在工作中，经常用到很多linux命令，netstat这个也属于查看网络情况的一个常用命令，以前常常用到，但只是知道带上一些参数：比如-anp 、-ln之类的组合，具体的含义和Output出来的一些选项都只是知道个大概，在查看了man文档以及部分资料后，这里整理下对于该命令的一些理解和说明。
]# man netstat
可以看到介绍如下：
NAME
netstat - Print network connections, routing tables, interface statistics, masquerade connections, and multi-cast memberships
基本可以阐述为一个查看网络情况的命令。
常用的选项有：
-a：将目前系统上所有的联机、监听、Socket数据都列出来
-t：列出tcp网络封包的数据
-u：列出udp网络封包的数据
-n：不以程序的服务名称，以port number来显示
-l：列出目前正在网络监听(listen)的服务
-p：列出该网络服务程序的PID
当然man文档中有所以选项的说明：
OPTIONS
--verbose , -v
Tell the user what is going on by being verbose. Especially print some useful information about unconfigured
address families.
--numeric , -n
Show numerical addresses instead of trying to determine symbolic host, port or user names.
--numeric-hosts
shows numerical host addresses but does not affect the resolution of port or user names.
--numeric-ports
shows numerical port numbers but does not affect the resolution of host or user names.
--numeric-users
shows numerical user IDs but does not affect the resolution of host or port names.
--protocol=family , -A
Specifies the address families (perhaps better described as low level protocols) for which connections are to
be shown. family is a comma (’,’) separated list of address family keywords like inet, unix, ipx, ax25,
netrom, and ddp. This has the same effect as using the --inet, --unix (-x), --ipx, --ax25, --netrom, and --ddp
options.
The address family inet includes raw, udp and tcp protocol sockets.
-c, --continuous
This will cause netstat to print the selected information every second continuously.
-e, --extend
Display additional information. Use this option twice for maximum detail.
-o, --timers
Include information related to networking timers.
-p, --program
Show the PID and name of the program to which each socket belongs.
-l, --listening
Show only listening sockets. (These are omitted by default.)
-a, --all
Show both listening and non-listening sockets. With the --interfaces option, show interfaces that are not
marked
-F
Print routing information from the FIB. (This is the default.)
-C
Print routing information from the route cache.
-Z --context
If SELinux enabled print SELinux context.
-T --notrim
Stop trimming long addresses.
delay
Netstat will cycle printing through statistics every delay seconds. UP.
直接不带选项输入命令：
~]# netstat
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 Slave1.Hadoop:53494 192.168.6.7:5667 TIME_WAIT
tcp 0 0 Slave1.Hadoop:27017 Slave2.Hadoop:38188 ESTABLISHED
tcp 0 0 Slave1.Hadoop:imap ::ffff:192.168.8.153:50678 ESTABLISHED
tcp 0 0 Slave1.Hadoop:imap ::ffff:192.168.8.153:49658 ESTABLISHED
tcp 0 0 Slave1.Hadoop:imap ::ffff:192.168.8.153:49660 ESTABLISHED
tcp 0 0 Slave1.Hadoop:asr ::ffff:192.168.6.7:46707 ESTABLISHED
tcp 0 0 Slave1.Hadoop:imap ::ffff:192.168.8.153:49634 ESTABLISHED
tcp 0 0 Slave1.Hadoop:42228 ::ffff:192.168.8.4:ncube-lm ESTABLISHED
tcp 0 0 Slave1.Hadoop:42527 ::ffff:192.168.8.4:ncube-lm ESTABLISHED
tcp 0 0 Slave1.Hadoop:42530 ::ffff:192.168.8.4:ncube-lm ESTABLISHED
tcp 0 0 Slave1.Hadoop:42531 ::ffff:192.168.8.4:ncube-lm ESTABLISHED
tcp 0 0 Slave1.Hadoop:42528 ::ffff:192.168.8.4:ncube-lm ESTABLISHED
tcp 0 0 Slave1.Hadoop:42529 ::ffff:192.168.8.4:ncube-lm ESTABLISHED
tcp 0 0 Slave1.Hadoop:36207 ::ffff:192.168.8.4:ncube-lm ESTABLISHED
tcp 0 0 Slave1.Hadoop:36206 ::ffff:192.168.8.4:ncube-lm ESTABLISHED
tcp 0 0 Slave1.Hadoop:48458 ::ffff:192.168.6.7:5801 ESTABLISHED
tcp 0 0 Slave1.Hadoop:imap ::ffff:192.168.8.153:59769 ESTABLISHED
tcp 0 0 Slave1.Hadoop:imap ::ffff:192.168.8.153:59774 ESTABLISHED
tcp 0 0 Slave1.Hadoop:45622 ::ffff:192.168.6.7:5701 ESTABLISHED
