Linux netstat command

1. Detailed explanation of TCP connection status

• LISTEN: Listen for connection requests from remote TCP ports
• SYN-SENT: wait for a matching connection request after sending the connection request
• SYN-RECEIVED: After receiving and sending a connection request, wait for the other party to confirm the connection request
• ESTABLISHED: Represents an open connection
• FIN-WAIT-1: Wait for the remote TCP connection interruption request, or the confirmation of the previous connection interruption request
• FIN-WAIT-2: Waiting for connection interruption request from remote TCP
• CLOSE-WAIT: Waiting for a connection interruption request from a local user
• CLOSING: Waiting for the remote TCP to confirm that the connection is interrupted
• LAST-ACK: Waiting for the confirmation of the original connection interruption request sent to the remote TCP
• TIME-WAIT: Wait for enough time to ensure that the remote TCP receives an acknowledgment of the connection interruption request
• CLOSED: no connection status

2. Command format

netstat(options)

3. Command options

• -a or –all: Display Sockets in all connections;
• -A<network type> or –<network type>: list the relevant addresses in the connection of this network type;
• -c or –continuous: Continuously list the network status;
• -C or –cache: Display the cache information of the router configuration;
• -e or –extend: Display other relevant information of the network;
• -F or –fib: display FIB;
• -g or –groups: Display the list of multicast function group members;
• -h or --help: online help;
• -i or –interfaces: display the network interface information form;
• -l or –listening: Display the Socket of the server being monitored;
• -M or –masquerade: display masquerading network connections;
• -n or –numeric: use the ip address directly without going through the domain name server;
• -N or --netlink or --symbolic: Display symbolic link names of network hardware peripherals;
• -o or --timers: display timers;
• -p or –programs: Display the program identification code and program name that are using Socket;
• -r or –route: Display Routing Table;
• -s or –statistice: display network work information statistics table;
• -t or –tcp: Display the connection status of the TCP transport protocol;
• -u or –udp: Display the connection status of the UDP transport protocol;
• -v or –verbose: display the instruction execution process;
• -V or –version: display version information;
• -w or –raw: Display the connection status of the RAW transmission protocol;
• -x or –unix: The effect of this parameter is the same as specifying the "-A unix" parameter;
• –ip or –inet: The effect of this parameter is the same as specifying the "-A inet" parameter.

4. List all ports (including TCP and UDP)

> netstat -a

4. List all TCP ports

> netstat -at

5. List all UDP ports

> netstat -au

6. List all Sockets in listening state

> netstat -l

7. Only list all listening tcp ports

> netstat -lt

8. Only list all listening udp ports

> netstat -lu

9. Only list all listening UNIX ports

> netstat -lx

10 Display statistics for all ports

> netstat -s
Ip:
    1007495197 total packets received
    0 forwarded
    582 with unknown protocol
    0 incoming packets discarded
    1007422115 incoming packets delivered
Icmp:
    66583265 ICMP messages received
    63899 input ICMP message failed.
    InCsumErrors: 384
    ICMP input histogram:
        destination unreachable: 115410
        timeout in transit: 12840
        source quenches: 11
        redirects: 563
        echo requests: 66453453
        echo replies: 152
        timestamp request: 438
        address mask request: 4
    66987000 ICMP messages sent
    0 ICMP messages failed
    ICMP output histogram:
        destination unreachable: 533106
        echo request: 4
        echo replies: 66453453
        timestamp replies: 437
IcmpMsg:
        InType0: 152
        InType3: 115410
        InType4: 11
        InType5: 563

IpExt:
    InNoRoutes: 15
    InMcastPkts: 1291307
    InOctets: 211446050816
    OutOctets: 481070069194

