Linux netstat command Daquan detailed _linux

Brief introduction

The Netstat command is used to display various network-related information, such as network connections, routing tables, Interface states (Interface Statistics), masquerade connections, multicast members (multicast memberships), and so on.

Output information meaning

After the Netstat is executed, its output is

Active Internet connections (w/o servers)
Proto recv-q send-q Local address Foreign address state
TCP 0 2 210.34.6 .89:telnet 210.34.6.96:2873 established
TCP 296 0 210.34.6.89:1165 210.34.6.84:netbios-ssn ESTABLISHED
TCP 0 0 LOCALHOST.LOCALDOM:9001 localhost.localdom:1162 established
TCP 0 0 localhost.localdom:1162 Localhost.localdom : 9001 established
TCP 0 210.34.6.89:1161 210.34.6.10:netbios-ssn close

Active UNIX domain sockets (w/o servers
Proto refcnt Flags Type State i-node Path
UNIX 1 [] stream CONNECTED 16178 @000000dd
Unix 1 [] stream C onnected 16176 @000000dc
Unix 9 [] dgram 5292/dev/log
UNIX 1 [] STREAM CONNECTED 16182 @000000df

As a whole, the output of Netstat can be divided into two parts:

One is the active Internet connections, known as the active TCP connection, where "recv-q" and "Send-q" refer to%0a receive queues and send queues. These numbers should generally be 0. If not, it means that the package is piling up in the queue. This situation can only be seen in very few situations.

The other is active UNIX domain sockets, known as the active UNIX domains socket (like a network socket, but only for native communication, which can improve performance by a factor).

Proto displays the protocol used by the connection, refcnt represents the process number that is attached to this set of interfaces, types displays the type of the socket interface, state displays the current status of the socket interface, and path represents the pathname used by other processes connected to the socket interface.

Common parameters

-A (all) shows all options, default does not show listen related
-T (TCP) displays only TCP-related options
-U (UDP) only displays UDP-related options
-N denies displaying aliases, and can display all numbers converted to numbers.
-l list only service status with Listen (listening)
-P Displays the name of the program that establishes the associated link
-R Displays routing information, routing table
-e display extended information, such as UID, etc.
-S statistics according to each protocol
-C executes the netstat command at every other fixed time.

Hint: The status of listen and listening can only be seen with-a or-l

Practical Command Instances

1. List all ports (both listening and not listening)

List all ports netstat-a

 # Netstat-a | More
 Active Internet connections (servers and established)
 Proto recv-q send-q Local address      Foreign address     state
 TCP    0   0 localhost:30037     *:*           LISTEN
 UDP    0   0 *:bootpc        *:*
 
Active UNIX domain sockets (servers and established)
 Proto refcnt Flags    Type    State     I-node  Path
 Unix 2   [ACC]   STREAM   listening   6135   /tmp/. X11-unix/x0
 Unix 2   [ACC]   STREAM   listening   5140   /var/run/acpid.socket

List all TCP ports Netstat-at

# netstat-at
 Active Internet connections (servers and established) Proto Recv-q Local address      send-q IGN address     state
 TCP    0   0 localhost:30037     *:*           LISTEN
 tcp    0   0 Localhost:ipp      *:*           LISTEN
 tcp    0   0 *:smtp         *:*           LISTEN
 tcp6    0   0 Localhost:ipp      [::]:*         LISTEN

List all UDP ports Netstat-au

 # Netstat-au
 Active Internet connections (servers and established) Proto Recv-q Local address      send-q Address     state
 UDP    0   0 *:bootpc        *:*
 UDP    0   0 *:49119         *:*
 UDP    0   0 *:mdns         *:*

2. List all Sockets in the listening state

Show only listening ports netstat-l

# netstat-l
 Active Internet connections (only servers)
 Proto recv-q send-q Local address      Foreign address< C23/>state
 TCP    0   0 Localhost:ipp      *:*           LISTEN
 tcp6    0   0 Localhost:ipp      [::]:*         LISTEN
 UDP    0   0 *:49119         *:*

Lists all listening TCP ports only NETSTAT-LT

 # netstat-lt
 Active Internet connections (only servers)
 Proto recv-q send-q Local address      Foreign Address
   state
 TCP    0   0 localhost:30037     *:*           LISTEN
 tcp    0   0 *:smtp         *:*           LISTEN
 tcp6    0   0 Localhost:ipp      [::]:*         LISTEN

Lists all listening UDP ports only Netstat-lu

# netstat-lu
 Active Internet connections (only servers)
 Proto recv-q send-q Local address      Foreign address     state
 UDP    0   0 *:49119         *:*
 UDP    0   0 *:mdns         *:*

List only all listening UNIX ports NETSTAT-LX

 # NETSTAT-LX
 Active UNIX domain sockets (only servers)
 Proto refcnt Flags    Type    State     I-node  Path
 Unix 2   [ACC]   STREAM   listening   6294   private/maildrop
 Unix 2   [ACC]   Stream   listening   6203   public/cleanup
 Unix 2   [ACC]   STREAM   listening   6302   private/ifmail
 Unix 2   [ACC]   STREAM   listening   6306   private/bsmtp

3. Display statistical information for each protocol

Show statistics for all ports netstat-s

 # netstat-s
 Ip: Total
packets received with
invalid addresses
forwarded incoming packets Discarded
incoming packets delivered
requests out
 ICMP:
ICMP sent messages
input ICMP message failed.
 TCP:
Active connections Openings
failed connection attempts connection resets received
 UDP:
Packets received
packets to unknown Port received.
 .....