tcp 0 0 Slave1.Hadoop:imap ::ffff:192.168.8.153:58650 ESTABLISHED
tcp 0 0 Slave1.Hadoop:razor Slave2.Hadoop:54565 ESTABLISHED
tcp 0 0 Slave1.Hadoop:47092 Slave2.Hadoop:compaq-wcp ESTABLISHED
tcp 0 0 Slave1.Hadoop:35664 Slave2.Hadoop:troff ESTABLISHED
tcp 0 0 Slave1.Hadoop:ssh ::ffff:192.168.8.234:53735 ESTABLISHED
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags Type State I-Node Path
unix 29 [ ] DGRAM 6973 /dev/log
unix 2 [ ] DGRAM 1471 @/org/kernel/udev/udevd
unix 2 [ ] DGRAM 7545 @/org/freedesktop/hal/udev_event
unix 2 [ ] DGRAM 23027536
unix 3 [ ] STREAM CONNECTED 23027127 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 23027126
unix 3 [ ] STREAM CONNECTED 23027121
unix 3 [ ] STREAM CONNECTED 23027120
unix 3 [ ] STREAM CONNECTED 23026616 /var/run/dovecot/login/default
........
从上面可以看出显示了两个部分：与网络相关的部分、与本机程序自己的相关部分。
1、先来看看网络相关部分的OUTPUT
Proto：protocol的缩写，网络的封包协议，主要分为TCP与UDP协议，另外从文档看还有个raw；
Recv-Q：非由用户程序链接到此socket的复制的总bytes数；
Send-Q：非由远程主机程序传送过来的acknowledged总管bytes数；
Local Address：本地端的IP：port情况；
Foregin Address：远程主机的IP：port情况；
State：联机状态，主要有建立(ESTABLISED)及监听(LISTEN)；
2、由于linux系统上面的程序是可以接受不同程序所发送来的信息，那就是linux上头的插槽挡(socket file)，这里看看linux本机系统相关部分的OUTPUT说明：
Proto：由于是本机，一般就是unix；
RefCnt：连接到此socket的程序数量；
Flags：联机的旗标；
Type：socket存取的类型，主要有确认联机的STREAM与不需要确认的DGRAM两种；
State：若为CONNECTED表示多个程序之间已经联机建立；
Path：连接到此socket的相关程序的路径！或者是相关数据输出的路径
具体的文档如下：
OUTPUT
Active Internet connections (TCP, UDP, raw)
Proto
The protocol (tcp, udp, raw) used by the socket.
Recv-Q
The count of bytes not copied by the user program connected to this socket.
Send-Q
The count of bytes not acknowledged by the remote host.
Local Address
Address and port number of the local end of the socket. Unless the --numeric (-n) option is specified, the
socket address is resolved to its canonical host name (FQDN), and the port number is translated into the corre-
sponding service name.
Foreign Address
Address and port number of the remote end of the socket. Analogous to "Local Address."
State
The state of the socket. Since there are no states in raw mode and usually no states used in UDP, this column
may be left blank. Normally this can be one of several values:
ESTABLISHED
The socket has an established connection.
SYN_SENT
The socket is actively attempting to establish a connection.
SYN_RECV
A connection request has been received from the network.
FIN_WAIT1
The socket is closed, and the connection is shutting down.
FIN_WAIT2
Connection is closed, and the socket is waiting for a shutdown from the remote end.
TIME_WAIT
The socket is waiting after close to handle packets still in the network.
CLOSED The socket is not being used.
CLOSE_WAIT
The remote end has shut down, waiting for the socket to close.
LAST_ACK
The remote end has shut down, and the socket is closed. Waiting for acknowledgement.
LISTEN The socket is listening for incoming connections. Such sockets are not included in the output unless
you specify the --listening (-l) or --all (-a) option.
CLOSING
Both sockets are shut down but we still don’t have all our data sent.
UNKNOWN
The state of the socket is unknown.
User
The username or the user id (UID) of the owner of the socket.
PID/Program name
Slash-separated pair of the process id (PID) and process name of the process that owns the socket. --program
causes this column to be included. You will also need superuser privileges to see this information on sockets
you don’t own. This identification information is not yet available for IPX sockets.
Timer
(this needs to be written)
Active UNIX domain Sockets
Proto
The protocol (usually unix) used by the socket.
