Linux中netstat命令详解
Netstat是控制台命令,是一个监控TCP/IP网络的非常有用的工具,它可以显示路由表、实际的网络连接以及每一个网络接口设备的状态信息。Netstat用于显示与IP、TCP、UDP和ICMP协议相关的统计数据,一般用于检验本机各端口的网络连接情况。
linux上面排查某个端口号是否被占用
1.netstat -anp |grep 端口号
如下,我以3306为例,netstat -anp |grep 3306(此处备注下,我是以普通用户操作,故加上了sudo,如果是以root用户操作,不用加sudo即可查看),如下图1:
图1
图1中主要看监控状态为LISTEN表示已经被占用,最后一列显示被服务mysqld占用,查看具体端口号,只要有如图这一行就表示被占用了。
2.netstat -nultp(此处不用加端口号)
该命令是查看当前所有已经使用的端口情况,如图2:
图2
图中可以看出我的82端口没有被占用
3.netstat -anp |grep 82查看82端口的使用情况,如图3:
图3
可以看出并没有LISTEN那一行,所以就表示没有被占用。此处注意,图中显示的LISTENING并不表示端口被占用,不要和LISTEN混淆哦,查看具体端口时候,必须要看到tcp,端口号,LISTEN那一行,才表示端口被占用了
下面是一些常用的命令
常见参数
-a (all)显示所有选项,默认不显示LISTEN相关
-t (tcp)仅显示tcp相关选项
-u (udp)仅显示udp相关选项
-n 拒绝显示别名,能显示数字的全部转化成数字。
-l 仅列出有在 Listen (监听) 的服務状态
-p 显示建立相关链接的程序名
-r 显示路由信息,路由表
-e 显示扩展信息,例如uid等
-s 按各个协议进行统计
-c 每隔一个固定时间,执行该netstat命令。
提示:LISTEN和LISTENING的状态只有用-a或者-l才能看到
1、列出所有的连接(包括监听和未监听的)
$ netstat -a
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp enlightened:domain *:* LISTEN
tcp localhost:ipp *:* LISTEN
tcp enlightened.local: li240-.members.li:http ESTABLISHED
tcp enlightened.local: del01s07-in-f14.:https ESTABLISHED
tcp6 ip6-localhost:ipp [::]:* LISTEN
udp enlightened:domain *:*
udp *:bootpc *:*
udp enlightened.local:ntp *:*
udp localhost:ntp *:*
udp *:ntp *:*
udp *: *:*
udp *:mdns *:*
udp *: *:*
udp6 fe80:::36ff:fef8:ntp [::]:*
udp6 ip6-localhost:ntp [::]:*
udp6 [::]:ntp [::]:*
udp6 [::]:mdns [::]:*
udp6 [::]: [::]:*
udp6 [::]: [::]:*
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node Path
unix [ ACC ] STREAM LISTENING @/tmp/dbus-IDgfj3UGXX
unix [ ACC ] STREAM LISTENING @/dbus-vfs-daemon/socket-6nUC6CCx
2、只列出tcp和udp协议的连接。
$ netstat -at Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp enlightened:domain *:* LISTEN
tcp localhost:ipp *:* LISTEN
tcp enlightened.local: del01s07-in-f24.:https ESTABLISHED
tcp enlightened.local: a96---.depl:http ESTABLISHED
tcp enlightened.local: ABTS-North-Static-:http ESTABLISHED
.....
# netstat -au
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
udp *: *:*
udp enlightened:domain *:*
udp *:bootpc *:*
udp enlightened.local:ntp *:*
udp localhost:ntp *:*
udp *:ntp *:*
udp6 fe80:::36ff:fef8:ntp [::]:*
udp6 ip6-localhost:ntp [::]:*
udp6 [::]:ntp [::]:*
上面同时显示了 IPv4 和 IPv6 的连接。
3、禁用反向域名,加快查询的速度
默认情况下netstat会通过反向域名解析技术查找每个ip地址对应的主机名。这会降低查找的速度,如果你觉得iop地址已经足够,而没有必要知道主机名,就使用-n选项禁用域名解析功能。
$ netstat -ant
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 127.0.1.1: 0.0.0.0:* LISTEN
tcp 127.0.0.1: 0.0.0.0:* LISTEN
tcp 192.168.1.2: 173.255.230.5: ESTABLISHED
tcp 192.168.1.2: 173.194.36.117: ESTABLISHED
tcp6 ::: :::* LISTEN
4、列出所有处于监听状态的 Sockets
只显示监听端口 netstat -l
# netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 localhost:ipp *:* LISTEN
tcp6 0 0 localhost:ipp [::]:* LISTEN
udp 0 0 *:49119 *:*
只列出所有监听 tcp 端口 netstat -lt
# netstat -lt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 localhost:30037 *:* LISTEN
tcp 0 0 *:smtp *:* LISTEN
tcp6 0 0 localhost:ipp [::]:* LISTEN
只列出所有监听 udp 端口 netstat -lu
# netstat -lu
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
udp 0 0 *:49119 *:*
udp 0 0 *:mdns *:*
只列出所有监听 UNIX 端口 netstat -lx
# netstat -lx
Active UNIX domain sockets (only servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 6294 private/maildrop
unix 2 [ ACC ] STREAM LISTENING 6203 public/cleanup
unix 2 [ ACC ] STREAM LISTENING 6302 private/ifmail
unix 2 [ ACC ] STREAM LISTENING 6306 private/bsmtp
5、获取进程名、进程号以及用户ID
~$ sudo netstat -nlpt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 127.0.1.1: 0.0.0.0:* LISTEN /dnsmasq
tcp 127.0.0.1: 0.0.0.0:* LISTEN /cupsd
tcp6 ::: :::* LISTEN /cupsd
$ sudo netstat -ltpe
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State User Inode PID/Program name
tcp enlightened:domain *:* LISTEN root /dnsmasq
tcp localhost:ipp *:* LISTEN root /cupsd
tcp6 ip6-localhost:ipp [::]:* LISTEN root /cupsd
这些额外的信息包括用户名和进程的索引节点号。这个命令对网管来说很有用。
注意 – 假如你将 -n 和 -e 选项一起使用,User 列的属性就是用户的 ID 号,而不是用户名。
6、打印统计数据
$ netstat -s
Ip:
total packets received
forwarded
incoming packets discarded
incoming packets delivered
requests sent out
outgoing packets dropped
Icmp:
ICMP messages received
input ICMP message failed.
