Linux netstat command detailed

Command: Netstat

Common parameters

-A (All) displays all options and does not show listen related by default

-T (TCP) displays only TCP-related options

-U (UDP) displays only UDP-related options

-N refuses to display aliases, showing all numbers converted to numbers.

-l list only service status in Listen (listening)

-P Displays the program name that establishes the associated link

-R display routing information, routing table

-e display extended information, such as UID, etc.

-S statistics according to each protocol

-C executes the netstat command every other fixed time.

Hint: The status of listen and listening can only be seen with-a or-l

Practical Command Instances

1. List all ports (including listening and not listening)

List all ports Netstat–a

List all TCP ports Netstat-at

List all UDP ports Netstat-au

2. List all Sockets in the listening state

Display only the listening port netstat-l

List all listening TCP ports only NETSTAT-LT

List all listening UDP ports only Netstat-lu

List all listening UNIX ports only NETSTAT-LX

3. Display statistics for each protocol

Displays statistics for all ports netstat-s

Displays statistics for TCP or UDP ports netstat-st or-SU

4. Display the PID and process name in the netstat output netstat-p

Netstat-p can be used with other switches, you can add "Pid/process name" to the netstat output, so debugging can easily find a specific port to run the program.

# netstat-pt

5. Host, port, and user name are not displayed in the Netstat output

When you don't want to let the host, port and user name display, use Netstat-n. Numbers will be used instead of those names.

The output can also be accelerated because there is no comparison query.

# Netstat–an

If you just don't want one of these three names to be displayed, use the following command

# netsat-a--numeric-ports

# netsat-a--numeric-hosts

# netsat-a--numeric-users

6. Continuous output of netstat information

Netstat will output network information every second.

# netstat-c

7. Show address families not supported by the system (addr families)

Netstat--verbose

8. Display Core Routing information netstat-r

# Netstat-r

9. Find out which port the program is running on

Not all processes can be found, no permissions will not be displayed, use root permissions to view all the information.

# Netstat-ap | grep ssh

Locate the process running on the specified port

# Netstat-an | grep ': 80 '

10. Display the list of network interfaces

# netstat-i

Show details like ifconfig using Netstat-ie:

# Netstat-ie

IP and TCP Analysis

View the IP addresses that connect to a service port

[Email protected]:~$ Netstat-nat | grep "192.168.1.15:22" |awk ' {print $} ' |awk-f: ' {print '} ' |sort|uniq-c|sort-nr|head-20

TCP Various status lists

Ro[email protected]:~$ netstat-nat |awk ' {print $6} '

Take the state all out first, then use UNIQ-C statistics, then sort.

[Email protected]:~$ netstat-nat |awk ' {print $6} ' |sort|uniq-c

The final command is as follows:

Netstat-nat |awk ' {print $6} ' |sort|uniq-c|sort-rn

Linux netstat command detailed