Textbook of Linux

netstat was for decades the go-to command for network diagnostics: open sockets, listening ports, routing tables, per-interface counters. On modern Linux it has been superseded by ss (for sockets and connections) and ip (for routes and interfaces), both faster and aware of recent kernel features.

netstat -tuln                    # TCP/UDP listening ports, numeric
netstat -anp                     # all sockets with owning processes
netstat -r                       # routing table (like ip route)
netstat -i                       # interface statistics
netstat -s                       # summary protocol stats

Minimal cloud images often omit netstat entirely; ss -tuln is the modern equivalent and comes with iproute2, which is always installed.