n estab

List active established connections

Usage — n estab

═══════════════════════════════════════════════════════════════════════════════
  Netscrew ("n") — estab (e, es, established) — List active/established connections
═══════════════════════════════════════════════════════════════════════════════

USAGE:
  n e .                                established sockets on this machine
  n e . tcp | . udp                    filter by protocol

Target: . = this machine · <host> = remote
Deeper: n e -h = the concept/theory behind this command

The concept behind it — n estab -h

═══════════════════════════════════════════════════════════════════════════════
  NETSCREW GUIDE: Active Established TCP Connections ("n e")
═══════════════════════════════════════════════════════════════════════════════

OVERVIEW:
  n e" inspects all active, live TCP data streams between your system and remote
  servers, database backends, API endpoints, or connected clients.

KEY TCP CONNECTION STATES:
  • ESTABLISHED : Active connection, data can flow bidirectionally.
  • CLOSE_WAIT  : Remote side closed the connection; local app hasn't closed its socket yet.
                   High numbers indicate a socket leak in your application!
  • TIME_WAIT   : Local side closed connection; socket held open for 2*MSL to prevent
                   late-arriving duplicate packets from corrupting new connections.
  • SYN_SENT    : Outbound connection attempt in progress (waiting for remote SYN-ACK).
                   Stuck SYN_SENT indicates firewall drops or routing blackholes.

RELATED COMMANDS:
  • n top-ips   Cluster all established connections by remote IP address
  • n choked    Detect processes failing to accept new incoming connections