RefCnt
The reference count (i.e. attached processes via this socket).
Flags
The flags displayed is SO_ACCEPTON (displayed as ACC), SO_WAITDATA (W) or SO_NOSPACE (N). SO_ACCECPTON is used
on unconnected sockets if their corresponding processes are waiting for a connect request. The other flags are
not of normal interest.
Type
There are several types of socket access:
SOCK_DGRAM
The socket is used in Datagram (connectionless) mode.
SOCK_STREAM
This is a stream (connection) socket.
SOCK_RAW
The socket is used as a raw socket.
SOCK_RDM
This one serves reliably-delivered messages.
SOCK_SEQPACKET
This is a sequential packet socket.
SOCK_PACKET
Raw interface access socket.
UNKNOWN
Who ever knows what the future will bring us - just fill in here :-)
State
This field will contain one of the following Keywords:
FREE The socket is not allocated
LISTENING
The socket is listening for a connection request. Such sockets are only included in the output if you
specify the --listening (-l) or --all (-a) option.
CONNECTING
The socket is about to establish a connection.
CONNECTED
The socket is connected.
DISCONNECTING
The socket is disconnecting.
(empty)
The socket is not connected to another one.
UNKNOWN
This state should never happen.
PID/Program name
Process ID (PID) and process name of the process that has the socket open. More info available in Active
Internet connections section written above.
Path
This is the path name as which the corresponding processes attached to the socket.
Active IPX sockets
(this needs to be done by somebody who knows it)
Active NET/ROM sockets
(this needs to be done by somebody who knows it)
Active AX.25 sockets
(this needs to be done by somebody who knows it)
NOTES
Starting with Linux release 2.2 netstat -i does not show interface statistics for alias interfaces. To get per
alias interface counters you need to setup explicit rules using the ipchains(8) command.
FILES
/etc/services -- The services translation file
/proc -- Mount point for the proc filesystem, which gives access to kernel status information via the following
files.
/proc/net/dev -- device information
/proc/net/raw -- raw socket information
/proc/net/tcp -- TCP socket information
/proc/net/udp -- UDP socket information
/proc/net/igmp -- IGMP multicast information
/proc/net/unix -- Unix domain socket information
/proc/net/ipx -- IPX socket information
/proc/net/ax25 -- AX25 socket information
/proc/net/appletalk -- DDP (appletalk) socket information
/proc/net/nr -- NET/ROM socket information
/proc/net/route -- IP routing information
/proc/net/ax25_route -- AX25 routing information
/proc/net/ipx_route -- IPX routing information
/proc/net/nr_nodes -- NET/ROM nodelist
/proc/net/nr_neigh -- NET/ROM neighbours
/proc/net/ip_masquerade -- masqueraded connections
/proc/net/snmp -- statistics
可能主要是Recv-Q和Send-Q比较拗口难以理解，这里找到一个比较不错的解释：
"Proto" is short for protocol, which is either TCP or UDP. "Recv-Q" and "Send-Q" mean receiving queue and sending queue. These should always be zero; if they're not you might have a problem. Packets should not be piling up in either queue, except briefly, as this example shows:
tcp 0 593 192.168.1.5:34321 venus.euao.com:smtp ESTABLISHED
That happened when I hit the "check mail" button in KMail; a brief queuing of outgoing packets is normal behavior. If the receiving queue is consistently jamming up, you might be experiencing a denial-of-service attack. If the sending queue does not clear quickly, you might have an application that is sending them out too fast, or the receiver cannot accept them quickly enough.
"Local address" is either your IP and port number, or IP and the name of a service. "Foreign address" is the hostname and service you are connected to. The asterisk is a placeholder for IP addresses, which of course cannot be known until a remote host connects. "State" is the current status of the connection. Any TCP state can be displayed here, but these three are the ones you want to see。
大概意思为：Recv-Q Send-Q分别表示网络接收队列，发送队列；
这两个值通常应该为0，如果不为0可能是有问题的。packets在两个队列里都不应该有堆积状态。可接受短暂的非0情况。如文中的示例，短暂的Send-Q队列发送pakets非0是正常状态。
Recv-Q：表示收到的数据已经在本地接收缓冲，但是还有多少没有被进程取走，recv()
Send-Q：对方没有收到的数据或者说没有Ack的,还是本地缓冲区.
通过netstat的这两个值就可以简单判断程序收不到包到底是包没到还是包没有被进程recv。
所以在网络出现问题的情况下，我们可以用netstat命令来跟踪查找问题，从而解决问题。