android通过执行netstat及cat /proc/net/tcp查看正在运行应用的本地端口号pid和uid以及对方的IP和端口号
来源：互联网 发布：excel计算重复数据 编辑：程序博客网 时间：2024/05/18 01:52
转自：http://wxmijl.blog.163.com/blog/static/132459282013773122750/
以下数据是通过 android手机上播放PPTV中的某个视屏，执行netstat和cat /proc/net/tcp获得数据列表。
表一
-----------------------------------------------------------------------------------------------------------------------------------------
1|shell@android:/ # netstat
netstat
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:16000 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:63843 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:9000 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:25000 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:1802 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:9003 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:9006 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:7575 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:5054 0.0.0.0:* LISTEN
tcp 1 0 192.168.123.103:43202 61.184.100.19:80 SYN_SENT
tcp 0 0 192.168.123.103:42340 183.129.205.249:80 ESTABLISHED
tcp 1 0 192.168.123.103:58752 115.238.140.102:80 SYN_SENT
tcp 0 0 192.168.123.103:43201 61.184.100.19:80 ESTABLISHED
udp 0 0 0.0.0.0:51209 0.0.0.0:* CLOSE
udp 0 0 0.0.0.0:5829 0.0.0.0:* CLOSE
udp 0 0 0.0.0.0:1900 0.0.0.0:* CLOSE
tcp6 0 0 :::6259 :::* LISTEN
tcp6 0 0 ::ffff:127.0.0.1:10007 :::* LISTEN
tcp6 0 0 ::ffff:192.168.123.103:42260 ::ffff:183.129.205.205:80 TIME_WAIT
tcp6 0 0 ::ffff:192.168.123.103:51095 ::ffff:202.75.220.6:5224 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:45898 ::ffff:211.147.4.31:443 TIME_WAIT
tcp6 0 0 ::ffff:192.168.123.103:56317 ::ffff:74.125.128.188:5228 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:57529 ::ffff:183.129.205.205:80 TIME_WAIT
tcp6 0 1 ::ffff:192.168.123.103:33732 ::ffff:120.197.232.27:80 CLOSE_WAIT
tcp6 0 0 ::ffff:192.168.123.103:37838 ::ffff:180.153.106.27:80 ESTABLISHED
tcp6 0 1 ::ffff:192.168.123.103:57468 ::ffff:14.17.18.181:80 CLOSE_WAIT
tcp6 0 1 ::ffff:192.168.123.103:43951 ::ffff:120.197.232.27:80 CLOSE_WAIT
tcp6 0 0 ::ffff:192.168.123.103:49276 ::ffff:115.238.140.102:80 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:40999 ::ffff:115.238.166.215:80 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:49800 ::ffff:183.129.205.249:80 TIME_WAIT
tcp6 0 0 ::ffff:192.168.123.103:48649 ::ffff:183.129.205.248:80 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:39098 ::ffff:115.238.140.101:80 TIME_WAIT
tcp6 0 0 ::ffff:192.168.123.103:55575 ::ffff:183.129.205.206:80 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:50284 ::ffff:115.238.140.101:80 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:58600 ::ffff:115.238.166.216:80 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:59393 ::ffff:101.226.76.146:8080 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:55361 ::ffff:180.153.106.24:80 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:34328 ::ffff:115.238.140.101:80 TIME_WAIT
