diff --git a/check_netstat b/check_netstat
index 5a9a7a92d27689a1ec05fcd07f8b4049cf045277..4d38b7ff717cbb31261d27b378a052d747115842 100755
--- a/check_netstat
+++ b/check_netstat
@@ -8,12 +8,50 @@
 #
 # ----------------------------------------------------------------------
 # 2020-07-08  v1.0  <axel.hahn@iml.unibe.ch>
+# 2022-10-25  v1.1  <axel.hahn@unibe.ch>  shell fixes; no tmpfiles; IML look
 # ======================================================================
 
 
-. `dirname $0`/inc_pluginfunctions
+. $(dirname $0)/inc_pluginfunctions
 
+self_APPNAME=$( basename $0 | tr [:lower:] [:upper:] )
+self_APPVERSION=1.1
 
+# ----------------------------------------------------------------------
+# functions
+# ----------------------------------------------------------------------
+
+function showHelp(){
+cat <<EOF
+______________________________________________________________________
+
+$self_APPNAME 
+v$self_APPVERSION
+
+(c) Institute for Medical Education - University of Bern
+Licence: GNU GPL 3
+______________________________________________________________________
+
+Count number of network connections.
+
+SYNTAX:
+$(basename $0) [ -w value -c value -h ]
+
+    -w VALUE       cpu usage warning level  (default: 75)
+    -c VALUE       cpu usage critical level (default: 90)
+    -h or --help   show this help.
+
+PARAMETERS:
+
+    None.
+
+EXAMPLE:
+$(basename $0) -w 60 -c 80 -p 40
+
+If there is no -w and -c then the result is always OK.
+
+EOF
+}
 # ----------------------------------------------------------------------
 # MAIN
 # ----------------------------------------------------------------------
@@ -22,32 +60,28 @@
 ph.require netstat
 
 # --- check param -h
-if [ "$1" = "-h" ]; then
-    echo "
-    usage: $0 [ -w value -c value -h ]
-
-        -w  Warning count  (optional)
-        -c  Critical count (optional; must be larger than warning)
-        -h  this help
-
-    If there is no -w and -c then the result is always OK.
-    "
-    exit 0
-fi
+case "$1" in
+    "--help"|"-h")
+        showHelp
+        exit 0
+        ;;
+    *)
+esac
 
 # --- set optional limits
-typeset -i iWarnLimit=`     ph.getValueWithParam 0 w "$@"`
-typeset -i iCriticalLimit=` ph.getValueWithParam 0 c "$@"`
-
+typeset -i iWarnLimit=$(     ph.getValueWithParam 0 w "$@")
+typeset -i iCriticalLimit=$( ph.getValueWithParam 0 c "$@")
 
 # --- count all connections
-tmpfile1=`mktemp`
-tmpfile=`mktemp`
+typeset -i iTotal=0
+typeset -i iEst=0
+typeset -i iListen=0
+typeset -i iWait=0
 
-(netstat -wltun; netstat -wtun) | awk '{ print $6 }' | grep -E '(ESTABLISHED|LISTEN|TIME_WAIT)' >$tmpfile1
-typeset -i iTotal=`wc -l $tmpfile1 | awk '{ print $1 }'`
+netdata=$( (netstat -wltun; netstat -wtun) | awk '{ print $6 }' | grep -E '(ESTABLISHED|LISTEN|TIME_WAIT)' )
+iTotal=$( echo "$netdata" | wc -l | awk '{ print $1 }')
 
-if [ $iWarnLimit -gt 0 -a $iCriticalLimit -gt 0 ]; then
+if [ $iWarnLimit -gt 0 -a $iCriticalLimit -gt 0 ]; then 
     ph.setStatusByLimit $iTotal $iWarnLimit $iCriticalLimit
 fi 
 
@@ -55,17 +89,20 @@ ph.status "NETSTAT - count of connections: $iTotal"
 
