netstat命令使用汇总

netstat 常用命令  $sudo netstat -antp|grep 8080   查找占用8080端口的程序   这个最常用  $sudo netstat -np|grep java|wc -l  查看java的并发数  查看80端口请求数最高的20个ip (查找攻击源)  $netstat -anlp|grep 80|grep tcp|awk '{print $5}'|awk -F: '{print $1}'|sort|uniq -c|sort -nr|head -n20  查看tcp端口的状态  $netstat -nat |awk '{print $6}'|sort|uniq -c|sort -rn   参数汇总  -a  show both listening and none-listening sockets.默认是不显示listening sockets  -t  仅显示tcp相关  默认是都显示  -u  仅显示udp相关  默认是都显示  -n  拒绝显示别名，显示数字  -l  仅列出有在Listen(监听)的服务状态  -p  显示建立相关连接的程序名   需要sudo才能看到其他用户起动的程序pid  -r  显示路由表  -c  每隔一段时间(秒)，执行该netstat命令  -i  显示各个网络接口的状况   -s  按照协议进行统计  前面锁所示的 -antp  大家可以对照看一下TCP端口状态  TCP端口有如下几个常见的状态  1.LISTENING    对应netstat的LISTEN   我们开一个80端口的服务，也就是使80端口处于LISTEN状态，                 这样浏览器就可以与我们的80端口进行连接  2.ESTABLISED   表示两个端口建立连接成功，正在通信  3.CLOSE_WAIT   对方主动关闭连接或者网络异常导致连接中断，这时我方的状态就会变为CLOSE_WAIT,                  此时我方要主动调用close()来关闭连接  4.TIME_WAIT    我方主动调用close()断开连接，收到对方确认后变为TIME_WAIT.                  TCP协议规定TIME_WAIT状态会一直持续2MSL(两倍的分段最大生存期)，                 以此确保旧的连接状态不会对新连接产生影响。处于TIME_WAIT状态的连接不会被内核释放，                 所以作为服务器，在可能的情况下，尽量不要主动断开连接，以减少TIME_WAIT状态造成的资源浪费。-a 参数  show both listening and none-listening sockets.默认是不显示listening sockets  $netstat   Proto Recv-Q Send-Q Local Address               Foreign Address             State  tcp        0      0 hu_bo1:47054                hu_bo1:8961                 TIME_WAIT  tcp        0      0 hu_bo1:6981                 192.168.6.80:54645          ESTABLISHED  tcp       41      0 localhost:8092              localhost:25272             CLOSE_WAIT  $netstat -a  tcp        0      0 *:acnet                     *:*                         LISTEN    #多了这个  tcp        0      0 hu_bo1:47054                hu_bo1:8961                 TIME_WAIT  tcp        0      0 hu_bo1:6981                 192.168.6.80:54645          ESTABLISHED  tcp       41      0 localhost:8092              localhost:25272             CLOSE_WAIT  其中Recv-Q 表示接受队列  Send-Q表示发送队列  这些数字一般是0,如果不是则表示网络包正在堆积-t 参数  只显示tcp端口 默认是全部显示  $netstat   Proto Recv-Q Send-Q Local Address               Foreign Address             State  tcp        0      0 hu_bo1:47054                hu_bo1:8961                 TIME_WAIT  tcp        0      0 hu_bo1:6981                 192.168.6.80:54645          ESTABLISHED  tcp       41      0 localhost:8092              localhost:25272             CLOSE_WAIT  tcp        0      0 SHTU-ABC-05.abc:griffin     SHTU-REDIS-21-104.abc:6062 ESTABLISHED  Active UNIX domain sockets (w/o servers)  Proto RefCnt Flags       Type       State         I-Node Path                 unix  7      [ ]         DGRAM                    74370628 /dev/log  unix  2      [ ]         DGRAM                    834846110  其中Active UNIX doamin sockets 为Unix域套接字，只能用于本机进程间通讯，性能比TCP高  $netstat -t  Proto Recv-Q Send-Q Local Address               Foreign Address             State  tcp        0      0 hu_bo1:47054                hu_bo1:8961                 TIME_WAIT  tcp        0      0 hu_bo1:6981                 192.168.6.80:54645          ESTABLISHED  tcp       41      0 localhost:8092              localhost:25272             CLOSE_WAIT  tcp        0      0 SHTU-ABC-05.abc:griffin     SHTU-REDIS-91-14.abc:6062   ESTABLISHED-u 参数  只显示udp 端口，默认是全部显示-n 参数  -n  拒绝显示别名，显示数字  $netstat  Proto Recv-Q Send-Q Local Address               Foreign Address             State  tcp        0      0 hu_bo1:47054                hu_bo1:8961                 TIME_WAIT  tcp        0      0 hu_bo1:6981                 