Shulou(Shulou.com)06/01 Report--

This article mainly explains "the usage of the Linux basic command netstat". The content of the article is simple and clear, and it is easy to learn and understand. Please follow the editor's train of thought to study and learn "the usage of the Linux basic command netstat".

Netstat

The netstat instruction can display information such as current network connections, routing tables, interface statistics, camouflage connections and multicast membership.

The scope of this command: RedHat, RHEL, Ubuntu, CentOS, SUSE, openSUSE, Fedora.

1. Grammar

Netstat [address_family_options] [--tcp |-t] [--udp |-- raw |-- raw |-- w] [--listening |-l] [--all |-- a] [--numeric |-- numeric] [--numeric-hosts] [--numeric-ports] [--symbolic |-N] [--extend |-e [--extend |-e] [--timers |-- program |-p] [--verbose |-v] [--continuous |-c] [delay]

Netstat {--route |-r} [address_family_options] [--extend |-e [--extend |-e]] [--verbose |-v] [--numeric |-n] [--numeric-hosts] [--numeric-ports] [--numeric-ports] [--continuous |-c] [delay]

Netstat {- interfaces |-I |-I} [iface] [--all |-a] [--extend |-e] [--verbose |-v] [--program |-- p] [--numeric |-n] [--numeric-hosts] [--numeric-ports] [--numeric-ports] [--continuous |-c] [delay]

Netstat {--groups |-g} [--numeric |-n] [--numeric-hosts] [--numeric-ports] [--numeric-ports] [--continuous |-c] [delay]

Netstat {--masquerade |-M} [--extend |-e] [--numeric |-n] [--numeric-hosts] [--numeric-ports] [--numeric-ports] [--continuous |-c] [delay]

Netstat {--statistics |-s} [--tcp |-t] [--udp |-u] [--raw |-w] [delay]

Netstat {--version |-V}

Netstat {--help |-h}

Address_family_options:

[--protocol= {inet,inet6,unix,ipx,ax25,netrom,ddp,...}] [--unix |-x] [--inet |-- ip] [--ax25] [--ipx] [--netrom] [--ddp]

2. List of options

Option

Description

-- help

Display help information

-- version

Display version information

-v |-- verbose

Show execution process

-n |-- numeric

Direct display of digital ip

-- numeric-hosts

Displays the numeric address of the host without affecting the port and user name

-- numeric-ports

Displays the port without affecting the host and user name

-- numeric-users

Displays the user id without affecting the host and port

-A |-- protocol

Specify the network type

-c |-- continuous

Continuous display

-e |-- extend

Show additional information

-o |-- timers

Display timer

-p |-- program

Displays the pid and name of the socket program in use

-l |-- listen

Only monitor socket information is displayed

-a |-all

Display socket information in all connections

-F

Show FIB

-C

Show the cache of the route

-Z |-- context

If SELinux is turned on, print the context of the SELinux

-T |-- notrim

Stop pruning long address

3. Description

Netstat prints information about the Linux network subsystem. The type of information printed is controlled by the first parameter

Parameters.

Description

(none)

By default, netstat displays a list of open sockets. If you do not specify any address families, the active sockets for all configured address families are printed.

-r |-- route

Print kernel routing table

-g |-- groups

Displays multicast group membership information for IPv4 and IPv6

-I |-- interfaces=iface,-I=iface

Displays a table of all network interfaces, or a specified ifaces.

-M |-- masquerade

Displays a list of fake connections.

-s |-- statistics

Displays summary statistics for each protocol.

4. Output

Active Internet connections (TCP, UDP, raw)

Description

Proto

The protocols used by socket, tcp, udp, raw.

Recv-Q

The number of bytes not copied by the user program connected to this socket.

Send-Q

The number of bytes not acknowledged by the remote host.

Local Address

The address and port number of the local side of the socket. Unless the "--numeric (- n)" option is specified, the socket address will resolve to its canonical host name (FQDN), and the port number will be converted to the corresponding service name.

Foreign Address

The address and port number of the remote side of the socket. Similar to "local address".

State

The status of the socket. Since there is no state in the original schema and no state is usually used in UDP, this column can be left blank. Typically, this can be one of several values:

ESTABLISHED, the socket has an established connection.

SYN_SENT, sockets are actively trying to establish a connection.

SYN_RECV, a connection request has been received from the network.

FIN_WAIT1, socket closed, connection is closing.

