How to use the netstat command in Linux

Editor to share with you how to use the netstat command in Linux, I believe most people do not know much about it, so share this article for your reference, I hope you can learn a lot after reading this article, let's go to know it!

Linux netstat command 1, TCP connection status detailed explanation

LISTEN: listen for connection requests from remote TCP ports

SYN-SENT: wait for a matching connection request after sending a connection request again

SYN-RECEIVED: wait for the other party to confirm the connection request after receiving and sending a connection request

ESTABLISHED: represents an open connection

FIN-WAIT-1: wait for remote TCP connection disruption request, or confirmation of previous connection interruption request

FIN-WAIT-2: waiting for a connection break request from a remote TCP

CLOSE-WAIT: waiting for a connection disconnection request from a local user

CLOSING: wait for the remote TCP to confirm the connection break

LAST-ACK: waits for confirmation of the original connection break request sent to the remote TCP

TIME-WAIT: wait enough time to ensure that the remote TCP receives an acknowledgement of the connection disconnection request

CLOSED: no connection status

2. Command format

Netstat (option)

3. Command options

-an or-all: displays the Socket in all connections

-An or -: list the relevant addresses in the connection of this network type

-c or-continuous: continuously lists network status

-C or-cache: displays the cache information configured by the router

-e or-extend: displays other relevant information about the network

-F or-fib: displays FIB

-g or-groups: displays the list of group members with multi-broadcast function

-h or-help: online help

-I or-interfaces: displays the web interface information form

-l or-listening: displays the Socket of the server under monitoring

-M or-masquerade: shows a camouflaged network connection

-n or-numeric: use the ip address directly, not through the domain name server

-N or-netlink or-symbolic: displays the symbolic connection name of the network hardware peripheral

-o or-timers: display timer

-p or-programs: displays the program identification number and program name that are using Socket

-r or-route: displays Routing Table

-s or-statistice: displays statistical tables of network work information

-t or-tcp: displays the connection status of the TCP transport protocol

-u or-udp: displays the connection status of the UDP transport protocol

-v or-verbose: displays the instruction execution process

-V or-version: displays version information

-w or-raw: displays the connection status of the RAW transport protocol

-x or-unix: this parameter has the same effect as specifying the "- A unix" parameter

-ip or-inet: this parameter has the same effect as specifying the "- An inet" parameter.

4. List all ports (including TCP and UDP)

> netstat-a

4. List all TCP ports

> netstat-at

5. List all UDP ports

> netstat-au

6. List all the Sockets in the listening state

> netstat-l

7. List only all listening tcp ports

> netstat-lt

8. List only all listening udp ports

> netstat-lu

9. List only all listening UNIX ports

> netstat-lx

10 display statistics for all ports > netstat-sIp: 1007495197 total packets received 0 forwarded 582 with unknown protocol 0 incoming packets discarded 1007422115 incoming packets deliveredIcmp: 66583265 ICMP messages received 63899 input ICMP message failed. InCsumErrors: 384 ICMP input histogram: destination unreachable: 115410 timeout in transit: 12840 source quenches: 11 redirects: 563 echo requests: 66453453 echo replies: 152 timestamp request: 438 address mask request: 4 66987000 ICMP messages sent 0 ICMP messages failed ICMP output histogram: destination unreachable: 533106 echo request: 4 echo replies: 66453453 timestamp replies: 437IcmpMsg: InType0: 152 InType3: 115410 InType4: 11 InType5: 563 IpExt: InNoRoutes: 15 InMcastPkts: 1291307 InOctets: 211446050816 OutOctets: 48107006919411 、 Show TCP port statistics > netstat-stIcmpMsg: InType0: 152InType3: 115410 InType4: 11 InType5: 563InType8: 66453492Tcp: 55437641 active connections openings 35899081 passive connection openings 552243 failed connection attempts 753118 connection resets received 7 connections establishedUdpLite:TcpExt: 162052 SYN cookies sent 621 SYN cookies received 4998179 invalid SYN cookies received 551915 resets received for embryonic SYN_RECV socketsIpExt: InNoRoutes: 15 InMcastPkts: 1291308 InOctets: 2114463015 OutOctets: 481070459735 InMcastOctets: 4648708812, Show UDP port statistics > netstat-suIcmpMsg: InType0: 152InType3: 115410 InType4: 11 InType5: 563 InType8: 66453594 InType11: 12840 InType13: 438 InType17: 4 InType37: 3 InType165: 7 OutType0: 66453594 OutType3: 533106 OutType8: 4 OutType14: 437Udp: 17941589 packets received 637146 packets to unknown port received. 1649 packet receive errors 17977050 packets sent 0 receive buffer errors 0 send buffer errors InCsumErrors: 1640UdpLite:IpExt: InNoRoutes: 15 InMcastPkts: 1291310 InOctets: 211446802283 OutOctets: 481071405083 InMcastOctets: 46487160 InNoECTPkts: 1009629627 InECT1Pkts: 9955 InECT0Pkts: 1987096 InCEPkts: 9403913, display PID and process name in netstat output

