Shulou(Shulou.com)06/01 Report--

This article will explain in detail how to use the netstat command in Linux system. The content of the article is of high quality, so Xiaobian shares it with you as a reference. I hope you have a certain understanding of relevant knowledge after reading this article.

The netstat man help manual will have a hint:

NOTE

This program is obsolete. Replacement for netstat is ss. Replacement for netstat -r is ip route.

Replacement for netstat -i is ip -s link. Replacement for netstat -g is ip maddr.

On Linux, netstat is deprecated and replaced by ss, netstat is obsolete and officially no longer updated. It has been superseded by the ss command and ip command, and may not be available in Linux distributions in the near future. So, if anyone else is using netstat, suggest that they use ss and ip.

netstat command is a very useful tool for monitoring TCP/IP networks. It displays routing tables, actual network connections, and status information for each network interface device.

Language: netstat [-acCeFghilMnNoprstuvVwx][-A network type>][--ip]

Note: netstat command allows you to know the entire Linux system network situation.

Parameters:

-a or--all Displays sockets in all connections.

-A Network Type> or--Network Type> Lists the relevant addresses in the connection for that network type.

-c or--continuous Continually lists network status.

-C or--cache Displays cache information for router configuration.

-e or--extend Displays additional information about the network.

-F or--fib shows FIB.

-g or--groups Displays the list of members of multiple broadcast function groups.

-h or--help online help.

-i or--interfaces Displays the web interface information form.

-l or--listening Displays the Socket of the server being monitored.

-M or--masquerade Displays disguised network connections.

-n or--numeric Use IP addresses directly, not through a domain name server.

-N or--netlink or--symbolic Displays the symbolic connection name of the network hardware peripheral.

-o or--timers Displays the timer.

-p or--programs Displays the program ID and program name of the Socket being used.

-r or--route Displays the Routing Table.

-s or--statistics Displays statistics for network work information.

-t or--tcp Displays the connection status of the TCP transport protocol.

-u or--udp Displays the UDP transport protocol connection status.

-v or--verbose shows instruction execution.

-V or--version Displays version information.

-w or--raw Displays the connection status of the RAW transmission protocol.

-x or--unix This parameter has the same effect as specifying the "-A unix" parameter.

--ip or--inet This parameter has the same effect as specifying the "-A inet" parameter.

1)

The code is as follows:

netstat -tl -nltp

View current tcp listening ports

Active Internet connections (only servers)

Proto Recv-Q Send-Q Local Address Foreign Address State

tcp 0 0 *:rrac *:* LISTEN

tcp 0 0 *:34006 *:* LISTEN

......

2)

The code is as follows:

netstat -tlp

View the current tcp listening port, need to display the listening program name, when you do not know mysql listening port is better to use

Active Internet connections (only servers)

Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name

tcp 0 0 *:rrac *:* LISTEN -

tcp 0 0 *:34006 *:* LISTEN 23425/mysqld

......

3)

The code is as follows:

netstat -tl | grep 34006

Only check the mysql listening port, the currently started mysql port is 34006, clearly know that mysql listening port to use

4)

The code is as follows:

netstat -ta | grep 34006

tcp 0 0 *:34006 *:* LISTEN

tcp 0 0 linux.local:34006 linux.local:41485 ESTABLISHED

tcp 0 0 linux.local:34006 linux.local:41486 ESTABLISHED

...

tcp 0 0 10.3.2.35:41488 10.3.2.35:34006 ESTABLISHED

tcp 0 0 10.3.2.35:41489 10.3.2.35:34006 ESTABLISHED

tcp 0 0 10.3.2.35:41490 10.3.2.35:34006 ESTABLISHED

Because the database and application are on the same machine, the connection is shown twice. You can use the-p parameter to display PID, then grep PID.

5)

The code is as follows:

netstat -tap | grep 34006 | grep 23425

23425 is the PID of the current mysql

tcp 0 0 *:34006 *:* LISTEN 23425/mysqld

tcp 0 0 linux.local:34006 linux.local:41510 ESTABLISHED 23425/mysqld

tcp 0 0 linux.local:34006 linux.local:41511 ESTABLISHED 23425/mysqld

tcp 0 0 linux.local:34006 linux.local:41516 ESTABLISHED 23425/mysqld Overall, netstat output can be divided into two parts, one is Active Internet connections, called active TCP connections, and the other is Active UNIX domain sockets, called active Unix domain sockets. Of the outputs above, the first section has five outputs showing active TCP connections, while the second section shows Unix domain socket connections. Proto shows the protocol used for the connection;RefCnt indicates the number of the process connected to the socket;Types shows the type of socket;State shows the current state of the socket;Path indicates the pathname used by other processes connected to the socket.

