Detailed explanation of Linux netstat command

Linux netstat command

1. Detailed explanation of TCP connection status

• LISTEN: Listen for connection requests from remote TCP ports
• SYN-SENT: Send a connection request and then wait for a matching connection request
• SYN-RECEIVED: After receiving and sending a connection request, wait for the other party to confirm the connection request
• ESTABLISHED: represents an open connection
• FIN-WAIT-1: Waiting for a remote TCP connection interruption request, or confirmation of a previous connection interruption request
• FIN-WAIT-2: Waiting for a connection interruption request from the remote TCP
• CLOSE-WAIT: Waiting for a connection termination request from a local user
• CLOSING: Waiting for remote TCP to confirm the connection is broken
• LAST-ACK: Waiting for confirmation of the original connection interruption request sent to the remote TCP
• TIME-WAIT: Wait enough time to ensure that the remote TCP receives confirmation of the connection termination request
• CLOSED: No connection status

2. Command format

netstat(options)

3. Command options

• -a or –all: Display all connected sockets;
• -A<network type> or –<network type>: lists the relevant addresses in the network type connection;
• -c or –continuous: Continuously list network status;
• -C or –cache: Displays the cache information of the router configuration;
• -e or –extend: Display other network related information;
• -F or –fib: Display FIB;
• -g or –groups: Displays the list of members of the multi-broadcast function group;
• -h or –help: online help;
• -i or –interfaces: Displays the network interface information form;
• -l or –listening: Displays the Socket of the monitored server;
• -M or –masquerade: Display disguised network connections;
• -n or –numeric: Use the IP address directly without going through the domain name server;
• -N or –netlink or –symbolic: Displays the symbolic link names of network hardware peripherals;
• -o or –timers: Display timers;
• -p or –programs: Displays the program identification code and program name that is using the Socket;
• -r or –route: Display Routing Table;
• -s or –statistice: Displays network work information statistics;
• -t or –tcp: Displays the connection status of the TCP transport protocol;
• -u or –udp: Displays the connection status of the UDP transport protocol;
• -v or –verbose: displays the execution process of the command;
• -V or –version: Display version information;
• -w or –raw: Displays the connection status of the RAW transmission protocol;
• -x or –unix: The effect of this parameter is the same as specifying the "-A unix" parameter;
• –ip or –inet: The effect of this parameter is the same as specifying the "-A inet" parameter.

4. List all ports (including TCP and UDP)

> netstat -a

4. List all TCP ports

> netstat -at

5. List all UDP ports

> netstat -au

6. List all Sockets in listening state

> netstat -l

7. Only list all listening TCP ports

> netstat -lt

8. Only list all listening udp ports

> netstat -lu

9. List only all listening UNIX ports

> netstat -lx

10 Display statistics of all ports

> netstat -s
Ip:
    1007495197 total packets received
    0 forwarded
    582 with unknown protocol
    0 incoming packets discarded
    1007422115 incoming packets delivered
Icmp:
    66583265 ICMP messages received
    63899 Input ICMP message failed.
    InCsumErrors: 384
    ICMP input histogram:
        destination unreachable: 115410
        timeout in transit: 12840
        source quenches: 11
        redirects: 563
        echo requests: 66453453
        echo replies: 152
        timestamp request: 438
        Address mask request: 4
    66987000 ICMP messages sent
    0 ICMP messages failed
    ICMP output histogram:
        destination unreachable: 533106
        echo request: 4
        echo replies: 66453453
        timestamp replies: 437
IcmpMsg:
        InType0: 152
        InType3: 115410
        InType4: 11
        InType5: 563
 
IpExt:
    InNoRoutes: 15
    InMcastPkts: 1291307
    InOctets: 211446050816
    OutOctets: 481070069194

