Linux netstat command tips

Netstat Introduction:

The netstat command is used to display various network-related information, such as network connections, routing tables, connection status, multicast members, and so on.
Common parameter options:
-A (All)
Show all options, default does not show listen related
-T (TCP)
Show only TCP-related options
-U (UDP)
Show only UDP-related options
-N (numberic)
Denies displaying aliases, and can display all numbers converted into numbers.
-L (Listen)
Only the Listen (monitor) is listed in the service of/>-P (program/pid)
Shows the program name and PID to establish the associated link
-R (Route)
Display routing information, routing table
-E (Extend)
Display extended information, such as UID
-S (Static)
Statistics according to each protocol
-C (Continus)
Execute the netstat command at every other fixed time.
-X
UNIX Socket Connection
-W
RAW

Connection Status Description:

LISTEN: Listening for connection requests from a remote TCP port
Syn-sent: Wait for a matching connection request after sending the connection request (if there is a large number of such status packs, check for strokes)
Syn-received: After receiving and sending a connection request to wait for the other party to confirm the connection request (if there is a large number of this state, estimated to be flood attack)
Established: Represents an open connection
Fin-wait-1: Waiting for a remote TCP connection interrupt request, or confirmation of a previous connection interrupt request
Fin-wait-2: Wait for connection interrupt request from remote TCP
Close-wait: Waiting for a connection interrupt request from a local user
CLOSING: Waiting for remote TCP to confirm connection interruption
Last-ack: Wait for the original send to remote TCP connection Interrupt request confirmation (not a good thing, this occurrence, check whether the attack)
Time-wait: Wait enough time to ensure that remote TCP receives a confirmation of a connection interrupt request
CLOSED: No connection status

Use examples:

(1) Show all TCP connections, and include PID and program name

Netstat-atnp

(2) Count all TCP states and sort

Netstat-atn | awk ' {print $} ' | Sort | uniq-c | Sort-rn

(3) every 1s display network information (-c parameter)

netstat-ctn | grep "established"

(4) List all IP in the connected state and sort by quantity

Netstat-an | grep established | awk '/^tcp/{print $} ' | Awk-f: ' {print $} ' | Sort | uniq-c | Sort-nr