首页 » linux » netstat手册

netstat手册

 

netstat 常用命令

  $sudo netstat -antp|grep 8080   查找占用8080端口的程序   这个最常用
  $sudo netstat -np|grep java|wc -l  查看java的并发数
  
  查看80端口请求数最高的20个ip (查找攻击源)
  $netstat -anlp|grep 80|grep tcp|awk '{print $5}'|awk -F: '{print $1}'|sort|uniq -c|sort -nr|head -n20
    
  查看tcp端口的状态
  $netstat -nat |awk '{print $6}'|sort|uniq -c|sort -rn

参数汇总

   
  -a  show both listening and none-listening sockets.默认是不显示listening sockets
  -t  仅显示tcp相关  默认是都显示
  -u  仅显示udp相关  默认是都显示
  -n  拒绝显示别名,显示数字
  -l  仅列出有在Listen(监听)的服务状态
  -p  显示建立相关连接的程序名   需要sudo才能看到其他用户起动的程序pid

  -r  显示路由表
  -c  每隔一段时间(秒),执行该netstat命令
  -i  显示各个网络接口的状况 
  -s  按照协议进行统计

  
  前面锁所示的 -antp  大家可以对照看一下

TCP端口状态

  TCP端口有如下几个常见的状态
  1.LISTENING    对应netstat的LISTEN   我们开一个80端口的服务,也就是使80端口处于LISTEN状态,
                 这样浏览器就可以与我们的80端口进行连接
  2.ESTABLISED   表示两个端口建立连接成功,正在通信
  3.CLOSE_WAIT   对方主动关闭连接或者网络异常导致连接中断,这时我方的状态就会变为CLOSE_WAIT, 
                 此时我方要主动调用close()来关闭连接
  4.TIME_WAIT    我方主动调用close()断开连接,收到对方确认后变为TIME_WAIT. 
                 TCP协议规定TIME_WAIT状态会一直持续2MSL(两倍的分段最大生存期),
                 以此确保旧的连接状态不会对新连接产生影响。处于TIME_WAIT状态的连接不会被内核释放,
                 所以作为服务器,在可能的情况下,尽量不要主动断开连接,以减少TIME_WAIT状态造成的资源浪费。

-a 参数

  show both listening and none-listening sockets.默认是不显示listening sockets
  
  $netstat 
  Proto Recv-Q Send-Q Local Address               Foreign Address             State
  tcp        0      0 hu_bo1:47054                hu_bo1:8961                 TIME_WAIT
  tcp        0      0 hu_bo1:6981                 192.168.6.80:54645          ESTABLISHED
  tcp       41      0 localhost:8092              localhost:25272             CLOSE_WAIT
  
  $netstat -a
  tcp        0      0 *:acnet                     *:*                         LISTEN    #多了这个
  tcp        0      0 hu_bo1:47054                hu_bo1:8961                 TIME_WAIT
  tcp        0      0 hu_bo1:6981                 192.168.6.80:54645          ESTABLISHED
  tcp       41      0 localhost:8092              localhost:25272             CLOSE_WAIT

  其中Recv-Q 表示接受队列  Send-Q表示发送队列  这些数字一般是0,如果不是则表示网络包正在堆积

-t 参数

  只显示tcp端口 默认是全部显示
  $netstat 
  Proto Recv-Q Send-Q Local Address               Foreign Address             State
  tcp        0      0 hu_bo1:47054                hu_bo1:8961                 TIME_WAIT
  tcp        0      0 hu_bo1:6981                 192.168.6.80:54645          ESTABLISHED
  tcp       41      0 localhost:8092              localhost:25272             CLOSE_WAIT
  tcp        0      0 SHTU-ABC-05.abc:griffin     SHTU-REDIS-21-104.abc:6062 ESTABLISHED
  Active UNIX domain sockets (w/o servers)
  Proto RefCnt Flags       Type       State         I-Node Path               
  unix  7      [ ]         DGRAM                    74370628 /dev/log
  unix  2      [ ]         DGRAM                    834846110
  