11. Display TCP port statistics

> netstat -st
IcmpMsg:
    InType0: 152
    InType3: 115410
    InType4: 11
    InType5: 563
    InType8: 66453492
Tcp:
    55437641 active connections openings
    35899081 passive connection openings
    552243 failed connection attempts
    753118 connection resets received
    7 connections established
UdpLite:
TcpExt:
    162052 SYN cookies sent
    621 SYN cookies received
    4998179 invalid SYN cookies received
    551915 resets received for embryonic SYN_RECV sockets
IpExt:
    InNoRoutes: 15
    InMcastPkts: 1291308
    InOctets: 211446303015
    OutOctets: 481070459735
    InMcastOctets: 46487088

12. Display UDP port statistics

> netstat -su
IcmpMsg:
    InType0: 152
    InType3: 115410
    InType4: 11
    InType5: 563
    InType8: 66453594
    InType11: 12840
    InType13: 438
    InType17: 4
    InType37: 3
    InType165: 7
    OutType0: 66453594
    OutType3: 533106
    OutType8: 4
    OutType14: 437
Udp:
    17941589 packets received
    637146 packets to unknown port received.
    1649 packet receive errors
    17977050 packets sent
    0 receive buffer errors
    0 send buffer errors
    InCsumErrors: 1640
UdpLite:
IpExt:
    InNoRoutes: 15
    InMcastPkts: 1291310
    InOctets: 211446802283
    OutOctets: 481071405083
    InMcastOctets: 46487160
    InNoECTPkts: 1009629627
    InECT1Pkts: 9955
    InECT0Pkts: 1987096
    InCEPkts: 94039

13. Show PID and process name in netstat output

> netstat -pt

14. Do not display host, port and user name (host, port or user) in netstat output

> netstat -an

15. Continue to output netstat information

Output network information every second

> netstat -c

16. Display core routing information

> netstat -r

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
default         gateway         0.0.0.0         UG        0 0          0 eth0
link-local      0.0.0.0         255.255.0.0     U         0 0          0 eth0
172.16.0.0      0.0.0.0         255.255.240.0   U         0 0          0 eth0

17. Use netstat -rn to display the number format without querying the host name.

> netstat -rn

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         172.16.0.1      0.0.0.0         UG        0 0          0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth0
172.16.0.0      0.0.0.0         255.255.240.0   U         0 0          0 eth0

18. Find out the port the program is running on

> netstat -tunlp | grep ssh

tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      4400/sshd

19. Find out the process running on the specified port

> netstat -an | grep ":80"
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN
tcp        0      0 172.16.0.9:80           185.191.171.12:9380     TIME_WAIT
tcp        0      0 172.16.0.9:80           185.191.171.26:52418    TIME_WAIT
tcp        0   3450 172.16.0.9:80           185.191.171.37:25108    FIN_WAIT1
tcp        0      0 172.16.0.9:80           185.191.171.37:55096    TIME_WAIT
tcp        0      0 172.16.0.9:80           144.76.176.171:27832    TIME_WAIT
tcp        0      0 172.16.0.9:80           118.126.124.7:11127     TIME_WAIT
tcp        0      0 172.16.0.9:46628        169.254.0.55:8080       TIME_WAIT
tcp        0      0 172.16.0.9:80           144.76.176.171:23812    ESTABLISHED

20. Find the process ID through the port

> netstat -tunlp | grep 80 | awk '{print $7}' | cut -d/ -f1
21323

21. Display a list of network interfaces

> netstat -i
Kernel Interface table
Iface             MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
docker0          1500        0      0      0 0             0      0      0      0 BMU
eth0             1450 462305568      0      0 0      276046945      0      0      0 BMRU
lo              65536  7204971      0      0 0       7204971      0      0      0 LRU
vpn_abi          1500 229612389      0 1023383 0      146640133      0    956      0 BMRU

22. Statistical list of various states of TCP

> netstat -n | awk '/^tcp/{++S[$NF]}END{for(i in S) print i,S[i]}'
ESTABLISHED 7
FIN_WAIT2 13
TIME_WAIT 18

 The above is the detailed content of the Linux netstat command. For more information about the Linux netstat command, please pay attention to other related articles of developpaer! I hope you will support developpaer a lot in the future!