聊聊netstat命令

来源：互联网发布：淘宝国棉一厂编辑：程序博客网时间：2024/06/06 03:48

netstat: 显示各种网络相关信息，如网络连接（无参数），路由表（-r），接口状态 (Interface Statistics)（-i），masquerade 连接（无效连接）（-m），多播成员 (Multicast Memberships).

netstat - Print network connections, routing tables, interface statis‐tics, masquerade connections,

and multicast memberships

zjy@ubuntu:~$ netstat | head -10

Active Internet connections (w/o servers)

Proto Recv-Q Send-Q Local Address Foreign Address State

tcp 0 0 10.211.55.6:ssh bogon:62723 ESTABLISHED

tcp 0 0 10.211.55.6:ssh bogon:62886 ESTABLISHED

Active UNIX domain sockets (w/o servers)

Proto RefCnt Flags Type State I-Node Path

unix 18 [ ] DGRAM 1566 /run/systemd/journal/dev-log

unix 3 [ ] DGRAM 12927 /run/systemd/notify

unix 2 [ ] DGRAM 12938 /run/systemd/journal/syslog

unix 2 [ ] DGRAM 20110 /run/user/1000/systemd/notify

zjy@ubuntu:~$

从整体上看，netstat的输出结果可以分为两个部分：
一个是Active Internet connections，称为有源TCP连接，其中"Recv-Q"和"Send-Q"指的是接收队列和发送队列。这些数字一般都应该是0。如果不是则表示软件包正在队列中堆积，其他文章中讲过不为0的情况。
另一个是Active UNIX domain sockets，称为有源Unix域套接口(和网络套接字一样，但是只能用于本机通信，性能可以提高一倍)。
Proto显示连接使用的协议，RefCnt表示连接到本套接口上的进程号，Types显示套接口的类型,State显示套接口当前的状态，Path表示连接到套接口的其它进程使用的路径名。

常见参数
-a (all)显示所有选项，默认不显示LISTEN相关
-t (tcp)仅显示tcp相关选项
-u (udp)仅显示udp相关选项
-n 拒绝显示别名，能显示数字的全部转化成数字。
-l 仅列出有在 Listen (监听) 的服務状态

-p 显示建立相关链接的程序名
-r 显示路由信息，路由表
-e 显示扩展信息，例如uid等
-s 按各个协议进行统计
-c 每隔一秒，执行该netstat命令。

提示：LISTEN和LISTENING的状态只有用-a或者-l才能看到

zjy@ubuntu:~$ netstat | head -10

Active Internet connections (w/o servers)

Proto Recv-Q Send-Q Local Address Foreign Address State

tcp 0 0 10.211.55.6:ssh bogon:62723 ESTABLISHED

tcp 0 0 10.211.55.6:ssh bogon:62886 ESTABLISHED

Active UNIX domain sockets (w/o servers)

Proto RefCnt Flags Type State I-Node Path

unix 18 [ ] DGRAM 1566 /run/systemd/journal/dev-log

unix 3 [ ] DGRAM 12927 /run/systemd/notify

unix 2 [ ] DGRAM 12938 /run/systemd/journal/syslog

unix 2 [ ] DGRAM 20110 /run/user/1000/systemd/notify

zjy@ubuntu:~$ netstat -r

Kernel IP routing table

Destination Gateway Genmask Flags MSS Window irtt Iface

default bogon 0.0.0.0 UG 0 0 0 enp0s5

10.211.55.0 * 255.255.255.0 U 0 0 0 enp0s5

link-local * 255.255.0.0 U 0 0 0 enp0s5

zjy@ubuntu:~$ netstat -g

IPv6/IPv4 Group Memberships

Interface RefCnt Group

--------------- ------ ---------------------

lo 1 all-systems.mcast.net

enp0s5 1 224.0.0.251

enp0s5 1 all-systems.mcast.net

lo 1 ip6-allnodes

lo 1 ff01::1

enp0s5 1 ff02::fb

enp0s5 1 ff02::1:ffdd:5670

enp0s5 1 ff02::1:ff20:3dad

enp0s5 1 ff02::1:ff0a:9445

enp0s5 1 ip6-allnodes

enp0s5 1 ff01::1

zjy@ubuntu:~$ netstat -i

Kernel Interface table

Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg

enp0s5 1500 0 75969 0 0 0 38472 0 0 0 BMRU

lo 65536 0 1281 0 0 0 1281 0 0 0 LRU

zjy@ubuntu:~$ netstat -s

Ip:

76883 total packets received

26 with invalid addresses

0 forwarded

0 incoming packets discarded

76781 incoming packets delivered

38265 requests sent out

40 outgoing packets dropped

Icmp:

80 ICMP messages received

0 input ICMP message failed.

ICMP input histogram:

destination unreachable: 80

80 ICMP messages sent

0 ICMP messages failed

ICMP output histogram:

destination unreachable: 80

IcmpMsg:

InType3: 80

OutType3: 80

Tcp:

36 active connections openings

22 passive connection openings

3 failed connection attempts

14 connection resets received

2 connections established

72272 segments received

37211 segments send out

5 segments retransmited

0 bad segments received.

