Netstat common methods

Netstat introduction

Netstat is a very useful tool for monitoring TCP/IP networks, which can display routing tables, actual network connections, and status information for each network interface device, Netstat used to display statistics related to IP,TCP,UDP and ICMP protocols, Typically used to query the network connectivity of the ports on this machine.

In general, the Netstat-an displays all connected IPs, ports, and digital representations.

The function of the netstat command is to display network connections, routing tables, and network interface information to let users know which network connections are in operation.

When used, Netstat displays active TCP connections without parameters

Netstat Common parameters

Several commonly used parameters are:-a-n-p-l

-a displays all sockets, including the listening

-L display Service status in Listen (listening)

-N Displays network connection situation with network IP address instead of name

-P shows the program name and PID for establishing the associated connection

-T shows the connection of the TCP protocol

-U shows the connection of the UDP protocol

-S shows statistics for each protocol

-B Displays the executable program involved in creating each connection or listening port

-C re-displays every 1 seconds until the user interrupts

Netstat common scenarios

1. Netstat-a List all connections

[[Email protected] the-9-162-bx-core ~]# netstat-aactive Internet connections (servers and established) Proto RECV-Q send-Q Local Address Foreign address statetcp0      0 0.0.0.0:p Rivatewire0.0.0.0:*listentcp0      0 0.0.0.0:4194            0.0.0.0:*listentcp5      0 0.0.0.0:30211           0.0.0.0:* LISTEN

UDP 0 0 0.0.0.0:10010 0.0.0.0:*
UDP 0 0 0.0.0.0:11916 0.0.0.0:*
UDP 0 0 0.0.0.0:30000 0.0.0.0:*
Active UNIX domain sockets (servers and established)
Proto refcnt Flags Type State I-node Path
UNIX 2 [ACC] STREAM LISTENING 3925009694/tmp/tmux-0/default
UNIX 2 [ACC] STREAM LISTENING 4021720277/tmp/tmux-1091/default
UNIX 2 [ACC] STREAM LISTENING 3910671241/tmp/tmux-1081/default

2. Netstat-at List all TCP connections

[Email protected] the-9-162-bx-core ~]# netstat-at|HeadActive Internet connections (servers and established) Proto RECV-Q send-Q Local Address Foreign address statetcp0      0 0.0.0.0:p Rivatewire0.0.0.0:*listentcp0      0 0.0.0.0:4194            0.0.0.0:*listentcp5      0 0.0.0.0:30211           0.0.0.0:*listentcp0      0 0.0.0.0: zabbix-agent0.0.0.0:*listentcp0      0Localhost:cslistener0.0.0.0:*listentcp0      0localhost10248         0.0.0.0:*listentcp1      0 0.0.0.0:31080           0.0.0.0:*listentcp0      0 0.0.0.0:30089           0.0.0.0:* LISTEN

3. Netstat-au List all UDP connections

[[Email protected] the-9-162-bx-core ~]# netstat-au|HeadActive Internet connections (servers and established) Proto RECV-Q send-Q Local Address Foreign address STATEUDP0      0 0.0.0.0: krb5240.0.0.0:*UDP0      0 0.0.0.0: UPNOTIFYP0.0.0.0:*UDP0      0 0.0.0.0: n1-fwp0.0.0.0:*UDP0      0 0.0.0.0: N1-RMGMT0.0.0.0:*UDP0      0 0.0.0.0: ASC-SLMD0.0.0.0:*UDP0      0 0.0.0.0:p Rivatewire0.0.0.0:*UDP0      0 0.0.0.0:55511           0.0.0.0:*UDP0      0 0.0.0.0:55512           0.0.0.0:*

4. Netstat-nl|grep Port Query Port number

[Email protected]9-162-bx-core ~]# netstat-ln| grep 8090 TCP         0      0 0.0. 0.0:8090            0.0.  0.0:*               LISTEN

5. Netstat-nlp|grep Port Query The program name or PID that occupies the port number

[Email protected]9-162-bx-core ~]# netstat-lnp| grep 8090 TCP         0      0 0.0. 0.0:8090            0.0.  0.0:*               LISTEN      8904/vintage

Connection Status

LISTEN Listening for connection requests from a remote TCP port

Syn-sent waiting for a matching connection request after sending a connection request

Syn-received waits for confirmation of the connection request after receiving and sending a connection request

The established represents an open connection

Time-wait waits enough time to ensure that the remote TCP receives a connection interrupt request acknowledgement

CLOSED does not have any connection status

Closed-wait waiting for a connection interrupt request from a local user

Netstat common methods