netstat 常用命令
$sudo netstat -antp|grep 8080 查找占用8080端口的程序 这个最常用
$sudo netstat -np|grep java|wc -l 查看java的并发数
查看80端口请求数最高的20个ip (查找攻击源)
$netstat -anlp|grep 80|grep tcp|awk '{print $5}'|awk -F: '{print $1}'|sort|uniq -c|sort -nr|head -n20
查看tcp端口的状态
$netstat -nat |awk '{print $6}'|sort|uniq -c|sort -rn
参数汇总
-a show both listening and none-listening sockets.默认是不显示listening sockets
-t 仅显示tcp相关 默认是都显示
-u 仅显示udp相关 默认是都显示
-n 拒绝显示别名，显示数字
-l 仅列出有在Listen(监听)的服务状态
-p 显示建立相关连接的程序名 需要sudo才能看到其他用户起动的程序pid
-r 显示路由表
-c 每隔一段时间(秒)，执行该netstat命令
-i 显示各个网络接口的状况
-s 按照协议进行统计
前面锁所示的 -antp 大家可以对照看一下
TCP端口状态
TCP端口有如下几个常见的状态
1.LISTENING 对应netstat的LISTEN 我们开一个80端口的服务，也就是使80端口处于LISTEN状态，
这样浏览器就可以与我们的80端口进行连接
2.ESTABLISED 表示两个端口建立连接成功，正在通信
3.CLOSE_WAIT 对方主动关闭连接或者网络异常导致连接中断，这时我方的状态就会变为CLOSE_WAIT,
此时我方要主动调用close()来关闭连接
4.TIME_WAIT 我方主动调用close()断开连接，收到对方确认后变为TIME_WAIT.
TCP协议规定TIME_WAIT状态会一直持续2MSL(两倍的分段最大生存期)，
以此确保旧的连接状态不会对新连接产生影响。处于TIME_WAIT状态的连接不会被内核释放，
所以作为服务器，在可能的情况下，尽量不要主动断开连接，以减少TIME_WAIT状态造成的资源浪费。
-a 参数
show both listening and none-listening sockets.默认是不显示listening sockets
$netstat
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 hu_bo1:47054 hu_bo1:8961 TIME_WAIT
tcp 0 0 hu_bo1:6981 192.168.6.80:54645 ESTABLISHED
tcp 41 0 localhost:8092 localhost:25272 CLOSE_WAIT
$netstat -a
tcp 0 0 *:acnet *:* LISTEN #多了这个
tcp 0 0 hu_bo1:47054 hu_bo1:8961 TIME_WAIT
tcp 0 0 hu_bo1:6981 192.168.6.80:54645 ESTABLISHED
tcp 41 0 localhost:8092 localhost:25272 CLOSE_WAIT
其中Recv-Q 表示接受队列 Send-Q表示发送队列 这些数字一般是0,如果不是则表示网络包正在堆积
-t 参数
只显示tcp端口 默认是全部显示
$netstat
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 hu_bo1:47054 hu_bo1:8961 TIME_WAIT
tcp 0 0 hu_bo1:6981 192.168.6.80:54645 ESTABLISHED
tcp 41 0 localhost:8092 localhost:25272 CLOSE_WAIT
tcp 0 0 SHTU-ABC-05.abc:griffin SHTU-REDIS-21-104.abc:6062 ESTABLISHED
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags Type State I-Node Path
unix 7 [ ] DGRAM 74370628 /dev/log
unix 2 [ ] DGRAM 834846110
其中Active UNIX doamin sockets 为Unix域套接字，只能用于本机进程间通讯，性能比TCP高
$netstat -t
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 hu_bo1:47054 hu_bo1:8961 TIME_WAIT
tcp 0 0 hu_bo1:6981 192.168.6.80:54645 ESTABLISHED
tcp 41 0 localhost:8092 localhost:25272 CLOSE_WAIT
tcp 0 0 SHTU-ABC-05.abc:griffin SHTU-REDIS-91-14.abc:6062 ESTABLISHED
-u 参数
只显示udp 端口，默认是全部显示
-n 参数
-n 拒绝显示别名，显示数字
$netstat
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 hu_bo1:47054 hu_bo1:8961 TIME_WAIT
tcp 0 0 hu_bo1:6981 192.168.6.80:54645 ESTABLISHED
tcp 41 0 localhost:8092 localhost:25272 CLOSE_WAIT
tcp 0 0 SHTU-ABC-05.abc:griffin SHTU-REDIS-21-104.abc:6062 ESTABLISHED
如下所示，显示的都是ip地址
$netstat -n
tcp 0 0 192.168.17.13:47054 192.168.17.13:8961 TIME_WAIT
tcp 0 0 192.168.17.13:6981 192.168.6.80:54645 ESTABLISHED
tcp 41 0 127.0.0.1:8092 127.0.0.1:25272 CLOSE_WAIT
-l 参数
-l 仅列出有在Listen(监听)的服务状态
$netstat -l
tcp 0 0 hu_bo1:6981 *:* LISTEN
tcp 0 0 *:2189 *:* LISTEN
tcp 0 0 hu_bo1:11213 *:* LISTEN
tcp 0 0 hu_bo1:6586 *:* LISTEN
-p 参数
-p 显示建立相关连接的程序名 需要sudo才能看到其他用户起动的程序pid
$sudo netstat -p
tcp 0 0 hu_bo1:6981 192.168.77.80:52256 ESTABLISHED 6458/redis-server 1
tcp 0 0 hu_bo1:6980 hu_bo1:11802 ESTABLISHED 6418/redis-server 1
tcp 0 0 hu_bo1:6980 192.168.77.80:65120 ESTABLISHED 6418/redis-server 1
-r 参数
-r 显示路由表
$ netstat -r
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
192.168.77.0 * 255.255.255.0 U 0 0 0 em2
link-local * 255.255.0.0 U 0 0 0 em1
link-local * 255.255.0.0 U 0 0 0 em2
192.168.0.0 192.168.77.1 255.255.0.0 UG 0 0 0 em2
-i 参数
-i 显示各个网络接口的状况
$netstat -i
Kernel Interface table
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
em1 1500 0 120567162 0 0 0 90527177 0 0 0 BMRU
em2 1500 0 5357249686 0 0 0 4400173145 0 0 0 BMRU
lo 65536 0 49625810403 0 0 0 49625810403 0 0 0 LRU
参数解释
RX-OK 接收时，正确的数据包数
RX-ERR 接受时，错误的数据包数
RX-DRP 接受时，丢弃的数据包数
RX-OVR 接收时，由于过速（在数据传输中，由于接收设备不能接收按照发送速率传送来的数据而使数据丢失）而丢失的数据包数。
TX-OK 发送时，正确的数据包数。
TX-ERR 发送时，产生错误的数据包数。
TX-DRP 发送时，丢弃的数据包数。
TX-OVR 发送时，由于过速而丢失的数据包数。
Flg
标志。
B 已经设置了一个广播地址。