192.168.6.80:54645          ESTABLISHED  tcp       41      0 localhost:8092              localhost:25272             CLOSE_WAIT  tcp        0      0 SHTU-ABC-05.abc:griffin     SHTU-REDIS-21-104.abc:6062 ESTABLISHED  如下所示，显示的都是ip地址  $netstat -n  tcp        0      0 192.168.17.13:47054         192.168.17.13:8961          TIME_WAIT  tcp        0      0 192.168.17.13:6981          192.168.6.80:54645          ESTABLISHED  tcp       41      0 127.0.0.1:8092              127.0.0.1:25272             CLOSE_WAIT-l 参数  -l  仅列出有在Listen(监听)的服务状态  $netstat -l  tcp        0      0 hu_bo1:6981                 *:*                         LISTEN  tcp        0      0 *:2189                      *:*                         LISTEN  tcp        0      0 hu_bo1:11213                *:*                         LISTEN  tcp        0      0 hu_bo1:6586                 *:*                         LISTEN-p 参数  -p  显示建立相关连接的程序名   需要sudo才能看到其他用户起动的程序pid  $sudo netstat -p  tcp        0      0 hu_bo1:6981                 192.168.77.80:52256         ESTABLISHED 6458/redis-server 1  tcp        0      0 hu_bo1:6980                 hu_bo1:11802                ESTABLISHED 6418/redis-server 1  tcp        0      0 hu_bo1:6980                 192.168.77.80:65120         ESTABLISHED 6418/redis-server 1 -r 参数  -r 显示路由表  $ netstat -r  Kernel IP routing table  Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface  192.168.77.0     *              255.255.255.0   U         0 0          0 em2  link-local      *               255.255.0.0     U         0 0          0 em1  link-local      *               255.255.0.0     U         0 0          0 em2  192.168.0.0     192.168.77.1    255.255.0.0     UG        0 0          0 em2-i 参数  -i 显示各个网络接口的状况  $netstat -i  Kernel Interface table  Iface       MTU  Met  RX-OK      RX-ERR RX-DRP RX-OVR   TX-OK       TX-ERR TX-DRP TX-OVR  Flg  em1        1500   0 120567162       0      0      0     90527177      0      0      0     BMRU  em2        1500   0 5357249686      0      0      0     4400173145    0      0      0     BMRU  lo        65536   0 49625810403     0      0      0     49625810403   0      0      0     LRU  参数解释  RX-OK   接收时，正确的数据包数  RX-ERR  接受时，错误的数据包数  RX-DRP  接受时，丢弃的数据包数  RX-OVR  接收时，由于过速（在数据传输中，由于接收设备不能接收按照发送速率传送来的数据而使数据丢失）而丢失的数据包数。  TX-OK   发送时，正确的数据包数。  TX-ERR  发送时，产生错误的数据包数。  TX-DRP  发送时，丢弃的数据包数。  TX-OVR  发送时，由于过速而丢失的数据包数。  Flg  标志。  B 已经设置了一个广播地址。  L 该接口是一个回送设备。  M 接收所有数据包（混乱模式）。  N 避免跟踪。  O 在该接口上，禁用ARP。  P 这是一个点到点链接。  R 接口正在运行。  U 接口处于“活动”状态。-c 参数  $netstat -p -c 10   每隔10秒执行一次该命令-s 参数  -s 按照协议进行统计   如果机器网络不太好的情况下，我们可以使用此参数来进行分析  $netstat -s   Ip:      54102745340 total packets received      0 forwarded      0 incoming packets discarded      54086127151 incoming packets delivered      54101665338 requests sent out  Icmp:         #Internet Control Message Protocol, Internet 控制报文协议 用于在IP主机、路由器之间传递控制消息      1077840 ICMP messages received      2145 input ICMP message failed.      ICMP input histogram:          destination unreachable: 2475          timeout in transit: 248          wrong parameters: 1          source quenches: 3          redirects: 1          echo requests: 1075034          echo replies: 69          timestamp request: 3      1129878 ICMP messages sent      0 ICMP messages failed      ICMP output histogram:          destination unreachable: 54769          echo request: 72          echo replies: 1075034          timestamp replies: 3  IcmpMsg:          InType0: 69          InType3: 2475          InType4: 3          InType5: 1          InType8: 