FIN_WAIT2, the connection is closed and the socket is waiting for a closure from the remote side.

TIME_WAIT, the socket waits for packets that are still in the network to be processed after it is turned off.

CLOSED, no sockets are used.

CLOSE_WAIT, the remote terminal is closed, waiting for the socket to close.

LAST_ACK, the remote terminal is closed and the socket is closed. Awaiting confirmation

LISTEN, the socket is listening for incoming connections. This type of socket is not included in the output unless you specify the "--listening" or "--all (- a)" options.

CLOSING, both sockets are closed, but we still haven't sent all the data.

UNKNOWN, the status of the socket is unknown.

User

PID/Program name

Timer

Active UNIX domain Sockets

Description

Proto

The protocol used by the socket (usually Unix).

RefCnt

Reference count (that is, processes attached through this socket).

Flags

The flags displayed are SO_ACCEPTON (shown as ACC), SO_WAITDATA (W), or SO_NOSPACE (N). If the corresponding process that is not connected to the socket is waiting for a connection request, use SO_ACCECPTON on the unconnected socket. The other signs are abnormal.

Type

Several possible values:

SOCK_DGRAM, sockets are used in Datagram (connectionless) mode.

SOCK_STREAM, which is a stream (connection) socket.

SOCK_RAW, the socket is used as the original socket.

SOCK_RDM, a service that provides reliable delivery of messages.

SOCK_SEQPACKET, which is a sequential packet socket.

SOCK_PACKET, the original interface accesses the socket.

UNKNOWN, unknown state

State

FREE, sockets have not been assigned yet

LISTENING, the socket is listening for the request.

CONNECTING, the socket is trying to connect.

CONNECTED, the socket is connected.

DISCONNECTING, the socket disconnects.

(empty), the socket is not connected anywhere else.

UNKNOWN, unknown statu

PID/Program name

Open the process ID (PID) and process name of the socket. More information can be found in the active Internet connection section written above.

Path

This is the pathname of the corresponding process connected to the socket.

5. Files

/ etc/services, service translation file

The mount point of the / proc,proc file system that allows access to kernel state.

/ proc/net/dev, device information.

/ proc/net/raw,raw socket information.

/ proc/net/tcp,tcp socket information.

/ proc/net/udp,udp socket information.

/ proc/net/igmp,IGMP Multicast information.

/ proc/net/unix,Unix domain name socket information.

/ proc/net/ipx,IPX socket information.

/ proc/net/ax25,AX25 socket information.

/ proc/net/appletalk,DDP (appletalk) socket information.

/ proc/net/nr,NET/ROM socket information

/ proc/net/route,IP routing information.

/ proc/net/ax25_route,AX25 routing information.

/ proc/net/ipx_route,IPX routing information.

/ proc/net/nr_nodes,NET/ROM node list.

/ proc/net/nr_neigh,NET/ROM neighbor.

/ proc/net/ip_masquerade, camouflage connection.

/ proc/net/snmp, static.

6. Examples

1) display the specified type of network information

[root@localhost ~] # netstat-An inet / / specify network type inet

Active Internet connections (w _ servers)

Proto Recv-Q Send-Q Local Address Foreign Address State

Udp 0 0 192.168.0.113:33423 192.168.0.1:domain ESTABLISHED

Udp 0 0 192.168.0.113:40242 192.168.1.1:domain ESTABLISHED

Udp 0 0 192.168.0.113:50786 192.168.0.1:domain ESTABLISHED

2) display the routing table

[root@localhost ~] # netstat-r / / shows the routing table

Kernel IP routing table

Destination Gateway Genmask Flags MSS Window irtt Iface

255.255.255.255-255.255.255.255! h-

192.168.1.0 * 255.255.255.0 U 000 eth0

224.0.0.0-255.255.255.0!-

Default 192.168.1.1 0.0.0.0 UG 0 0 0 eth0

3) display the status of the network card

[root@localhost ~] # netstat-I / / displays the status of the network card

Kernel Interface table

Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg

Eth0 1500 0 121817 00 0 79998 00 0 BMRU

Lo 16436 0 8374 0 0 0 8374 0 0 0 LRU

Thank you for your reading, the above is the content of "the usage of the Linux basic command netstat". After the study of this article, I believe you have a deeper understanding of the usage of the Linux basic command netstat, and the specific use needs to be verified in practice. Here is, the editor will push for you more related knowledge points of the article, welcome to follow!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.