  其中Active UNIX doamin sockets 为Unix域套接字,只能用于本机进程间通讯,性能比TCP高
  
  $netstat -t
  Proto Recv-Q Send-Q Local Address               Foreign Address             State
  tcp        0      0 hu_bo1:47054                hu_bo1:8961                 TIME_WAIT
  tcp        0      0 hu_bo1:6981                 192.168.6.80:54645          ESTABLISHED
  tcp       41      0 localhost:8092              localhost:25272             CLOSE_WAIT
  tcp        0      0 SHTU-ABC-05.abc:griffin     SHTU-REDIS-91-14.abc:6062   ESTABLISHED

-u 参数

  只显示udp 端口,默认是全部显示

-n 参数

  -n  拒绝显示别名,显示数字
  $netstat
  Proto Recv-Q Send-Q Local Address               Foreign Address             State
  tcp        0      0 hu_bo1:47054                hu_bo1:8961                 TIME_WAIT
  tcp        0      0 hu_bo1:6981                 192.168.6.80:54645          ESTABLISHED
  tcp       41      0 localhost:8092              localhost:25272             CLOSE_WAIT
  tcp        0      0 SHTU-ABC-05.abc:griffin     SHTU-REDIS-21-104.abc:6062 ESTABLISHED
  
  
  如下所示,显示的都是ip地址
  $netstat -n
  tcp        0      0 192.168.17.13:47054         192.168.17.13:8961          TIME_WAIT
  tcp        0      0 192.168.17.13:6981          192.168.6.80:54645          ESTABLISHED
  tcp       41      0 127.0.0.1:8092              127.0.0.1:25272             CLOSE_WAIT

-l 参数

  -l  仅列出有在Listen(监听)的服务状态
  
  $netstat -l
  tcp        0      0 hu_bo1:6981                 *:*                         LISTEN
  tcp        0      0 *:2189                      *:*                         LISTEN
  tcp        0      0 hu_bo1:11213                *:*                         LISTEN
  tcp        0      0 hu_bo1:6586                 *:*                         LISTEN

-p 参数

  -p  显示建立相关连接的程序名   需要sudo才能看到其他用户起动的程序pid
  
  $sudo netstat -p
  tcp        0      0 hu_bo1:6981                 192.168.77.80:52256         ESTABLISHED 6458/redis-server 1
  tcp        0      0 hu_bo1:6980                 hu_bo1:11802                ESTABLISHED 6418/redis-server 1
  tcp        0      0 hu_bo1:6980                 192.168.77.80:65120         ESTABLISHED 6418/redis-server 1

-r 参数

  -r 显示路由表
  $ netstat -r
  Kernel IP routing table
  Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
  192.168.77.0     *              255.255.255.0   U         0 0          0 em2
  link-local      *               255.255.0.0     U         0 0          0 em1
  link-local      *               255.255.0.0     U         0 0          0 em2
  192.168.0.0     192.168.77.1    255.255.0.0     UG        0 0          0 em2

-i 参数

  -i 显示各个网络接口的状况
  
  $netstat -i
  Kernel Interface table
  Iface       MTU  Met  RX-OK      RX-ERR RX-DRP RX-OVR   TX-OK       TX-ERR TX-DRP TX-OVR  Flg
  em1        1500   0 120567162       0      0      0     90527177      0      0      0     BMRU
  em2        1500   0 5357249686      0      0      0     4400173145    0      0      0     BMRU
  lo        65536   0 49625810403     0      0      0     49625810403   0      0      0     LRU
  
  参数解释
  RX-OK   接收时,正确的数据包数
  RX-ERR  接受时,错误的数据包数
  RX-DRP  接受时,丢弃的数据包数
  RX-OVR  接收时,由于过速(在数据传输中,由于接收设备不能接收按照发送速率传送来的数据而使数据丢失)而丢失的数据包数。
  TX-OK   发送时,正确的数据包数。
  TX-ERR  发送时,产生错误的数据包数。
  TX-DRP  发送时,丢弃的数据包数。
  TX-OVR  发送时,由于过速而丢失的数据包数。
  
  Flg
  标志。
  B 已经设置了一个广播地址。
  L 该接口是一个回送设备。
  M 接收所有数据包(混乱模式)。
  N 避免跟踪。
  O 在该接口上,禁用ARP。
  P 这是一个点到点链接。
  R 接口正在运行。
  U 接口处于“活动”状态。