> netstat-pt

14. Host, port and user name (host, port or user) are not displayed in the netstat output

> netstat-an

15. Continuously output netstat information

Output network information every other second

> netstat-c

16 、 Show core routing information > netstat-r Kernel IP routing tableDestination Gateway Genmask Flags MSS Window irtt Ifacedefault gateway 0.0.0.0 UG 000 eth0link-local 0.0.0.0 255.255.0.0 U 000 eth0172.16.0.0 0.0.0.0 255.255.240.0 U 0 0 0 eth017 、 Display the number format using netstat-rn The host name is not queried. > netstat-rn Kernel IP routing tableDestination Gateway Genmask Flags MSS Window irtt Iface0.0.0.0 172.16.0.1 0.0.0.0 UG 000 eth0169.254.0.0 0.0.0.0 255.255.0.0 U 000 eth0172.16.0.0 0.0 . 0.0 255.255.240.0 U 0 0 0 eth018 、 Find out the port on which the program is running > netstat-tunlp | grep ssh tcp 00 0.0.0.0 grep ssh tcp 22 0.0.0.0 grep ssh tcp * port, Find out which process is running on the specified port > netstat-an | grep ": 80" tcp 0 0 0.0 0 grep 80 0 0 0 * LISTENtcp 0 0172.16 0.9 LISTENtcp 80 185.191.171.12 grep 9380 185.191.171.12 191.171.26:52418 TIME_WAITtcp 0 3450 172.16.0.9:80 185.191.171.37:25108 FIN_WAIT1tcp 0 0 172.16.0.9:80 185.191.171.37:55096 TIME_WAITtcp 0 0 172.16.0.9:80 144.76.176.171:27832 TIME_WAITtcp 0 0 172 .16.0.9: 80 118.126.124.7:11127 TIME_WAITtcp 0 0 172.16.0.9:46628 169.254.0.55:8080 TIME_WAITtcp 0 0 172.16.0.9:80 144.76.176.171:23812 ESTABLISHED20 、 Find the process ID > netstat-tunlp through the port | grep 80 | awk'{print $7}'| cut-d /-f12132321, Show the list of network interfaces > netstat-iKernel Interface tableIface MTU RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flgdocker0 1500 00 00 00 BMUeth0 1450 462305568 00 0 276046945 00 0 BMRUlo 65536 7204971 0 00 7204971 00 0 LRUvpn_abi 1500 229612389 0 1023383 0 146640133 0 956 0 BMRU22 、 Statistics of TCP status list > netstat-n | awk'/ ^ tcp/ {+ + S [$NF]} END {for (i in S) print I S [I]} 'ESTABLISHED 7FIN_WAIT2 13TIME_WAIT 18 and above are all the contents of the article "how to use netstat commands in Linux" Thank you for reading! I believe we all have a certain understanding, hope to share the content to help you, if you want to learn more knowledge, welcome to follow the industry information channel!