Linux network-related query scripts

1. View TCP connection Status

Netstat-nat |awk ' {print $6} ' |sort|uniq-c|sort-rn
Netstat-n | awk '/^tcp/{++s[$NF]}; END {for (a in S) print A, s[a]} ' or
Netstat-n | awk '/^tcp/{++state[$NF]}; END {for (key in) print key, "\ T", State[key]} '
Netstat-n | awk '/^tcp/{++arr[$NF]}; END {for (k in arr) print K, "\ T", arr[k]} '
Netstat-n |awk '/^tcp/{print $NF} ' |sort|uniq-c|sort-rn
Netstat-ant | awk ' {print $NF} ' | Grep-v ' [A-z] | Sort | Uniq-c
(The effect of each of these lines is basically the same, listing the different ways to make the script easier to understand)

2. Find the number of requests 20 IP (commonly used to find the source of attack)

Netstat-anlp|grep 80|grep Tcp|awk ' {print $} ' |awk-f: ' {print '} ' |sort|uniq-c|sort-nr|head-n20
Netstat-ant |awk '/:80/{split ($5,ip, ":"); ++a[ip[1]]}end{for (i in A) print A[i],i} ' |sort-rn|head-n20
3. Sniff 80-port access with tcpdump to see who is the tallest

Tcpdump-i ETH0-TNN DST Port 80-c 1000 | Awk-f "." ' {print $ '. $ "." $ "." $4} ' | Sort | uniq-c | Sort-nr |head-20
4. Find more time_wait connections

Netstat-n|grep Time_wait|awk ' {print $} ' |sort|uniq-c|sort-rn|head-n20
5. Check for more SYN connections

Netstat-an | grep SYN | awk ' {print $} ' | Awk-f: ' {print $} ' | Sort | uniq-c | Sort-nr | More
6. Depending on the port column process

NETSTAT-NTLP | grep 80 | awk ' {print $7} ' | Cut-d/-F1
7. See how many php-cgi process activities

NETSTAT-ANP | grep php-cgi | grep ^tcp | Wc-l
8. View the total amount of memory occupied by php-cgi

total=0; For i in ' ps-c php-cgi-o rss= '; Do total=$ (($total + $i)); Done echo "php-cgi Memory usage: $total KB"

Linux network-related query scripts