tcp6 0 1 ::ffff:192.168.123.103:35724 ::ffff:117.41.242.183:80 CLOSE_WAIT
tcp6 0 0 ::ffff:192.168.123.103:43892 ::ffff:211.151.139.211:80 TIME_WAIT
tcp6 0 0 ::ffff:192.168.123.103:58915 ::ffff:115.238.140.101:80 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:56639 ::ffff:115.238.140.101:80 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:53001 ::ffff:117.21.182.151:80 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:35138 ::ffff:115.238.166.216:80 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:44504 ::ffff:183.129.205.206:80 TIME_WAIT
tcp6 0 0 ::ffff:192.168.123.103:49286 ::ffff:115.238.166.216:80 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:44812 ::ffff:123.126.34.24:80 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:33153 ::ffff:180.149.131.209:5287 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:56887 ::ffff:183.129.205.206:80 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:44746 ::ffff:121.14.125.26:8080 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:34833 ::ffff:183.129.205.191:80 TIME_WAIT
tcp6 0 0 ::ffff:192.168.123.103:51162 ::ffff:115.238.140.101:80 ESTABLISHED
tcp6 0 1 ::ffff:192.168.123.103:52975 ::ffff:117.41.242.183:80 CLOSE_WAIT
tcp6 0 1 ::ffff:192.168.123.103:49943 ::ffff:117.21.185.46:80 CLOSE_WAIT
tcp6 0 0 ::ffff:192.168.123.103:33272 ::ffff:180.153.106.27:80 TIME_WAIT
tcp6 0 0 ::ffff:192.168.123.103:33832 ::ffff:180.153.106.27:80 TIME_WAIT
tcp6 0 0 ::ffff:192.168.123.103:47326 ::ffff:211.151.139.211:80 TIME_WAIT
tcp6 0 1 ::ffff:192.168.123.103:54291 ::ffff:117.121.57.38:80 CLOSE_WAIT
tcp6 0 0 ::ffff:192.168.123.103:59307 ::ffff:115.238.166.215:80 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:53838 ::ffff:117.135.148.48:80 TIME_WAIT
tcp6 0 1 ::ffff:192.168.123.103:54452 ::ffff:74.125.235.198:80 CLOSE_WAIT
tcp6 0 0 ::ffff:192.168.123.103:53130 ::ffff:211.147.4.31:443 TIME_WAIT
tcp6 0 0 ::ffff:192.168.123.103:46034 ::ffff:183.129.205.206:80 TIME_WAIT
tcp6 0 0 ::ffff:192.168.123.103:46712 ::ffff:180.153.106.27:80 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:48966 ::ffff:183.129.205.238:80 ESTABLISHED
tcp6 0 1 ::ffff:192.168.123.103:57503 ::ffff:101.226.89.41:80 CLOSE_WAIT
tcp6 0 0 ::ffff:192.168.123.103:51160 ::ffff:115.238.140.102:80 ESTABLISHED
tcp6 0 0 ::ffff:192.168.123.103:54270 ::ffff:115.238.140.101:80 ESTABLISHED
以上列表中state状态说明
LISTEN 侦听来自远方的TCP端口的连接请求[4]
SYN-SENT 在发送连接请求后等待匹配的连接请求[4]
SYN-RECEIVED 在收到和发送一个连接请求后等待对方对连接请求的确认[4]
ESTABLISHED 代表一个打开的连接[4]
FIN-WAIT-1 等待远程TCP连接中断请求，或先前的连接中断请求的确认[4]
FIN-WAIT-2 从远程TCP等待连接中断请求[4]
CLOSE-WAIT 等待从本地用户发来的连接中断请求[4]
CLOSING 等待远程TCP对连接中断的确认[4]
LAST-ACK 等待原来的发向远程TCP的连接中断请求的确认[4]
TIME-WAIT 等待足够的时间以确保远程TCP接收到连接中断请求的确认[4]
CLOSED 没有任何连接状态[4]
表二
