Brief introduction
The Netstat command is used to display various network-related information, such as network connections, routing tables, Interface states (Interface Statistics), masquerade connections, multicast members (multicast memberships), and so on.
Output information meaning
After the Netstat is executed, its output is
Active Internet connections (w/o servers)
Proto recv-q send-q Local address Foreign address state
TCP 0 2 210.34.6 .89:telnet 210.34.6.96:2873 established
TCP 296 0 210.34.6.89:1165 210.34.6.84:netbios-ssn ESTABLISHED
TCP 0 0 LOCALHOST.LOCALDOM:9001 localhost.localdom:1162 established
TCP 0 0 localhost.localdom:1162 Localhost.localdom : 9001 established
TCP 0 210.34.6.89:1161 210.34.6.10:netbios-ssn close
Active UNIX domain sockets (w/o servers
Proto refcnt Flags Type State i-node Path
UNIX 1 [] stream CONNECTED 16178 @000000dd
Unix 1 [] stream C onnected 16176 @000000dc
Unix 9 [] dgram 5292/dev/log
UNIX 1 [] STREAM CONNECTED 16182 @000000df
As a whole, the output of Netstat can be divided into two parts:
One is the active Internet connections, known as the active TCP connection, where "recv-q" and "Send-q" refer to%0a receive queues and send queues. These numbers should generally be 0. If not, it means that the package is piling up in the queue. This situation can only be seen in very few situations.
The other is active UNIX domain sockets, known as the active UNIX domains socket (like a network socket, but only for native communication, which can improve performance by a factor).
Proto displays the protocol used by the connection, refcnt represents the process number that is attached to this set of interfaces, types displays the type of the socket interface, state displays the current status of the socket interface, and path represents the pathname used by other processes connected to the socket interface.
Common parameters
-A (all) shows all options, default does not show listen related
-T (TCP) displays only TCP-related options
-U (UDP) only displays UDP-related options
-N denies displaying aliases, and can display all numbers converted to numbers.
-l list only service status with Listen (listening)
-P Displays the name of the program that establishes the associated link
-R Displays routing information, routing table
-e display extended information, such as UID, etc.
-S statistics according to each protocol
-C executes the netstat command at every other fixed time.
Hint: The status of listen and listening can only be seen with-a or-l
Practical Command Instances
1. List all ports (both listening and not listening)
List all ports netstat-a
# Netstat-a | More
Active Internet connections (servers and established)
Proto recv-q send-q Local address Foreign address state
TCP 0 0 localhost:30037 *:* LISTEN
UDP 0 0 *:bootpc *:*
Active UNIX domain sockets (servers and established)
Proto refcnt Flags Type State I-node Path
Unix 2 [ACC] STREAM listening 6135 /tmp/. X11-unix/x0
Unix 2 [ACC] STREAM listening 5140 /var/run/acpid.socket
List all TCP ports Netstat-at
# netstat-at
Active Internet connections (servers and established) Proto Recv-q Local address send-q IGN address state
TCP 0 0 localhost:30037 *:* LISTEN
tcp 0 0 Localhost:ipp *:* LISTEN
tcp 0 0 *:smtp *:* LISTEN
tcp6 0 0 Localhost:ipp [::]:* LISTEN
List all UDP ports Netstat-au
# Netstat-au
Active Internet connections (servers and established) Proto Recv-q Local address send-q Address state
UDP 0 0 *:bootpc *:*
UDP 0 0 *:49119 *:*
UDP 0 0 *:mdns *:*
2. List all Sockets in the listening state
Show only listening ports netstat-l
# netstat-l
Active Internet connections (only servers)
Proto recv-q send-q Local address Foreign address< C23/>state
TCP 0 0 Localhost:ipp *:* LISTEN
tcp6 0 0 Localhost:ipp [::]:* LISTEN
UDP 0 0 *:49119 *:*
Lists all listening TCP ports only NETSTAT-LT
# netstat-lt
Active Internet connections (only servers)
Proto recv-q send-q Local address Foreign Address
state
TCP 0 0 localhost:30037 *:* LISTEN
tcp 0 0 *:smtp *:* LISTEN
tcp6 0 0 Localhost:ipp [::]:* LISTEN
Lists all listening UDP ports only Netstat-lu
# netstat-lu
Active Internet connections (only servers)
Proto recv-q send-q Local address Foreign address state
UDP 0 0 *:49119 *:*
UDP 0 0 *:mdns *:*
List only all listening UNIX ports NETSTAT-LX
# NETSTAT-LX
Active UNIX domain sockets (only servers)
Proto refcnt Flags Type State I-node Path
Unix 2 [ACC] STREAM listening 6294 private/maildrop
Unix 2 [ACC] Stream listening 6203 public/cleanup
Unix 2 [ACC] STREAM listening 6302 private/ifmail
Unix 2 [ACC] STREAM listening 6306 private/bsmtp
3. Display statistical information for each protocol
Show statistics for all ports netstat-s
# netstat-s
Ip: Total
packets received with
invalid addresses
forwarded incoming packets Discarded
incoming packets delivered
requests out
ICMP:
ICMP sent messages
input ICMP message failed.