1075034          InType11: 248          InType12: 1          InType13: 3          OutType0: 1075034          OutType3: 54769          OutType8: 72          OutType14: 3  Tcp:      4149941351 active connections openings      1022620333 passive connection openings      3095563980 failed connection attempts      100271379 connection resets received      1084 connections established    #目前有多少个连接      54083689577 segments received      54084074455 segments send out      15055961 segments retransmited      195874 bad segments received.      3856575743 resets sent  Udp:      1241256 packets received      54773 packets to unknown port received.      0 packet receive errors      1405039 packets sent  UdpLite:  TcpExt:      247872 invalid SYN cookies received      16618 resets received for embryonic SYN_RECV sockets      1240 packets pruned from receive queue because of socket buffer overrun      60 packets pruned from receive queue      1 packets dropped from out-of-order queue because of socket buffer overrun      29 ICMP packets dropped because they were out-of-window      78559379 TCP sockets finished time wait in fast timer      883371423 time wait sockets recycled by time stamp      1535 packets rejects in established connections because of timestamp      182605148 delayed acks sent      32564 delayed acks further delayed because of locked socket      Quick ack mode was activated 821546 times      2675061 times the listen queue of a socket overflowed      2675061 SYNs to LISTEN sockets ignored      19271359 packets directly queued to recvmsg prequeue.      7399328202 packets directly received from backlog      6765697193 packets directly received from prequeue      35764943050 packets header predicted      6579353 packets header predicted and directly queued to user      4032336419 acknowledgments not containing data received      34697552082 predicted acknowledgments      2816 times recovered from packet loss due to SACK data      Detected reordering 15 times using FACK      Detected reordering 89 times using SACK      Detected reordering 81 times using time stamp      194 congestion windows fully recovered      1916 congestion windows partially recovered using Hoe heuristic      TCPDSACKUndo: 9657      4637954 congestion windows recovered after partial ack      37163 TCP data loss events      TCPLostRetransmit: 503      46377 timeouts after SACK recovery      442 timeouts in loss state      13532 fast retransmits      4104 forward retransmits      10183 retransmits in slow start      13670540 other TCP timeouts      192 sack retransmits failed      1 times receiver scheduled too late for direct processing      256454 packets collapsed in receive queue due to low socket buffer      822253 DSACKs sent for old packets      1212 DSACKs sent for out of order packets      42832 DSACKs received      18 DSACKs for out of order packets received      85408336 connections reset due to unexpected data      251901 connections reset due to early user close      8215 connections aborted due to timeout      TCPDSACKIgnoredOld: 105      TCPDSACKIgnoredNoUndo: 4023      TCPSpuriousRTOs: 389      TCPSackShifted: 38352      TCPSackMerged: 77354      TCPSackShiftFallback: 285038      TCPBacklogDrop: 4806      TCPChallengeACK: 599326      TCPSYNChallenge: 503530      TCPFromZeroWindowAdv: 52647      TCPToZeroWindowAdv: 52647      TCPWantZeroWindowAdv: 12002148  IpExt:      InBcastPkts: 37      InOctets: 12648107098338      OutOctets: 10787636949021      InBcastOctets: 19328