-----------------------------------------------------------------------------------------------------------------------------------------
shell@android:/ # cat /proc/net/tcp
cat /proc/net/tcp
sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt ui
d timeout inode
0: 00000000:3E80 00000000:0000 0A 00000000:00000000 00:00000000 00000000 10049 0 104371 1 cbcdedc0 300 0 0 2 -1
1: 00000000:F963 00000000:0000 0A 00000000:00000000 00:00000000 00000000 10049 0 103485 1 cbcdf6c0 300 0 0 2 -1
2: 0100007F:2328 00000000:0000 0A 00000000:00000000 00:00000000 00000000 10049 0 104365 1 cbcde040 300 0 0 2 -1
3: 0100007F:61A8 00000000:0000 0A 00000000:00000000 00:00000000 00000000 1000 0 2110 1 cbcdfb40 300 0 0 2 -1
4: 00000000:070A 00000000:0000 0A 00000000:00000000 00:00000000 00000000 10049 0 104388 1 cbcde4c0 300 0 0 2 -1
5: 00000000:232B 00000000:0000 0A 00000000:00000000 00:00000000 00000000 10049 0 104359 1 cbcde940 300 0 0 2 -1
6: 00000000:232E 00000000:0000 0A 00000000:00000000 00:00000000 00000000 10049 0 104390 1 c1a3d6c0 300 0 0 2 -1
7: 00000000:1D97 00000000:0000 0A 00000000:00000000 00:00000000 00000000 10049 0 103486 1 cbcdf240 300 0 0 2 -1
8: 00000000:13BE 00000000:0000 0A 00000000:00000000 00:00000000 00000000 10049 0 104391 1 c1a3d240 300 0 0 2 -1
9: 677BA8C0:E581 668CEE73:0050 08 00000000:00000001 00:00000000 00000000 10049 0 105395 1 c1a3cdc0 21 4 2 4 -1
10: 677BA8C0:A8C2 1364B83D:0050 02 00000001:00000000 01:000000C2 00000002 1019 0 104846 2 c1a3c4c0 1200 0 0 2 2
11: 677BA8C0:A564 F9CD81B7:0050 01 00000000:00000000 00:00000000 00000000 10049 0 104389 1 c1a3db40 39 0 0 3 2
12: 677BA8C0:A8C1 1364B83D:0050 01 00000000:00000000 00:00000000 00000000 1013 0 104839 1 c1a3c040 25 4 0 2 -1
以上列表中状态说明
注1：文件中都是用的16进制，所以HTTP的80端口记录为0050。
注2：状态码对应如下
00 "ERROR_STATUS",
01 "TCP_ESTABLISHED",
02 "TCP_SYN_SENT",
03 "TCP_SYN_RECV",
04 "TCP_FIN_WAIT1",
05 "TCP_FIN_WAIT2",
06 "TCP_TIME_WAIT",
07 "TCP_CLOSE",
08 "TCP_CLOSE_WAIT",
09 "TCP_LAST_ACK",
0A "TCP_LISTEN",
0B "TCP_CLOSING",
注2：状态码对应如下
00 "ERROR_STATUS",
01 "TCP_ESTABLISHED",
02 "TCP_SYN_SENT",
03 "TCP_SYN_RECV",
04 "TCP_FIN_WAIT1",
05 "TCP_FIN_WAIT2",
06 "TCP_TIME_WAIT",
07 "TCP_CLOSE",
08 "TCP_CLOSE_WAIT",
09 "TCP_LAST_ACK",
0A "TCP_LISTEN",
0B "TCP_CLOSING",
表三
-----------------------------------------------------------------------------------------------------------------------------------------
127|shell@android:/ # ps
ps
USER PID PPID VSIZE RSS WCHAN PC NAME
app_49 7491 137 337892 40992 ffffffff 2aabc4b0 S com.pplive.androidphone
app_49 7510 137 287792 12064 ffffffff 2aabc4b0 S com.pplive.androidphone.pushservice
app_49 12290 137 293844 13124 ffffffff 2aabc4b0 S com.pplive.androidphone:remote
通过以上命令可以得出：我们只取状态为ESTABLISHED的数据
tcp 0 0 192.168.123.103:42340 183.129.205.249:80 ESTABLISHED
tcp 0 0 192.168.123.103:43201 61.184.100.19:80 ESTABLISHED
10049 ，1013就是UID号 其中10000以下的都是系统应用，10049-10000＝49就是就是真实的UID：APP_49,