11. Display statistics of TCP ports

> netstat -st
IcmpMsg:
    InType0: 152
    InType3: 115410
    InType4: 11
    InType5: 563
    InType8: 66453492
TCP:
    55437641 active connections openings
    35899081 passive connection openings
    552243 failed connection attempts
    753118 connection resets received
    7 connections established
UdpLite:
TcpExt:
    162052 SYN cookies sent
    621 SYN cookies received
    4998179 invalid SYN cookies received
    551915 resets received for embryonic SYN_RECV sockets
IpExt:
    InNoRoutes: 15
    InMcastPkts: 1291308
    InOctets: 211446303015
    OutOctets: 481070459735
    InMcastOctets: 46487088

12. Display UDP port statistics

> netstat -su
IcmpMsg:
    InType0: 152
    InType3: 115410
    InType4: 11
    InType5: 563
    InType8: 66453594
    InType11: 12840
    InType13: 438
    InType17: 4
    InType37: 3
    InType165: 7
    OutType0: 66453594
    OutType3: 533106
    OutType8: 4
    OutType14: 437
Udp:
    17941589 packets received
    637146 packets to unknown port received.
    1649 packet receive errors
    17977050 packets sent
    0 receive buffer errors
    0 send buffer errors
    InCsumErrors: 1640
UdpLite:
IpExt:
    InNoRoutes: 15
    InMcastPkts: 1291310
    InOctets: 211446802283
    OutOctets: 481071405083
    InMcastOctets: 46487160
    InNoECTPkts: 1009629627
    InECT1Pkts: 9955
    InECT0Pkts: 1987096
    InCEPkts: 94039

13. Display PID and process name in netstat output

> netstat -pt

14. Do not display host, port and user name in netstat output (host, port or user)

> netstat -an

15. Continuously output netstat information

Output network information every second

> netstat -c

16. Display core routing information

> netstat -r
 
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
default gateway 0.0.0.0 UG 0 0 0 eth0
link-local 0.0.0.0 255.255.0.0 U 0 0 0 eth0
172.16.0.0 0.0.0.0 255.255.240.0 U 0 0 0 eth0

17. Use netstat -rn to display the output in digital format without querying the host name.

> netstat -rn
 
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 172.16.0.1 0.0.0.0 UG 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
172.16.0.0 0.0.0.0 255.255.240.0 U 0 0 0 eth0

18. Find out the port the program is running on

> netstat -tunlp | grep ssh
 
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 4400/sshd

19. Find the process running on the specified port

> netstat -an | grep ":80"
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN
tcp 0 0 172.16.0.9:80 185.191.171.12:9380 TIME_WAIT
tcp 0 0 172.16.0.9:80 185.191.171.26:52418 TIME_WAIT
tcp 0 3450 172.16.0.9:80 185.191.171.37:25108 FIN_WAIT1
tcp 0 0 172.16.0.9:80 185.191.171.37:55096 TIME_WAIT
tcp 0 0 172.16.0.9:80 144.76.176.171:27832 TIME_WAIT
tcp 0 0 172.16.0.9:80 118.126.124.7:11127 TIME_WAIT
tcp 0 0 172.16.0.9:46628 169.254.0.55:8080 TIME_WAIT
tcp 0 0 172.16.0.9:80 144.76.176.171:23812 ESTABLISHED

20. Find the process ID through the port

> netstat -tunlp | grep 80 | awk '{print $7}' | cut -d/ -f1
21323

21. Display the list of network interfaces

> netstat -i
Kernel Interface table
Iface MTU RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
docker0 1500 0 0 0 0 0 0 0 0 BMU
eth0 1450 462305568 0 0 0 276046945 0 0 0 BMRU
lo 65536 7204971 0 0 0 7204971 0 0 0 LRU
vpn_abi 1500 229612389 0 1023383 0 146640133 0 956 0 BMRU

22. Statistics of various TCP status lists

> netstat -n | awk '/^tcp/{++S[$NF]}END{for(i in S) print i,S[i]}'
ESTABLISHED 7
FIN_WAIT2 13
TIME_WAIT 18

The above is the detailed content of the detailed explanation of Linux netstat command. For more information about Linux netstat command, please pay attention to other related articles on 123WORDPRESS.COM! I hope everyone will support 123WORDPRESS.COM in the future!