diff --git a/pkg/cli/parse.go b/pkg/cli/parse.go
index aa93d76..d80a5c6 100644
--- a/pkg/cli/parse.go
+++ b/pkg/cli/parse.go
@@ -18,6 +18,7 @@ package cli
 
 import (
 	"fmt"
+	"github.com/cdk-team/CDK/pkg/tool/netstat"
 
 	"github.com/cdk-team/CDK/pkg/evaluate"
 	"github.com/cdk-team/CDK/pkg/plugin"
@@ -114,6 +115,8 @@ func ParseCDKMain() bool {
 			network.GetLocalAddresses()
 		case "ps":
 			ps.RunPs()
+		case "netstat":
+			netstat.RunNetstat()
 		case "probe":
 			if len(args) != 4 {
 				log.Println("Invalid input args.")
diff --git a/pkg/tool/netstat/netstat.go b/pkg/tool/netstat/netstat.go
new file mode 100644
index 0000000..02cccf0
--- /dev/null
+++ b/pkg/tool/netstat/netstat.go
@@ -0,0 +1,40 @@
+package netstat
+
+import (
+	"fmt"
+	"github.com/shirou/gopsutil/v3/net"
+	"log"
+	"sort"
+)
+
+func RunNetstat() {
+	log.Printf("[+] run netstat, using RunNestat()")
+	stats, err := net.Connections("all")
+	if err != nil {
+		fmt.Println(err.Error())
+		return
+	}
+	fmt.Printf("ipType\t\tconnection\tlocalAddr\t\t\tstatus\t\t\tremoteAddr\t\t\tpid\n")
+	sort.Slice(stats, func(i, j int) bool {
+		return stats[i].Type < stats[j].Type
+	})
+	for _, stat := range stats {
+		switch stat.Family {
+		case 2:
+			switch stat.Type {
+			case 1:
+				fmt.Printf("ipv4\t\ttcp\t\t%-16s\t\t%-13s\t\t%-16s\t\t%d\n", fmt.Sprintf("%s:%d", stat.Laddr.IP, stat.Laddr.Port), stat.Status, fmt.Sprintf("%s:%d", stat.Raddr.IP, stat.Raddr.Port), stat.Pid)
+			case 2:
+				fmt.Printf("ipv4\t\tudp\t\t%-16s\t\t%-13s\t\t%-16s\t\t%d\n", fmt.Sprintf("%s:%d", stat.Laddr.IP, stat.Laddr.Port), stat.Status, fmt.Sprintf("%s:%d", stat.Raddr.IP, stat.Raddr.Port), stat.Pid)
+			}
+		case 23:
+			switch stat.Type {
+			case 1:
+				fmt.Printf("ipv6\t\ttcp\t\t%-16s\t\t%-13s\t\t%-16s\t\t%d\n", fmt.Sprintf("%s:%d", stat.Laddr.IP, stat.Laddr.Port), stat.Status, fmt.Sprintf("%s:%d", stat.Raddr.IP, stat.Raddr.Port), stat.Pid)
+			case 2:
+				fmt.Printf("ipv6\t\tudp\t\t%-16s\t\t%-13s\t\t%-16s\t\t%d\n", fmt.Sprintf("%s:%d", stat.Laddr.IP, stat.Laddr.Port), stat.Status, fmt.Sprintf("%s:%d", stat.Raddr.IP, stat.Raddr.Port), stat.Pid)
+			}
+
+		}
+	}
+}