Shulou(Shulou.com)06/01 Report--

This article mainly introduces how to use the Netstat command in the Linux system, the article is very detailed, has a certain reference value, interested friends must read it!

The Netstat command is used to display all kinds of network-related information, such as network connection, routing table, interface status, and so on.

Introduction to Netstat: Netstat is a console command and a very useful tool for monitoring TCP/IP networks. It can display the routing table, the actual network connection, and the status information of each network interface device. Netstat is used to display statistics related to IP, TCP, UDP and ICMP protocols, and is generally used to verify the network connectivity of each port of the machine.

The meaning of the output information: after executing netstat, the output result is

[vagrant@centos6 ~] $netstat | more Active Internet connections (wsycho servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 10.0.2.15:ssh 10.0.2.2 more Active Internet connections 52091 ESTABLISHED Active UNIX domain sockets (wampo servers) Proto RefCnt Flags Type State I-Node Path unix 11 [] DGRAM 11021 / dev/log unix 2 [] DGRAM 11556 @ / org/freedesktop/hal/udev_event unix 2 [] DGRAM 8986 @ / org/kernel/udev/udevd unix 3 [] STREAM CONNECTED 17777 unix 3 [] STREAM CONNECTED 17776 as a whole The output of netstat can be divided into two parts:

OUTPUT Active Internet connections (TCP, UDP, raw) Proto The protocol (tcp, udp, raw) used by the socket. Recv-Q The count of bytes not copied by the user program connected to this socket. Send-Q The count of bytes not acknowledged by the remote host. One is Active Internet connections, which is called an active TCP connection, where "Recv-Q" and "Send-Q" refer to the receive queue and the send queue, and these numbers should generally be 0. If not, it means that packages are piling up in the queue, which is rare.

Active UNIX domain Sockets Proto The protocol (usually unix) used by the socket. RefCnt The reference count (i.e. Attached processes via this socket). Flags The flags displayed is SO_ACCEPTON (displayed as ACC), SO_WAITDATA (W) or SO_NOSPACE (N). SO_ACCECPTON is used on unconnected sockets if their corresponding processes are waiting for a connect request. The other flags are not of nor- mal interest. Type There are several types of socket access: SOCK_DGRAM The socket is used in Datagram (connectionless) mode. SOCK_STREAM This is a stream (connection) socket. SOCK_RAW The socket is used as a raw socket. The other is Active UNIX domain sockets, called the active Unix domain socket (like network sockets, but only for native communication, and performance can be doubled).

Proto shows the protocol used for the connection, RefCnt indicates the number of processes connected to this socket, Types shows the type of socket, State shows the current status of the socket, and Path indicates the pathname used by other processes connected to the socket. The common parameter-a (all) shows all options, netstat does not show LISTEN related by default-t (tcp) shows only tcp related options-u (udp) shows only udp related options-n refuses to show aliases and can show that all numbers are converted into numbers. (important)-l only lists the service status in Listen (snooping)-p displays the name of the program that establishes the relevant link (macOS represents protocol-p protocol)-r displays routing information, routing table-e displays extended information, such as uid, etc.-s carries out statistics by each protocol (important)-c executes the netstat command at regular intervals. Tip: the status of LISTEN and LISTENING can only be seen with-an or-l

Practical command example 1. List all ports (both listening and unlistening) list all ports: netstat-a list all tcp ports: netstat-at list all udp ports: netstat-au2. List all listening Sockets ports only: netstat-l lists only all listening tcp ports: netstat-lt lists only all listening udp ports; netstat-lu lists only all listening UNIX ports: netstat-lx3. Display statistics for each protocol show statistics for all ports netstat-s

[vagrant@centos6] $netstat-s Ip: 2081 total packets received 2 with invalid addresses 0 forwarded 0 incoming packets discarded 2079 incoming packets delivered 1319 requests sent out Icmp: 0 ICMP messages received 0 input ICMP message failed. ICMP input histogram: 0 ICMP messages sent 0 ICMP messages failed ICMP output histogram: Tcp: 0 active connections openings 3 passive connection openings 0 failed connection attempts 0 connection resets received 1 connections established 1957 segments received 1103 segments send out 0 segments retransmited 0 bad segments received. 1 resets sent Udp: 122 packets received 0 packets to unknown port received. 0 packet receive errors 216 packets sent UdpLite: TcpExt: 9 delayed acks sent 1 packets directly queued to recvmsg prequeue. 730 packets header predicted 5 acknowledgments not containing data received 1036 predicted acknowledgments 0 TCP data loss events IpExt: InOctets: 146500 OutOctets: 132340 displays statistics for TCP or UDP ports netstat-st or-su

