Netstat是控制台命令,是一个监控TCP/IP网络的非常有用的工具，它可以显示路由表、实际的网络连接以及每一个网络接口设备的状态信息。Netstat用于显示与IP、TCP、UDP和ICMP协议相关的统计数据，一般用于检验本机各端口的网络连接情况。
如果你的计算机有时候接收到的数据包导致出错数据或故障，你不必感到奇怪，TCP/IP可以容许这些类型的错误，并能够自动重发数据包。但如果累计的出错情况数目占到所接收的IP数据报相当大的百分比，或者它的数目正迅速增加，那么你就应该使用Netstat查一查为什么会出现这些情况了。
#netstat
Active Internet connections
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp4 0 0 192.168.2.209.52671 ti-in-f100.1e100.https SYN_SENT
tcp4 0 0 192.168.2.209.52669 ti-in-f113.1e100.https SYN_SENT
tcp4 0 0 192.168.2.209.52668 ti-in-f113.1e100.https SYN_SENT
tcp4 0 0 192.168.2.209.52667 ti-in-f138.1e100.https SYN_SENT
tcp4 0 0 192.168.2.209.52666 ti-in-f101.1e100.https SYN_SENT
tcp4 0 0 192.168.2.209.52665 ti-in-f101.1e100.https SYN_SENT
tcp4 0 0 192.168.2.209.52664 ti-in-f102.1e100.https SYN_SENT
tcp4 0 0 192.168.2.209.52663 123.58.182.252.http ESTABLISHED
tcp4 0 0 192.168.2.209.52661 121.201.9.155.http CLOSE_WAIT
tcp4 0 0 192.168.245.1.52651 192.168.245.130.ssh ESTABLISHED
tcp4 0 0 172.16.28.1.alchemy 172.16.28.1.52572 ESTABLISHED
tcp4 0 0 172.16.28.1.52572 172.16.28.1.alchemy ESTABLISHED
tcp4 0 0 192.168.2.209.52569 a23-219-132-147..https ESTABLISHED
tcp4 0 0 192.168.2.209.52568 as-40816.engx.vm.https CLOSE_WAIT
tcp4 0 0 192.168.2.209.50305 tk-in-f188.1e100.5228 ESTABLISHED
tcp4 0 0 192.168.2.209.50115 17.252.140.166.5223 ESTABLISHED
tcp4 0 0 192.168.2.209.50105 17.188.165.207.5223 ESTABLISHED
udp4 0 0 *.terabase *.*
udp4 0 0 localhost.5800 *.*
udp4 0 0 192.168.245.1.49152 *.*
OUTPUT
Active Internet connections (TCP, UDP, raw)
Proto 【节点所使用的协议】
The protocol (tcp, udp, raw) used by the socket.
Recv-Q 【链接到此节点未被使用者拷贝的字节数量】
The count of bytes not copied by the user program connected to this
socket.
Send-Q 【链接到此节点未被识别的字节数量】
The count of bytes not acknowledged by the remote host.
Local Address 【本地地址】
Address and port number of the local end of the socket. Unless the numeric (-n) option is specified, the socket address is resolved to its canonical host name (FQDN), and the port number is translated into the corresponding service name.
Foreign Address 【外部链接地址】
Address and port number of the remote end of the socket. Analogous to "Local Address."
State 【链接状态】
The state of the socket. Since there are no states in raw mode and usually no states used in UDP, this column may be left blank. Normally
this can be one of several values:
ESTABLISHED 【代表一个打开的连接】
The socket has an established connection.
SYN_SENT 【在发送连接请求后等待匹配的连接请求】
The socket is actively attempting to establish a connection.
SYN_RECV 【在收到和发送一个连接请求后等待对方对连接请求的确认】
A connection request has been received from the network.
FIN_WAIT1 【等待远程TCP连接中断请求，或先前的连接中断请求的确认】
The socket is closed, and the connection is shutting down.
FIN_WAIT2 【从远程TCP等待连接中断请求】
Connection is closed, and the socket is waiting for a shutdown
TIME_WAIT 【等待足够的时间以确保远程TCP接收到连接中断请求的确认】
The socket is waiting after close to handle packets still in the network.
CLOSED 【没有任何连接状态】
The socket is not being used.
CLOSE_WAIT 【等待从本地用户发来的连接中断请求】
The remote end has shut down, waiting for the socket to close.
LAST_ACK 【等待原来的发向远程TCP的连接中断请求的确认】
The remote end has shut down, and the socket is closed. Waiting
for acknowledgement.
LISTEN 【侦听来自远方的TCP端口的连接请求。需要增加l或者a选项】
The socket is listening for incoming connections. Such sockets are not included in the output unless you specify the listening (-l) or all (-a) option.
CLOSING 【等待远程TCP对连接中断的确认】
Both sockets are shut down but we still don’t have all our data sent.
UNKNOWN 【未知】
The state of the socket is unknown.
User
The username or the user id (UID) of the owner of the socket.
PID/Program name
Slash-separated pair of the process id (PID) and process name of the process that owns the socket. program causes this column to be included. You will also need superuser privileges to see this information on sockets you don’t own. This identification information is not yet available for IPX sockets.
Flags
The flags displayed is SO_ACCEPTON (displayed as ACC), SO_WAITDATA (W) or SO_NOSPACE (N). SO_ACCECPTON is used on unconnected sockets if their corresponding processes are waiting for a connect request. The other flags are not of normal interest.
Type
There are several types of socket access:
SOCK_DGRAM 【数据模式】
The socket is used in Datagram (connectionless) mode.
SOCK_STREAM 【连接状态】
This is a stream (connection) socket.
SOCK_RAW 【未使用状态】
The socket is used as a raw socket.
SOCK_RDM 【链接硬盘？？？】
This one serves reliably-delivered messages.
SOCK_SEQPACKET
This is a sequential packet socket.
SOCK_PACKET
Raw interface access socket.
UNKNOWN
Who ever knows what the future will bring us - just fill in here :-)
常见命令
--route , -r 【显示核心路由表】
Display the kernel routing tables.
--groups , -g 【按协议分类显示】
Display multicast group membership information for IPv4 and IPv6.
-interfaces=iface , -I=iface , -i 【显示所有网络接口信息】
Display a table of all network interfaces, or the specified iface.
--masquerade , -M 【】
Display a list of masqueraded connections.
--statistics , -s 【显示每个协议的统计】
Display summary statistics for each protocol.
-c, --continuous 【每隔1秒就重新显示一遍，直到用户中断它。】
This will cause netstat to print the selected information every second continuously.
-e, --extend 【显示以太网统计。此选项可以与 -s 选项结合使用。】
Display additional information. Use this option twice for maximum
detail.
-o, --timers 【】
Include information related to networking timers.
-p, --program 【显示建立相关连接的程序名和PID】
Show the PID and name of the program to which each socket belongs.
-l, --listening 【仅显示正在监听的端口】
Show only listening sockets. (These are omitted by default.)
-a, --all 【显示所有socket，包括正在监听的】
Show both listening and non-listening (for TCP this means established
connections) sockets. With the --interfaces option, show interfaces
that are not marked
-F
Print routing information from the FIB. (This is the default.)
-C
Print routing information from the route cache.
-Z --context
If SELinux enabled print SELinux context.
-T --notrim
Stop trimming long addresses.
编辑回复