ICMP input histogram:
destination unreachable:
ICMP messages sent
ICMP messages failed
ICMP output histogram:
destination unreachable:
... OUTPUT TRUNCATED ...
7、显示内核路由信息
$ netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 192.168.1.1 0.0.0.0 UG eth0
192.168.1.0 0.0.0.0 255.255.255.0 U eth0
8、打印网络接口
$ netstat -i
Kernel Interface table
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0 BMRU
lo LRU
$ netstat -ie
Kernel Interface table
eth0 Link encap:Ethernet HWaddr :::f8:b2:
inet addr:192.168.1.2 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80:::36ff:fef8:b264/ Scope:Link
UP BROADCAST RUNNING MULTICAST MTU: Metric:
RX packets: errors: dropped: overruns: frame:
TX packets: errors: dropped: overruns: carrier:
collisions: txqueuelen:
RX bytes: (29.6 MB) TX bytes: (4.5 MB)
Interrupt: Memory:da000000-da020000 lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::/ Scope:Host
UP LOOPBACK RUNNING MTU: Metric:
RX packets: errors: dropped: overruns: frame:
TX packets: errors: dropped: overruns: carrier:
collisions: txqueuelen:
RX bytes: (305.2 KB) TX bytes: (305.2 KB)
9、netstat持续输出
$ netstat -ct
10、显示多播组信息
$ netstat -g
IPv6/IPv4 Group Memberships
Interface RefCnt Group
--------------- ------ ---------------------
lo all-systems.mcast.net
eth0 224.0.0.251
eth0 all-systems.mcast.net
lo ip6-allnodes
lo ff01::
eth0 ff02::fb
eth0 ff02:::fff8:b264
eth0 ip6-allnodes
eth0 ff01::
wlan0 ip6-allnodes
wlan0 ff01::
$ netstat -atnp | grep ESTA
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
tcp 192.168.1.2: 173.255.230.5: ESTABLISHED /chrome
tcp 192.168.1.2: 173.194.36.117: ESTABLISHED /chrome
$ watch -d -n0 "netstat -atnp | grep ESTA"
$ sudo netstat -aple | grep ntp
udp enlightened.local:ntp *:* root /ntpd
udp localhost:ntp *:* root /ntpd
udp *:ntp *:* root /ntpd
udp6 fe80:::36ff:fef8:ntp [::]:* root /ntpd
udp6 ip6-localhost:ntp [::]:* root /ntpd
udp6 [::]:ntp [::]:* root /ntpd
unix [ ] DGRAM /ntpd
11. IP和TCP分析
查看连接某服务端口最多的的IP地址
wss8848@ubuntu:~$ netstat -nat | grep "192.168.1.15:22" |awk '{print $5}'|awk -F: '{print $1}'|sort|uniq -c|sort -nr|head -20
18 221.136.168.36
3 154.74.45.242
2 78.173.31.236
2 62.183.207.98
2 192.168.1.14
2 182.48.111.215
2 124.193.219.34
2 119.145.41.2
2 114.255.41.30
1 75.102.11.99
TCP各种状态列表
wss8848@ubuntu:~$ netstat -nat |awk '{print $6}'
established)
Foreign
LISTEN
TIME_WAIT
ESTABLISHED
TIME_WAIT
SYN_SENT
先把状态全都取出来,然后使用uniq -c统计,之后再进行排序。
wss8848@ubuntu:~$ netstat -nat |awk '{print $6}'|sort|uniq -c
143 ESTABLISHED
1 FIN_WAIT1
1 Foreign
1 LAST_ACK
36 LISTEN
6 SYN_SENT
113 TIME_WAIT
1 established)
最后的命令如下:
netstat -nat |awk '{print $6}'|sort|uniq -c|sort -rn
分析access.log获得访问前10位的ip地址
awk '{print $1}' access.log |sort|uniq -c|sort -nr|head -10