linux命令：netstat

Help说明

``` usage: netstat [-veenNcCF] [] -r netstat {-V|--version|-h|--help} netstat [-vnNcaeol] [ ...] netstat { [-veenNac] -I[] | [-veenNac] -i | [-cnNe] -M | -s } [delay]

    -r, --route                display routing table
    -I, --interfaces=<Iface>   display interface table for <Iface>
    -i, --interfaces           display interface table
    -g, --groups               display multicast group memberships
    -s, --statistics           display networking statistics (like SNMP)
    -M, --masquerade           display masqueraded connections

    -v, --verbose              be verbose
    -n, --numeric              don't resolve names
    --numeric-hosts            don't resolve host names
    --numeric-ports            don't resolve port names
    --numeric-users            don't resolve user names
    -N, --symbolic             resolve hardware names
    -e, --extend               display other/more information
    -p, --programs             display PID/Program name for sockets
    -c, --continuous           continuous listing

    -l, --listening            display listening server sockets
    -a, --all, --listening     display all sockets (default: connected)
    -o, --timers               display timers
    -F, --fib                  display Forwarding Information Base (default)
    -C, --cache                display routing cache instead of FIB
    -T, --notrim               stop trimming long addresses
    -Z, --context              display SELinux security context for sockets

: Name of interface to monitor/list.
={-t|–tcp} {-u|–udp} {-S|–sctp} {-w|–raw} {-x|–unix} --ax25 --ipx --netrom
=Use '-A ’ or ‘–’; default: inet
List of possible address families (which support routing):
inet (DARPA Internet) inet6 (IPv6) ax25 (AMPR AX.25)
netrom (AMPR NET/ROM) ipx (Novell IPX) ddp (Appletalk DDP)
x25 (CCITT X.25)

常用命令：

 - -a || --all：显示所有连接 (默认仅显示已连接状态)； 
 - -t || --tcp：显示tcp连接
 - -u || --udp：显示udp连接
 - -x || --unix：显示unix内部
 - -n || --numeric：连接信息数字化
 - -p || --programs：显示连接的PID/program name
 - -e || --extend：显示更多的信息，程序执行者，inode号码
 - -i || --interfaces：显示网络接口列表（网卡信息列表）
 - -s || --statistics：显示所有端口的统计信息
 - -l || --listening：显示处理监听状态的连接
 - -r || --route：显示路由信息
<h2>查看端口占用情况</h2>

列出所有连接

netstat -anp

查看程序占用的端口

netstat -anp | grep httpd

查看端口被哪一个程序占用

netstat -anp | grep ‘:3306’

查看TCP的创建时间

netstat -npt | grep <PORT|PID> 
#tcp 0 0 127.0.0.1:58566 127.0.0.1:6379 ESTABLISHED 32121/php
lsof -p <PID> | grep <PORT>
#php 32121 www-data 6u IPv4 17328792 0t0 TCP 127.0.0.1:58566->127.0.0.1:6379 (ESTABLISHED)
ls -al /proc/<PID>/fd/<fd>
#lrwx------ 1 user user 64 Apr 21 05:44 /proc/32121/fd/6 -> socket:[17328792]
# 上面 Apr 21 05:44 即为链接创建时间