Linux netstat 命令详解

最新推荐文章于 2022-11-19 17:25:21 发布

最新推荐文章于 2022-11-19 17:25:21 发布 · 75 阅读

文章标签：

#操作系统 #网络 #运维

Netstat命令用于显示与IP、TCP、UDP和ICMP协议相关的统计数据，一般用于检验本机各端口的网络连接情况。

在Internet RFC标准中，Netstat的定义是： Netstat是在内核中访问网络及相关信息的程序，它能提供TCP连接，TCP和UDP监听，进程内存管理的相关报告。

检查2222 端口的相关信息：

[root@singledb ~]# netstat -an |grep 2222

tcp 0 0 :::2222 :::* LISTEN

tcp 0 0 ::ffff:192.168.3.200:2222 ::ffff:192.168.3.115:53516 ESTABLISHED

该命令的帮助文档如下：

[root@singledb ~]# netstat -h

usage: netstat [-veenNcCF] [<Af>] -r netstat {-V|--version|-h|--help}

netstat [-vnNcaeol] [<Socket> ...]

netstat { [-veenNac] -I[<Iface>] | [-veenNac] -i | [-cnNe] -M | -s } [delay]

-r, --route display routing table

-I, --interfaces=[<Iface>] display interface table for <Iface>

-i, --interfaces display interface table

-g, --groups display multicast group memberships

-s, --statistics display networking statistics (like SNMP)

-M, --masquerade display masqueraded connections

-v, --verbose be verbose

-n, --numeric don't resolve names

--numeric-hosts don't resolve host names

--numeric-ports don't resolve port names

--numeric-users don't resolve user names

-N, --symbolic resolve hardware names

-e, --extend display other/more information

-p, --programs display PID/Program name for sockets

-c, --continuous continuous listing

-l, --listening display listening server sockets

-a, --all, --listening display all sockets (default: connected)

-o, --timers display timers

-F, --fib display Forwarding Information Base (default)

-C, --cache display routing cache instead of FIB

-T, --notrim stop trimming long addresses

-Z, --context display SELinux security context for sockets

<Iface>: Name of interface to monitor/list.

<Socket>={-t|--tcp} {-u|--udp} {-S|--sctp} {-w|--raw} {-x|--unix} --ax25 --ipx --netrom

<AF>=Use '-A <af>' or '--<af>'; default: inet

List of possible address families (which support routing):

inet (DARPA Internet) inet6 (IPv6) ax25 (AMPR AX.25)

netrom (AMPR NET/ROM) ipx (Novell IPX) ddp (Appletalk DDP)

x25 (CCITT X.25)

在上面的命令里讲了一个参数的意思。如果想查看更详细的内容，可以使用man命令。这个可以显示的更详细。

Netstat的一些常用选项：

netstat -s: 按照各个协议分别显示其统计数据。

netstat -r: 显示关于路由表的信息。

netstat -a: 显示一个所有的有效连接信息列表.

netstat -n：显示所有已建立的有效连接。

[root@singledb ~]# netstat -a

Active Internet connections (servers and established)

Proto Recv-Q Send-Q Local Address Foreign Address State

tcp 0 0 localhost.localdomain:2208 *:* LISTEN

tcp 0 0 192.168.122.1:domain *:* LISTEN

tcp 0 0 ::ffff:192.168.3.200:ssh ::ffff:192.168.3.115:51710 ESTABLISHED

tcp 0 0 ::ffff:192.16:rockwell-csp2 ::ffff:192.168.3.115:53516 ESTABLISHED

udp 0 0 *:48902 *:*

udp 0 0 192.168.122.1:domain *:*

udp 0 0 *:mdns *:*

Active UNIX domain sockets (servers and established)

