Linux Network Monitoring tool--NETSTAT and network connection analysis

The netstat command is used to print the status information of network systems in Linux, allowing you to know the network conditions of the entire Linux system.

-A (All) displays all options and does not show listen related by default
-T (TCP) displays only TCP-related options
-U (UDP) displays only UDP-related options
-N refuses to display aliases, showing all numbers converted to numbers
-l list only service status in Listen (listening)

-P Displays the program name that establishes the associated link
-R display routing information, routing table
-e display extended information, such as UID, etc.
-S statistics according to each protocol
-C executes the netstat command every other fixed time

Freq used: NETSTAT-LNPT

Netstat-an

1. View TCP connection Status
Netstat-nat |awk ' {print $6} ' |sort|uniq-c|sort-rn
Netstat-n | awk '/^tcp/{++s[$NF]}; END {for (a in S) print A, S[a]} '  
netstat-n | awk '/^tcp/{++arr[$NF]}; END {for (k in arr) print K, "\ T", arr[k]} '
Netstat-n |awk '/^tcp/{print $NF} ' |sort|uniq-c|sort-rn
Netstat-ant | A WK ' {print $NF} ' | Grep-v ' [A-z] | Sort | Uniq-c

2. Number of Lookup requests 20 IP (commonly used to find the source of attack)

Netstat-anlp|grep 80|grep Tcp|awk ' {print $} ' |awk-f: ' {print '} ' |sort|uniq-c|sort-nr|head-n20

3. Use tcpdump to sniff 80 ports with the highest number of IP
Tcpdump-i ETH0-TNN DST Port 80-c 1000 | Awk-f "." ' {print $1″. ' $2″. " $3″. " $4} ' | Sort | uniq-c | Sort-nr |head-10

4. Find more time_wait connections
Netstat-n|grep Time_wait|awk ' {print $} ' |sort|uniq-c|sort-rn|head-n10

5. Check for more SYN connections
Netstat-an | grep SYN | awk ' {print $} ' | Awk-f: ' {print $} ' | Sort | uniq-c | Sort-nr | More

6. Depending on the port column process
NETSTAT-NTLP | grep 80 | awk ' {print $7} ' | Cut-d/-F1

This article is from the "Practical Linux knowledge and Skills sharing" blog, please be sure to keep this source http://superleedo.blog.51cto.com/12164670/1886248

Linux Network Monitoring tool--NETSTAT and network connection analysis