TCP:
Active connections Openings
failed connection attempts connection resets received
UDP:
Packets received
packets to unknown Port received.
.....
Displays statistics for TCP or UDP ports netstat-st or-SU
# netstat-st
# NETSTAT-SU
4. Display PID and process name in netstat output netstat-p
Netstat-p can be used with other switches, you can add "Pid/process name" to the netstat output, so debugging can easily find a specific port to run the program.
# netstat-pt
Active Internet connections (w/o servers) Proto Recv-q Local address send-q Foreign >state pid/program name
TCP 1 0 ramesh-laptop.loc:47212 192.168.185.75:www close_wait 2109/ Firefox
TCP 0 0 ramesh-laptop.loc:52750 lax:www established 2109/firefox
5. Do not display host, port and username in netstat output (host, port or user)
When you don't want to have the host, port and username displayed, use Netstat-n. Numbers will be used instead of those names.
The output can also be accelerated because there is no comparison query.
If you just don't want one of these three names to be displayed, use the following command
# netsat-a--numeric-ports
# netsat-a--numeric-hosts
# netsat-a--numeric-users
6. Continuous output netstat information
Netstat will output network information every second.
# netstat-c
Active Internet connections (w/o servers) Proto Recv-q Local address send-q Address State
TCP 0 0 ramesh-laptop.loc:36130 101-101-181-225.ama:www established
TCP 1 1 ramesh-laptop.loc:52564 101.11.169.230:www CLOSING
tcp 0 0 ramesh-laptop.loc:43758 SERVER-101-101-43-2:WWW established
TCP 1 1 ramesh-laptop.loc:42367 101.101.34.101:www CLOSING
^c
7. Show the system does not support the address of the family (addresses families)
At the end of the output, you will have the following information
Netstat:no support for ' AF IPX ' in this system.
Netstat:no support for ' AF AX25 ' in this system.
Netstat:no support for ' AF X25 ' in this system.
Netstat:no support for ' AF Netrom ' in this system.
8. Display Core Routing information netstat-r
# netstat-r
Kernel IP routing table
destination Gateway genmask Flags MSS Window Irtt iface
192.168.1.0 * 255.255.255.0 U 0 0 0 eth2
link-local * 255.255.0.0 U 0 0 0 eth2
default 192.168.1.1 0.0.0.0 UG 0 0 0 eth2
Note: Use Netstat-rn to display the number format without querying the host name.
9. Find the port where the program is running
Not all processes can be found, no permissions will be displayed, and all information is viewed using root permissions.
# Netstat-ap | grep ssh
TCP 1 0 dev-db:ssh 101.174.100.22:39213 close_wait-
TCP 1 0 dev-db:ssh 101.174.100.22:57643 Close_wait-
Locate the process running on the specified port
# Netstat-an | grep ': 80 '
10. Display Network Interface list
# netstat-i
Kernel Interface table
iface MTU Met rx-ok rx-err rx-drp rx-ovr tx-ok tx-err TX-DRP TX-OVR Flg
eth0 1500 0 0 0 0 0 0 0 0 0 BMU
eth2 1500 0 26196 0 0 0 26883 6 0 0 Bmru
lo 16436 0 4 0 0 0 4 0 0 0 LRU
Display details, such as Ifconfig using Netstat-ie:
# Netstat-ie
Kernel Interface table
eth0 Link encap:ethernet hwaddr 00:10:40:11:11:11 up
Broadcast Multicast mtu:1500 metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 ov erruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
memory:f6ae0000-f6b00000
IP and TCP Analysis
View the IP addresses that have the most connections to a service port
wss8848@ubuntu:~$ Netstat-nat | grep "192.168.1.15:22" |awk ' {print $} ' |awk-f: ' {print '} ' |sort|uniq-c|sort-nr|head-20
221.136.168.36
154.74.45.242
78.173.31.236
62.183.207.98
192.168.1.14
182.48.111.215
124.193.219.34
119.145.41.2
114.255.41.30
75.102.11.99
TCP Various status lists
wss8848@ubuntu:~$ netstat-nat |awk ' {print $} '
established
Foreign LISTEN Established
time_wait
syn_sent
First take the state all out, and then use UNIQ-C statistics, and then sorted.
wss8848@ubuntu:~$ netstat-nat |awk ' {print $} ' |sort|uniq-c established fin_wait1 Foreign last_
ACK
LISTEN
syn_sent
time_wait
established)
The final order is as follows:
Netstat-nat |awk ' {print $} ' |sort|uniq-c|sort-rn
Analysis Access.log access to the first 10-bit IP address
awk ' {print $} ' Access.log |sort|uniq-c|sort-nr|head-10
The above is the entire content of this article, I hope to help you learn, but also hope that we support the cloud habitat community.