Displays statistics for TCP or UDP ports netstat-st or-SU

# netstat-st 
# NETSTAT-SU

4. Display PID and process name in netstat output netstat-p

Netstat-p can be used with other switches, you can add "Pid/process name" to the netstat output, so debugging can easily find a specific port to run the program.

# netstat-pt
 Active Internet connections (w/o servers) Proto Recv-q Local address      send-q Foreign >state    pid/program name
 TCP    1   0 ramesh-laptop.loc:47212 192.168.185.75:www    close_wait 2109/ Firefox
 TCP    0   0 ramesh-laptop.loc:52750 lax:www established 2109/firefox

5. Do not display host, port and username in netstat output (host, port or user)

When you don't want to have the host, port and username displayed, use Netstat-n. Numbers will be used instead of those names.

The output can also be accelerated because there is no comparison query.

# Netstat-an

If you just don't want one of these three names to be displayed, use the following command

# netsat-a--numeric-ports
# netsat-a--numeric-hosts
# netsat-a--numeric-users

6. Continuous output netstat information

Netstat will output network information every second.

# netstat-c
 Active Internet connections (w/o servers) Proto Recv-q Local address      send-q     Address State
 TCP    0   0 ramesh-laptop.loc:36130 101-101-181-225.ama:www established
 TCP    1   1 ramesh-laptop.loc:52564 101.11.169.230:www   CLOSING
 tcp    0   0 ramesh-laptop.loc:43758 SERVER-101-101-43-2:WWW established
 TCP    1   1 ramesh-laptop.loc:42367 101.101.34.101:www   CLOSING
 ^c

7. Show the system does not support the address of the family (addresses families)

Netstat--verbose

At the end of the output, you will have the following information

Netstat:no support for ' AF IPX ' in this system.
Netstat:no support for ' AF AX25 ' in this system.
Netstat:no support for ' AF X25 ' in this system.
Netstat:no support for ' AF Netrom ' in this system.

8. Display Core Routing information netstat-r

# netstat-r
 Kernel IP routing table
 destination   Gateway     genmask     Flags  MSS Window Irtt iface
 192.168.1.0   *        255.255.255.0  U     0 0     0 eth2
 link-local   *        255.255.0.0   U     0 0     0 eth2
 default     192.168.1.1   0.0.0.0     UG    0 0     0 eth2

Note: Use Netstat-rn to display the number format without querying the host name.

9. Find the port where the program is running

Not all processes can be found, no permissions will be displayed, and all information is viewed using root permissions.

# Netstat-ap | grep ssh
 TCP    1   0 dev-db:ssh      101.174.100.22:39213    close_wait-
 TCP    1   0 dev-db:ssh      101.174.100.22:57643    Close_wait-

Locate the process running on the specified port

# Netstat-an | grep ': 80 '

10. Display Network Interface list

# netstat-i
 Kernel Interface table
 iface  MTU Met  rx-ok rx-err  rx-drp rx-ovr tx-ok tx-err TX-DRP TX-OVR Flg
 eth0    1500 0     0   0   0 0 0 0 0   0 BMU
 eth2    1500 0   26196   0   0 0     26883   6   0 0   Bmru
 lo    16436 0       4 0 0 0 4   0   0   0 LRU

Display details, such as Ifconfig using Netstat-ie:

# Netstat-ie
 Kernel Interface table
 eth0   Link encap:ethernet hwaddr 00:10:40:11:11:11 up
 Broadcast Multicast mtu:1500 metric:1
 RX packets:0 errors:0 dropped:0 overruns:0 frame:0
 TX packets:0 errors:0 dropped:0 ov erruns:0 carrier:0
 collisions:0 txqueuelen:1000
 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
 memory:f6ae0000-f6b00000

IP and TCP Analysis

View the IP addresses that have the most connections to a service port

wss8848@ubuntu:~$ Netstat-nat | grep "192.168.1.15:22" |awk ' {print $} ' |awk-f: ' {print '} ' |sort|uniq-c|sort-nr|head-20
221.136.168.36
154.74.45.242
78.173.31.236
62.183.207.98
192.168.1.14
182.48.111.215
124.193.219.34
119.145.41.2
114.255.41.30
75.102.11.99

TCP Various status lists

wss8848@ubuntu:~$ netstat-nat |awk ' {print $} '
established
Foreign LISTEN Established
time_wait
syn_sent

First take the state all out, and then use UNIQ-C statistics, and then sorted.

wss8848@ubuntu:~$ netstat-nat |awk ' {print $} ' |sort|uniq-c established fin_wait1 Foreign last_
ACK
LISTEN
syn_sent
time_wait
established)

The final order is as follows:

Netstat-nat |awk ' {print $} ' |sort|uniq-c|sort-rn

Analysis Access.log access to the first 10-bit IP address

awk ' {print $} ' Access.log |sort|uniq-c|sort-nr|head-10

The above is the entire content of this article, I hope to help you learn, but also hope that we support the cloud habitat community.