Details about common options of netstat
-N: the IP address and port are directly displayed without resolution.
Otherwise, the port will be parsed to: 80 to www, 22 to ssh, and 13 to daytime
Resolve the IP address to 127.0.0.1 localhost, and 0.0.0.0 *
-L display connections from listening (only connections in listion state can be seen through-l or-)
-P: displays the PID of the socket process and the name of the process (root permission is required)
-T display tcp
-U display udp
-W raw
-A Show both listening and non-listening sockets
Displays tcp connections in any status. Otherwise, only tcp connections in non-liston status are displayed.
Example 1: sudo netstat-nplt
Description: displays the binding port and IP information of processes that are listening over tcp, ip address and host in numeric mode, and pid and process name of processes.
Example 2: sudo netstat-npltu
Description: displays the binding port and IP information of processes that are listening using tcp or udp, ip addresses and hosts, and process pid and process name in digital mode.
Example 3: sudo netstat-natp
Meaning: displays the binding port and IP information of a process that is listening or has established a connection using the tcp protocol. ip and host are displayed digitally, And the pid and name of the process are displayed.
Other netstat options
-I: display the network interface table
-S displays network statistics, including the number of packets sent and received by each protocol.
-R: Display route table
Some output fields of netstat
Recv-Q: data received by the socket but not removed by the process (in bytes)
Send-Q: the socket sends the message but does not receive the data confirmed by the remote recipient (in bytes)
1) query which process occupies port 80
Same as below
2) If the PC has multiple NICs, check the process bound to the IP address of the NIC.
Netstat-npl | grep 0.0.0.0 // 0.0.0.0 indicates binding each Nic, including the internet Nic and Intranet Nic.
Netstat-npl | grep Internet _ IP
Author "paggywong"