10.9 View network status
netstat is a program that accesses network connection status and related information in the kernel. It can provide reports on TCP connections, TCP and UDP monitoring, and process memory management.
netstat is a console command and is a very useful tool for monitoring TCP/IP networks. It can display routing tables, actual network connections, and status information for each network interface device. Netstat is used to display statistical data related to IP, TCP, UDP and ICMP protocols, and is generally used to check the network connection of each port of the machine.
Don't be surprised if your computer sometimes receives packets that cause erroneous data or failures, TCP/IP tolerates these types of errors and can automatically resend packets. But if the cumulative number of error conditions is a significant percentage of the IP datagrams received, or if the number is increasing rapidly, then you should use netstat to find out why these conditions are occurring.
The function of the netstat command is to display network connection, routing table and network interface information, allowing users to know which network connections are working. When used without arguments, netstat displays active TCP connections.
The netstat command is used to print network connection status, system open ports, routing table and other information. The most commonly used commands for netstat are the netstat -lnp (to see which ports are currently enabled by the system) and netstat -an (to see the network connection status). These two commands are very useful.
Under normal circumstances, a machine does not have any port listening, which means that it has no way to communicate with other machines. To provide web services and let others access servers and websites, you need to listen on a port. So how to check the listening port? Enter the command netstat -lnp, press Enter, see the figure below,
Only view the commands of tcp and udp, see the figure below,
netstat -ltnp view tcp
netstat -lunp view udp
netstat -ltunp view tcp and udp
There is another command: netstat -an to view tcp/ip status
It's called "Three Handshakes, Four Waves" of TCP/IP. "Three handshakes, four waves" is the point.
The common state in the above figure is the connection state. There is no state in the original mode, and often also in the user datagram protocol, so the state column can be left empty. If there is a state, usually the value is:
LISTEN
listens for a connection request from a remote TCP port SYN
-SENT
waits for a matching connection request after sending a connection request The acknowledgment of ESTABLISHED represents an open connection, indicating that communication is in progress. This value needs attention. If it is very large, it means that the system is busy now. Under normal circumstances, within 1000, the server is acceptable. FIN-WAIT-1 Waiting for remote TCP connection interruption request, or confirmation of previous connection interruption request FIN-WAIT-2 Waiting for connection interruption request from remote TCP CLOSE-WAIT Waiting for connection interruption request from local user CLOSING Waiting for remote TCP pair Acknowledgment of connection interruption LAST-ACK Waiting for acknowledgment of the original connection interruption request sent to the remote TCP TIME-WAIT Waiting for enough time to ensure that the remote TCP receives the connection interruption request acknowledgment CLOSED No connection status
Share a little trick, you can view all the status numbers, enter the command netstat -an | awk '/^tcp/ {++sta[$NF]} END {for(key in sta) print key, "\t", sta[key]}' , press Enter, see the figure below,
There is also a command ss, which is similar to netstat, see the figure below,
The disadvantage of this command is that it will not display the name of the process. The netstat command will do.
netstat -lnp View which ports are currently activated by the system
netstat -an View network connection status
netstat -ltnp View the tcp ports
currently activated by the system netstat -lunp View the udp ports activated by the
current system netstat -ltunp View the tcp and udp ports activated by the current system
netstat - an | awk '/^tcp/ {++sta[$NF]} END {for(key in sta) print key, "\t", sta[key]}' to see all the state numbers.
The courseware address is at centos7.aminglinux.com.
ss -an is similar to netstat, both of them check the status, but it will not display the name of the process
ss -an | grep -i listen Check the status of listen