L 该接口是一个回送设备。
M 接收所有数据包（混乱模式）。
N 避免跟踪。
O 在该接口上，禁用ARP。
P 这是一个点到点链接。
R 接口正在运行。
U 接口处于“活动”状态。
-c 参数
$netstat -p -c 10 每隔10秒执行一次该命令
-s 参数
-s 按照协议进行统计 如果机器网络不太好的情况下，我们可以使用此参数来进行分析
$netstat -s
Ip:
54102745340 total packets received
0 forwarded
0 incoming packets discarded
54086127151 incoming packets delivered
54101665338 requests sent out
Icmp: #Internet Control Message Protocol, Internet 控制报文协议 用于在IP主机、路由器之间传递控制消息
1077840 ICMP messages received
2145 input ICMP message failed.
ICMP input histogram:
destination unreachable: 2475
timeout in transit: 248
wrong parameters: 1
source quenches: 3
redirects: 1
echo requests: 1075034
echo replies: 69
timestamp request: 3
1129878 ICMP messages sent
0 ICMP messages failed
ICMP output histogram:
destination unreachable: 54769
echo request: 72
echo replies: 1075034
timestamp replies: 3
IcmpMsg:
InType0: 69
InType3: 2475
InType4: 3
InType5: 1
InType8: 1075034
InType11: 248
InType12: 1
InType13: 3
OutType0: 1075034
OutType3: 54769
OutType8: 72
OutType14: 3
Tcp:
4149941351 active connections openings
1022620333 passive connection openings
3095563980 failed connection attempts
100271379 connection resets received
1084 connections established #目前有多少个连接
54083689577 segments received
54084074455 segments send out
15055961 segments retransmited
195874 bad segments received.
3856575743 resets sent
Udp:
1241256 packets received
54773 packets to unknown port received.
0 packet receive errors
1405039 packets sent
UdpLite:
TcpExt:
247872 invalid SYN cookies received
16618 resets received for embryonic SYN_RECV sockets
1240 packets pruned from receive queue because of socket buffer overrun
60 packets pruned from receive queue
1 packets dropped from out-of-order queue because of socket buffer overrun
29 ICMP packets dropped because they were out-of-window
78559379 TCP sockets finished time wait in fast timer
883371423 time wait sockets recycled by time stamp
1535 packets rejects in established connections because of timestamp
182605148 delayed acks sent
32564 delayed acks further delayed because of locked socket
Quick ack mode was activated 821546 times
2675061 times the listen queue of a socket overflowed
2675061 SYNs to LISTEN sockets ignored
19271359 packets directly queued to recvmsg prequeue.
7399328202 packets directly received from backlog
6765697193 packets directly received from prequeue
35764943050 packets header predicted
6579353 packets header predicted and directly queued to user
4032336419 acknowledgments not containing data received
34697552082 predicted acknowledgments
2816 times recovered from packet loss due to SACK data
Detected reordering 15 times using FACK
Detected reordering 89 times using SACK
Detected reordering 81 times using time stamp
194 congestion windows fully recovered
1916 congestion windows partially recovered using Hoe heuristic
TCPDSACKUndo: 9657
4637954 congestion windows recovered after partial ack
37163 TCP data loss events
TCPLostRetransmit: 503
46377 timeouts after SACK recovery
442 timeouts in loss state
13532 fast retransmits
4104 forward retransmits
10183 retransmits in slow start
13670540 other TCP timeouts
192 sack retransmits failed
1 times receiver scheduled too late for direct processing
256454 packets collapsed in receive queue due to low socket buffer
822253 DSACKs sent for old packets
1212 DSACKs sent for out of order packets
42832 DSACKs received
18 DSACKs for out of order packets received
85408336 connections reset due to unexpected data
251901 connections reset due to early user close
8215 connections aborted due to timeout
TCPDSACKIgnoredOld: 105
TCPDSACKIgnoredNoUndo: 4023
TCPSpuriousRTOs: 389
TCPSackShifted: 38352
TCPSackMerged: 77354
TCPSackShiftFallback: 285038
TCPBacklogDrop: 4806
TCPChallengeACK: 599326
TCPSYNChallenge: 503530
TCPFromZeroWindowAdv: 52647
TCPToZeroWindowAdv: 52647
TCPWantZeroWindowAdv: 12002148
IpExt:
InBcastPkts: 37
InOctets: 12648107098338
OutOctets: 10787636949021
InBcastOctets: 19328
Free-Abc智能