14 resets sent

Udp:

3292 packets received

80 packets to unknown port received.

0 packet receive errors

3020 packets sent

IgnoredMulti: 1075

UdpLite:

TcpExt:

18 TCP sockets finished time wait in fast timer

282 delayed acks sent

2 packets directly queued to recvmsg prequeue.

20 bytes directly received in process context from prequeue

60582 packet headers predicted

2 packets header predicted and directly queued to user

6453 acknowledgments not containing data payload received

356 predicted acknowledgments

1 other TCP timeouts

1 connections reset due to early user close

TCPRcvCoalesce: 35781

TCPSynRetrans: 5

TCPOrigDataSent: 8738

TCPHystartTrainDetect: 3

TCPHystartTrainCwnd: 72

TCPKeepAlive: 4

IpExt:

InMcastPkts: 987

OutMcastPkts: 622

InBcastPkts: 1075

OutBcastPkts: 20

InOctets: 94244704

OutOctets: 6445995

InMcastOctets: 177628

OutMcastOctets: 89729

InBcastOctets: 117713

OutBcastOctets: 1144

InNoECTPkts: 76846

InECT0Pkts: 40

zjy@ubuntu:~$ netstat -M

netstat: no support for `ip_masquerade' on this system.

zjy@ubuntu:~$ netstat -c | head 4

head: cannot open '4' for reading: No such file or directory

zjy@ubuntu:~$ netstat -c | head -4

Active Internet connections (w/o servers)

Proto Recv-Q Send-Q Local Address Foreign Address State

tcp 0 0 10.211.55.6:ssh bogon:62723 ESTABLISHED

tcp 0 0 10.211.55.6:ssh bogon:62886 ESTABLISHED

zjy@ubuntu:~$ netstat -napc | head -4

(Not all processes could be identified, non-owned process info

will not be shown, you would have to be root to see it all.)

Active Internet connections (servers and established)

Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name

tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN -

tcp 0 0 127.0.1.1:53 0.0.0.0:* LISTEN -

zjy@ubuntu:~$ netstat -atc

Active Internet connections (servers and established)

Proto Recv-Q Send-Q Local Address Foreign Address State

tcp 0 0 localhost:6379 *:* LISTEN

tcp 0 0 ubuntu:domain *:* LISTEN

tcp 0 0 *:ssh *:* LISTEN

tcp 0 0 localhost:ipp *:* LISTEN

tcp 0 0 10.211.55.6:ssh bogon:62723 ESTABLISHED

tcp 0 0 10.211.55.6:ssh bogon:62886 ESTABLISHED

tcp6 0 0 [::]:ssh [::]:* LISTEN

tcp6 0 0 ip6-localhost:ipp [::]:* LISTEN

Active Internet connections (servers and established)

Proto Recv-Q Send-Q Local Address Foreign Address State

tcp 0 0 localhost:6379 *:* LISTEN

tcp 0 0 ubuntu:domain *:* LISTEN

tcp 0 0 *:ssh *:* LISTEN

tcp 0 0 localhost:ipp *:* LISTEN

tcp 0 0 10.211.55.6:ssh bogon:62723 ESTABLISHED

tcp 0 0 10.211.55.6:ssh bogon:62886 ESTABLISHED

tcp6 0 0 [::]:ssh [::]:* LISTEN

tcp6 0 0 ip6-localhost:ipp [::]:* LISTEN

Active Internet connections (servers and established)

.....

zjy@ubuntu:~$ netstat -at

Active Internet connections (servers and established)

Proto Recv-Q Send-Q Local Address Foreign Address State

tcp 0 0 localhost:6379 *:* LISTEN

tcp 0 0 ubuntu:domain *:* LISTEN

tcp 0 0 *:ssh *:* LISTEN

tcp 0 0 localhost:ipp *:* LISTEN

tcp 0 0 10.211.55.6:ssh bogon:62723 ESTABLISHED

tcp 0 0 10.211.55.6:ssh bogon:62886 ESTABLISHED

tcp6 0 0 [::]:ssh [::]:* LISTEN

tcp6 0 0 ip6-localhost:ipp [::]:* LISTEN

zjy@ubuntu:~$ netstat -at | awk '{print $1,$6}' | uniq -c | sort -n

1 Active established)

1 Proto Foreign

2 tcp6 LISTEN

2 tcp ESTABLISHED

4 tcp LISTEN

zjy@ubuntu:~$ netstat -at | awk '{print $1,$6}' | uniq -c | sort -nr

4 tcp LISTEN

2 tcp ESTABLISHED

2 tcp6 LISTEN

1 Proto Foreign

1 Active established)

zjy@ubuntu:~$

uniq - report or omit repeated lines

sort - sort lines of text files

head - output the first part of files

阅读全文

0 0