# netstat-st # netstat-su4. Display PID and process name netstat-p can be used with other switches, you can add "PID/ process name" to the netstat output, so that debugging can easily find the program running on a specific port.

[root@centos6 ~] # netstat-pt Active Internet connections (wstroke o servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 00 10.0.2.15:ssh 10.0.2.2 root@centos6 52964 ESTABLISHED 3008/sshd tcp 00 10.0.2.15:ssh 10. 0.2.2:52091 ESTABLISHED 2813/sshd5. Do not display host, port and user name (host, port or user) when you do not want host, port and user name to be displayed, use netstat-n. Numbers will be used instead of those names. This parameter speeds up the output of the output because there is no need for a comparison query.

# netstat-an # if you just don't want one of these three names to be displayed, use the following command # netsat-a-- numeric-ports # netsat-a-- numeric-hosts # netsat-a-- numeric-users6. Continuous output of netstat information netstat will output network information every other second.

# netstat-t-c 27. Display the unsupported address family (Address Families) netstat-verbose8. Display core routing information [root@centos6 ~] # netstat-rn Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 10.0.2.0 0.0.0.0 255.255.255.0 U 000 eth0 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0 0.0.0.0 10.0.2.2 0.0.0.0 UG 000 eth0 # Note: use netstat-rn to display the number format Do not query the host name, the effect is equivalent to route-n9. Find out the port on which the program is running, not all processes can find it, those without permissions will not be displayed, and use root permissions to view all the information.

[root@centos6 ~] # netstat-apn | grep ssh tcp 00 0.0.0.0apn 22 0.0.0.0grep ssh tcp 00 10.0.2.15 LISTEN 1438/sshd tcp 00 10.0.2.15 LISTEN 1438/sshd tcp 22 10.0.2.2apn 52964 apn 00 10.0.2.15 : 22 10.0.2.2 STREAM CONNECTED 52091 ESTABLISHED 2813/sshd tcp 00: 22: * LISTEN 1438/sshd unix 3 [] STREAM CONNECTED 18443 3008/sshd unix 3 [] STREAM CONNECTED 18442 3011/sshd unix 2 [] DGRAM 18439 3008/sshd unix 3 [] STREAM CONNECTED 17777 2813/sshd unix 3 [] STREAM CONNECTED 17776 2816/sshd unix 2 [] DGRAM 17773 2813/sshd find the process running on the designated port

[root@centos6 ~] # netstat-an | grep': 22 'tcp 0 0 0.0.0 0 tcp 22 0.0 0 tcp * LISTEN tcp 0 0 10.0.2.15 tcp 22 10.0.2.2 5 2964 grep 0 0 10.0.2.15 15 10.0.2.2 ESTABLISHED tcp 52091 0: 22:: * LISTEN10. Display the list of network interfaces [root@centos6 ~] # netstat-i Kernel Interface table Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg eth0 1500 0 12125 5474 5474 0 BMRU lo 65536 000 000 LRU [root@centos6 ~] # netstat-ie Kernel Interface table eth0 Link encap:Ethernet HWaddr 52:54:00:5D:A4:AF inet addr:10.0.2.15 Bcast:10.0.2.255 Mask:255.255.255.0 inet6 addr: fe80::5054:ff:fe5d:a4af/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:12131 errors:0 dropped:0 overruns : 0 frame:0 TX packets:5477 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:7474852 (7.1 MiB) TX bytes:580343 (566.7 KiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: 1Point128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0b) TX bytes:0 (0.0b) and above are all the contents of the article "how to use Netstat commands in Linux systems" Thank you for reading! Hope to share the content to help you, more related knowledge, welcome to follow the industry information channel!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.