ano | findstr ESTABLISHED
route print REM Routing table (pivot planning)
arp -a| Flag | Meaning |
|---|---|
-a | All connections & listeners |
-n | Numeric addresses/ports |
-o | Owning PID |
-b | Binary name (needs admin) |
Get-NetTCPConnection -State Listen
Get-NetTCPConnection | Where-Object {$_.State -eq "Established"}📌 What to Look For
| Finding | Action |
|---|---|
| Port in use on Kali (4444, 8080…) | Port in Use - kill listener — ss -ltnp · kill · fuser -k |
127.0.0.1:3306 MySQL | Port Forwarding → attack locally |
0.0.0.0:5985 WinRM | evil-winrm if creds |
| Internal IP listeners | Pivot target on domain network |
| Unexpected high port | Gobuster / ffuf / manual probe |
| ESTABLISHED to DC | User/domain context hint |
📌 Quick Cheat Sheet
# Linux
ss -nltp
ss -tulpn
ps aux
netstat -tulpn | grep LISTENREM Windows
netstat -ano | findstr LISTENING