-c 参数

  $netstat -p -c 10   每隔10秒执行一次该命令

-s 参数

  -s 按照协议进行统计   如果机器网络不太好的情况下,我们可以使用此参数来进行分析
  
  $netstat -s 
  Ip:
      54102745340 total packets received
      0 forwarded
      0 incoming packets discarded
      54086127151 incoming packets delivered
      54101665338 requests sent out
  Icmp:         #Internet Control Message Protocol, Internet 控制报文协议 用于在IP主机、路由器之间传递控制消息
      1077840 ICMP messages received
      2145 input ICMP message failed.
      ICMP input histogram:
          destination unreachable: 2475
          timeout in transit: 248
          wrong parameters: 1
          source quenches: 3
          redirects: 1
          echo requests: 1075034
          echo replies: 69
          timestamp request: 3
      1129878 ICMP messages sent
      0 ICMP messages failed
      ICMP output histogram:
          destination unreachable: 54769
          echo request: 72
          echo replies: 1075034
          timestamp replies: 3
  IcmpMsg:
          InType0: 69
          InType3: 2475
          InType4: 3
          InType5: 1
          InType8: 1075034
          InType11: 248
          InType12: 1
          InType13: 3
          OutType0: 1075034
          OutType3: 54769
          OutType8: 72
          OutType14: 3
  Tcp:
      4149941351 active connections openings
      1022620333 passive connection openings
      3095563980 failed connection attempts
      100271379 connection resets received
      1084 connections established    #目前有多少个连接
      54083689577 segments received
      54084074455 segments send out
      15055961 segments retransmited
      195874 bad segments received.
      3856575743 resets sent
  Udp:
      1241256 packets received
      54773 packets to unknown port received.
      0 packet receive errors
      1405039 packets sent
  UdpLite:
  TcpExt:
      247872 invalid SYN cookies received
      16618 resets received for embryonic SYN_RECV sockets
      1240 packets pruned from receive queue because of socket buffer overrun
      60 packets pruned from receive queue
      1 packets dropped from out-of-order queue because of socket buffer overrun
      29 ICMP packets dropped because they were out-of-window
      78559379 TCP sockets finished time wait in fast timer
      883371423 time wait sockets recycled by time stamp
      1535 packets rejects in established connections because of timestamp
      182605148 delayed acks sent
      32564 delayed acks further delayed because of locked socket
      Quick ack mode was activated 821546 times
      2675061 times the listen queue of a socket overflowed
      2675061 SYNs to LISTEN sockets ignored
      19271359 packets directly queued to recvmsg prequeue.
      7399328202 packets directly received from backlog
      6765697193 packets directly received from prequeue
      35764943050 packets header predicted
      6579353 packets header predicted and directly queued to user
      4032336419 acknowledgments not containing data received
      34697552082 predicted acknowledgments
      2816 times recovered from packet loss due to SACK data
      Detected reordering 15 times using FACK
      Detected reordering 89 times using SACK
      Detected reordering 81 times using time stamp
      194 congestion windows fully recovered
      1916 congestion windows partially recovered using Hoe heuristic
      TCPDSACKUndo: 9657
      4637954 congestion windows recovered after partial ack
      37163 TCP data loss events
      TCPLostRetransmit: 503
      46377 timeouts after SACK recovery
      442 timeouts in loss state
      13532 fast retransmits
      4104 forward retransmits
      10183 retransmits in slow start
      13670540 other TCP timeouts
      192 sack retransmits failed
      1 times receiver scheduled too late for direct processing
      256454 packets collapsed in receive queue due to low socket buffer
      822253 DSACKs sent for old packets
      1212 DSACKs sent for out of order packets
      42832 DSACKs received
      18 DSACKs for out of order packets received
      85408336 connections reset due to unexpected data
      251901 connections reset due to early user close
      8215 connections aborted due to timeout
      TCPDSACKIgnoredOld: 105
      TCPDSACKIgnoredNoUndo: 4023
      TCPSpuriousRTOs: 389
      TCPSackShifted: 38352
      TCPSackMerged: 77354
      TCPSackShiftFallback: 285038
      TCPBacklogDrop: 4806
      TCPChallengeACK: 599326
      TCPSYNChallenge: 503530
      TCPFromZeroWindowAdv: 52647
      TCPToZeroWindowAdv: 52647
      TCPWantZeroWindowAdv: 12002148
  IpExt:
      InBcastPkts: 37
      InOctets: 12648107098338
      OutOctets: 10787636949021
      InBcastOctets: 19328

原文链接:netstat手册,转载请注明来源!

0