 
 # --- add performance data
-cat $tmpfile1 | sort | uniq -c >$tmpfile
+data2=$( echo "$netdata" | sort | uniq -c )
 # result is something like that:
 #      5 ESTABLISHED
 #     10 LISTEN
 #     77 TIME_WAIT
+echo "$data2"
 
-ph.perfadd "established" "`grep ESTABLISHED $tmpfile | awk '{ print $1 }' `"
-ph.perfadd "listen"      "`grep LISTEN      $tmpfile | awk '{ print $1 }' `"
-ph.perfadd "time-wait"   "`grep TIME_WAIT   $tmpfile | awk '{ print $1 }' `"
+iEst=$(    echo "$data2" | grep ESTABLISHED | awk '{ print $1 }' )
+iListen=$( echo "$data2" | grep LISTEN      | awk '{ print $1 }' )
+iWait=$(   echo "$data2" | grep TIME_WAIT   | awk '{ print $1 }' )
 
+ph.perfadd "established" "$iEst"
+ph.perfadd "listen"      "$iListen"
+ph.perfadd "time-wait"   "$iWait"
 
 # --- bye
-rm -f $tmpfile $tmpfile1
 ph.exit
diff --git a/docs/20_Checks/_index.md b/docs/20_Checks/_index.md
index 71c13cdf3694023b2bee1eba3024f9c1a6d0a4d4..e6a5a9976937ba507c6ce0c5ca1280c14fa40b68 100644
--- a/docs/20_Checks/_index.md
+++ b/docs/20_Checks/_index.md
@@ -7,7 +7,7 @@ There is one include script used by all checks:
 
 ## Check scripts
 
-* check_apache_requests
+* [check_apache_requests](check_apache_requests.md)
 * check_backup_one
 * check_ceph_diskfree
 * check_ceph_osd
@@ -15,7 +15,7 @@ There is one include script used by all checks:
 * check_clientbackup
 * check_couchdb-lb
 * [check_cpu](check_cpu.md)
-* check_cronstatus
+* [check_cronstatus](check_cronstatus.md)
 * check_disk-io
 * check_dns_responsetime
 * [check_eol](check_eol.md)
@@ -23,13 +23,13 @@ There is one include script used by all checks:
 * check_haproxy_status
 * check_memory
 * check_netio
-* check_netstat
+* [check_netstat](check_netstat.md)
 * check_opencpu
 * check_packages2install
 * check_proc_mem
 * check_proc_ressources
 * check_proc_zombie
-* check_reboot_required
+* [check_reboot_required](check_reboot_required.md)
 * check_sensuplugins
 * check_smartstatus
 * [check_snmp_data](check_snmp_data.md)
diff --git a/docs/20_Checks/check_netstat.md b/docs/20_Checks/check_netstat.md
new file mode 100644
index 0000000000000000000000000000000000000000..9270cecbd7fd556c4b185147af0ab3bfc3739bca
--- /dev/null
+++ b/docs/20_Checks/check_netstat.md
@@ -0,0 +1,51 @@
+# check netstat
+
+## Introduction
+
+Count number of network connections.
+
+## Syntax
+
+```text
+> ./check_netstat -h
+______________________________________________________________________
+
+CHECK_NETSTAT 
+v1.1
+
+(c) Institute for Medical Education - University of Bern
+Licence: GNU GPL 3
+______________________________________________________________________
+
+Count number of network connections.
+
+SYNTAX:
+check_netstat [ -w value -c value -h ]
+
+    -w VALUE       cpu usage warning level  (default: 75)
+    -c VALUE       cpu usage critical level (default: 90)
+    -h or --help   show this help.
+
+PARAMETERS:
+
+    None.
+
+EXAMPLE:
+check_netstat -w 60 -c 80 -p 40
+
+If there is no -w and -c then the result is always OK.
+
+```
+
+## Examples
+
+Simple call:
+
+```txt
+> ./check_netstat
+OK: NETSTAT - count of connections: 27
+     20 ESTABLISHED
+      4 LISTEN
+      3 TIME_WAIT
+ |established=20;;;0; listen=4;;;0; time-wait=3;;;0;
+ ```