Proto RefCnt Flags Type State I-Node Path

unix 2 [ ACC ] STREAM LISTENING 6166 @ISCSIADM_ABSTRACT_NAMESPACE

unix 28 [ ] DGRAM 6709 /dev/log

unix 2 [ ACC ] STREAM LISTENING 9022 /dev/gpmctl

unix 2 [ ACC ] STREAM LISTENING 6702 /var/run/audispd_events

以其中一条做说明：

tcp 0 0 ::ffff:192.168.3.200:ssh ::ffff:192.168.3.115:51710 ESTABLISHED

协议（Proto）：TCP，指是传输层通讯协议。

有关TCP, 可以参考Blog：

网络七层协议说明

http://blog.youkuaiyun.com/tianlesoftware/archive/2010/11/16/6012976.aspx

LocalAddress：::ffff:192.168.3.200:ssh，本地的IP地址，和用于连接的端口，这里写成ssh了。指的是SSH 端口。

Foreign Address： ffff:192.168.3.115:51710，远程机器的的IP地址和连接的端口。

State：ESTABLISHED。连接状态。可有一下几种状态：

LISTEN：在监听状态中。

ESTABLISHED：已建立联机的联机情况。

TIME_WAIT：该联机在目前已经是等待的状态。

[root@singledb ~]# netstat -n

Active Internet connections (w/o servers)

Proto Recv-Q Send-Q Local Address Foreign Address State

tcp 0 132 ::ffff:192.168.3.200:22 ::ffff:192.168.3.115:51710 ESTABLISHED

tcp 0 0 ::ffff:192.168.3.200:2222 ::ffff:192.168.3.115:53516 ESTABLISHED

--刚才这里显示的SSH。现在显示成对应的端口了。

Active UNIX domain sockets (w/o servers)

Proto RefCnt Flags Type State I-Node Path

unix 28 [ ] DGRAM 6709 /dev/log

unix 2 [ ] DGRAM 1413 @/org/kernel/udev/udevd

unix 2 [ ] DGRAM 7379 @/org/freedesktop/hal/udev_event

unix 2 [ ] DGRAM 15309

unix 2 [ ] DGRAM 13877

unix 2 [ ] DGRAM 13005

unix 3 [ ] STREAM CONNECTED 12935

unix 3 [ ] STREAM CONNECTED 12934

unix 2 [ ] DGRAM 12930

Netstat -n基本上是-a参数的数字形式，-a和－n是最常用的两个，其中

（1）-n 显示用数字化主机名，即IP地址

（2）-n只显示TCP连接

[root@singledb ~]# netstat -r

Kernel IP routing table

Destination Gateway Genmask Flags MSS Window irtt Iface

192.168.3.0 * 255.255.255.0 U 0 0 0 bond0

192.168.122.0 * 255.255.255.0 U 0 0 0 virbr0

169.254.0.0 * 255.255.0.0 U 0 0 0 bond0

default 192.168.3.1 0.0.0.0 UG 0 0 0 bond0

[root@singledb ~]# netstat -s

Ip:

63105 total packets received

0 forwarded

0 incoming packets discarded

41834 incoming packets delivered

33322 requests sent out

Icmp:

1377 ICMP messages received

0 input ICMP message failed.

ICMP input histogram:

destination unreachable: 1377

1377 ICMP messages sent

0 ICMP messages failed

ICMP output histogram:

destination unreachable: 1377

IcmpMsg:

InType3: 1377

OutType3: 1377

Tcp:

147 active connections openings

33 passive connection openings

0 failed connection attempts

0 connection resets received

2 connections established

31684 segments received

31347 segments send out

393 segments retransmited

0 bad segments received.

0 resets sent

Udp:

132 packets received

1 packets to unknown port received.

0 packet receive errors

201 packets sent

TcpExt:

23 TCP sockets finished time wait in fast timer

7032 delayed acks sent

10 delayed acks further delayed because of locked socket

Quick ack mode was activated 8137 times

2 packets directly queued to recvmsg prequeue.

2 packets directly received from prequeue

3496 packets header predicted

2325 acknowledgments not containing data received

7805 predicted acknowledgments

6 times recovered from packet loss due to SACK data

TCPDSACKUndo: 3

12 congestion windows recovered after partial ack

3 TCP data loss events

5 fast retransmits

3 retransmits in slow start

137 other TCP timeouts

2 sack retransmits failed

8137 DSACKs sent for old packets

24 DSACKs received

IpExt:

InMcastPkts: 36

OutMcastPkts: 40

InBcastPkts: 8617

[root@singledb ~]#

------------------------------------------------------------------------------

Blog： http://blog.youkuaiyun.com/tianlesoftware

网上资源： http://tianlesoftware.download.youkuaiyun.com

相关视频：http://blog.youkuaiyun.com/tianlesoftware/archive/2009/11/27/4886500.aspx

DBA1 群：62697716(满); DBA2 群：62697977(满)

DBA3 群：62697850 DBA 超级群：63306533;

聊天群：40132017