In fact, netstat is a collection of several tools.

display the routing table

When n e t s t a t is called with the- r tag, the kernel routing table is displayed, just as we did with the r o u t e command. The resulting output is as follows:

The code is as follows:

[root@machine1 /]$ netstat -nr

Kernel IP routing table

Destination Gateway Genmask Flags MSS Window irtt Iface

210.34.6.0 0.0.0.0 255.255.255.128 U 0 0 0 eth0

192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2

127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo

0.0.0.0 210.34.6.2 0.0.0.0 UG 0 0 0 eth0

- The n option causes netstat to output IP addresses in dotted quadrants instead of symbolic host names and network names. This is especially useful if you want to avoid looking up addresses over the network (such as avoiding DNS or NIS servers).

In the netstat output, the second column shows the gateway to which the route entry refers, and if no gateway is used, an asterisk (*) or 0.0.0.0 appears. The third column shows an overview of the route. When finding the most appropriate route for a specific IP address, the kernel will look at all entries in the routing table and perform a bitwise AND calculation of the IP address and genmask before comparing the found route with the target route. The fourth column shows the different markers, which are described as follows:

G route will use gateway.

U The interface to be used is active.

H Only one host can be reached via this route.

D This flag is set if the routing table entry was generated by an ICMP redirect message.

M This flag is set if the routing table entry has been modified by an ICMP redirect message.

The Iface of netstat output results shows the physical NIC used for the connection, such as eth0 means using the first one, eth2 means using the second one.

Display interface characteristics

When called with the- i tag, netstat displays the current configuration characteristics of the network interface. In addition, if called with the-a option, it will output all interfaces in the kernel, not just the currently configured interfaces. The output of netstat-i looks like this:

The code is as follows:

[root@machine1 /]$ netstat -i

Kernel Interface table

Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg

eth0 1500 0 787165 0 0 1 51655 0 0 0 BRU

eth2 1500 0 520811 0 0 0 1986 0 0 0 BRU

lo 3924 0 1943 0 0 0 43 0 0 0 LRU

The MTU and Met fields indicate the MTU and metric values of the interface; the RX and TX columns indicate how many packets have been sent and received without error (RX - OK / TX - OK), how many errors have been generated (RX-ERR/TX-ERR), how many packets have been dropped (RX-DRP/TX-DRP), and how many packets have been lost due to errors (RX-OVR/TX-OVR); and the last column shows the flags set for the interface, which take a single letter when using ifconfig to display the interface configuration. They are described as follows:

B has set up a broadcast address.

L This interface is a loopback device.

M receives all packets (chaotic mode).

N Avoid tracking.

O Disable AR P on this interface.

P This is a point-to-point link.

The R interface is running.

The U interface is active.

Display Link

netstat supports an option set for displaying active or passive sockets. Options- t, - u, - w, and- x represent TCP, UDP, RAW, and UNIX socket connections, respectively. If you additionally provide a- a flag, sockets waiting for a connection (i.e., in listening mode) will also be displayed. This gives you a list of servers that are currently running on the system.

When netstat -ta is called, the output is as follows:

The code is as follows:

[root@machine1 /]$ netstat -ta

Active Internet connections (servers and established)

Proto Recv-Q Send-Q Local Address Foreign Address State

tcp 0 2 210.34.6.89:telnet 210.34.6.96:2873 ESTABLISHED

tcp 0 0 210.34.6.89:1165 210.34.6.84:netbios-ssn ESTABLISHED

tcp 0 0 localhost.localdom:9001 localhost.localdom:1162 ESTABLISHED

tcp 0 0 localhost.localdom:1162 localhost.localdom:9001 ESTABLISHED

tcp 0 0 *:9001 *:* LISTEN

tcp 0 0 *:6000 *:* LISTEN

tcp 0 0 *:socks *:* LISTEN

tcp 0 80 210.34.6.89:1161 210.34.6.10:netbios-ssn CLOSE

How to use netstat command in Linux system is shared here. I hope the above content can be helpful to everyone and learn more knowledge. If you think the article is good, you can share it so that more people can see it.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.