11: 677BA8C0:A564 F9CD81B7:0050 01 00000000:00000000 00:00000000 00000000 10049 0 104389 1 c1a3db40 39 0 0 3 2
12: 677BA8C0:A8C1 1364B83D:0050 01 00000000:00000000 00:00000000 00000000 1013 0 104839 1 c1a3c040 25 4 0 2 -1
通过分析表一，二，三生成表四：
本地IP本地10进制端口对方IP对方端口本地16进制端口原UID号转码UID号PID号包名
192.168.123.10342340183.129.205.24980A56410049 APP_497491,7510com.pplive.androidphone/com.pplive.androidphone.pushservice/com.pplive.androidphone:remote
192.168.123.10343201 61.184.100.1980A8C11013
以下转自：http://blog.csdn.net/myarrow/article/details/8930827
1. Android的netstat
netstat代码如下所示：
- int netstat_main(int argc, char *argv[])
- {
- printf("Proto Recv-Q Send-Q Local Address Foreign Address State\n");
- ipv4("/proc/net/tcp", "tcp");
- ipv4("/proc/net/udp", "udp");
- ipv6("/proc/net/tcp6", "tcp6");
- ipv6("/proc/net/udp6", "udp6");
- return 0;
- }
如：cat /proc/net/tcp6内容如下：
# cat /proc/net/tcp6
sl local_address remote_address st tx_queue rx_queue tr tm->when retrnsmt
uid timeout inode
0: 00000000000000000000000000000000:EA6000000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 10031 0 8220 1 eded9b80 300 0 0 2 -1
1: 00000000000000000000000000000000:1873 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 10071 0 8214 1 eded8000 300 0 0 2 -1
2: 0000000000000000FFFF00008204A8C0:E066 0000000000000000FFFF0000CEEB7D4A:0050 08 00000000:00000001 00:00000000 00000000 1000 0 5015 1 eded8b00 21 4 22 10 -1
3: 0000000000000000FFFF00008204A8C0:EA600000000000000000FFFF00005B04A8C0:CECD 01 00000000:00000000 00:00000000 00000000 10031 0 8376 1 ededa100 300 0 0 10 -1
如对于端口EA60 (60000)的uid为10031，大于10000的uid为app。
2. 在pid中如何寻找对应的uid
如我的10031在app_31中。
app_31 2761 1378 454512 28132 ffffffff 400e7ae8 S cn.mytest.test
# cat /proc/2761/cgroup
2:cpu:/bg_non_interactive
1:cpuacct:/uid/10031
其实很简单，app_xx对应的uid为10000+xx
0 0
- android通过执行netstat及cat /proc/net/tcp查看正在运行应用的本地端口号pid和uid以及对方的IP和端口号
- android通过执行netstat及cat /proc/net/tcp查看正在运行应用的本地端口号pid和uid以及对方的IP和端口号
- Android根据本地端口号寻找对应的用户UID和进程PID
- 查看进程的端口号和pid
- netstat查看正在监听的端口
- netstat查看正在监听的端口
- linux操作系统中的netstat命令查看端口状态的使用和window操作系统查看端口号
- Windows下使用netstat命令和任务管理器查看某一应用对应的端口号
- 查看指定端口端口号所对应用的PID及应用程序
- 如何查看pid进程号和对应的端口号
- 查看pid和端口号的对应关系
- Android应用的uid和pid
- Android应用的uid和pid
- python： tcp/ip学习、端口、udp和tcp的应用
- VC中UDP通信中记录对方的IP地址和端口号
- boost显示本地和远程的IP地址、端口号
- 查看进程使用端口号及结束进程 使用命令 sudo netstat -ntlp，可以查看到目前系统网络服务器的运行情况，然后使用 sudo kill -9 pid，结束进程。
- linux查看正在运行的所有端口
- MFC 对话框编程要点
- Lucene学习总结之五：Lucene段合并(merge)过程分析
- 黑马程序员--集合框架
- POSIX详解pthread_mutex_lock
- According to TLD or attribute directive in tag file, attribute test does not accept any expressions
- android通过执行netstat及cat /proc/net/tcp查看正在运行应用的本地端口号pid和uid以及对方的IP和端口号
- 加密技术基本原理
- hive 访问hbase表
- 最全的静态网站生成器（开源项目）
- UML类图几种关系的总结
- Lucene学习总结之六：Lucene打分公式的数学推导
- 什么是AIDL服务
- Android Message handling (based on KK4.4)
- Lucene学习总结之七：Lucene搜索过程解析
