android通过执行netstat及cat /proc/net/tcp查看正在运行应用的本地端口号pid和uid以及对方的IP和端口号

转自:http://wxmijl.blog.163.com/blog/static/132459282013773122750/


以下数据是通过 android手机上播放PPTV中的某个视屏,执行netstat和cat /proc/net/tcp获得数据列表。
表一
-----------------------------------------------------------------------------------------------------------------------------------------
1|shell@android:/ # netstat
netstat
Proto Recv-Q Send-Q Local Address          Foreign Address        State
 tcp       0      0 0.0.0.0:16000          0.0.0.0:*              LISTEN
 tcp       0      0 0.0.0.0:63843          0.0.0.0:*              LISTEN
 tcp       0      0 127.0.0.1:9000         0.0.0.0:*              LISTEN
 tcp       0      0 127.0.0.1:25000        0.0.0.0:*              LISTEN
 tcp       0      0 0.0.0.0:1802           0.0.0.0:*              LISTEN
 tcp       0      0 0.0.0.0:9003           0.0.0.0:*              LISTEN
 tcp       0      0 0.0.0.0:9006           0.0.0.0:*              LISTEN
 tcp       0      0 0.0.0.0:7575           0.0.0.0:*              LISTEN
 tcp       0      0 0.0.0.0:5054           0.0.0.0:*              LISTEN
 tcp       1      0 192.168.123.103:43202  61.184.100.19:80       SYN_SENT
 tcp       0      0 192.168.123.103:42340  183.129.205.249:80     ESTABLISHED
 tcp       1      0 192.168.123.103:58752  115.238.140.102:80     SYN_SENT
 tcp       0      0 192.168.123.103:43201  61.184.100.19:80       ESTABLISHED
 udp       0      0 0.0.0.0:51209          0.0.0.0:*              CLOSE
 udp       0      0 0.0.0.0:5829           0.0.0.0:*              CLOSE
 udp       0      0 0.0.0.0:1900           0.0.0.0:*              CLOSE
tcp6       0      0 :::6259                :::*                   LISTEN
tcp6       0      0 ::ffff:127.0.0.1:10007 :::*                   LISTEN
tcp6       0      0 ::ffff:192.168.123.103:42260 ::ffff:183.129.205.205:80 TIME_WAIT
tcp6       0      0 ::ffff:192.168.123.103:51095 ::ffff:202.75.220.6:5224 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:45898 ::ffff:211.147.4.31:443 TIME_WAIT
tcp6       0      0 ::ffff:192.168.123.103:56317 ::ffff:74.125.128.188:5228 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:57529 ::ffff:183.129.205.205:80 TIME_WAIT
tcp6       0      1 ::ffff:192.168.123.103:33732 ::ffff:120.197.232.27:80 CLOSE_WAIT
tcp6       0      0 ::ffff:192.168.123.103:37838 ::ffff:180.153.106.27:80 ESTABLISHED
tcp6       0      1 ::ffff:192.168.123.103:57468 ::ffff:14.17.18.181:80 CLOSE_WAIT
tcp6       0      1 ::ffff:192.168.123.103:43951 ::ffff:120.197.232.27:80 CLOSE_WAIT
tcp6       0      0 ::ffff:192.168.123.103:49276 ::ffff:115.238.140.102:80 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:40999 ::ffff:115.238.166.215:80 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:49800 ::ffff:183.129.205.249:80 TIME_WAIT
tcp6       0      0 ::ffff:192.168.123.103:48649 ::ffff:183.129.205.248:80 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:39098 ::ffff:115.238.140.101:80 TIME_WAIT
tcp6       0      0 ::ffff:192.168.123.103:55575 ::ffff:183.129.205.206:80 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:50284 ::ffff:115.238.140.101:80 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:58600 ::ffff:115.238.166.216:80 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:59393 ::ffff:101.226.76.146:8080 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:55361 ::ffff:180.153.106.24:80 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:34328 ::ffff:115.238.140.101:80 TIME_WAIT
tcp6       0      1 ::ffff:192.168.123.103:35724 ::ffff:117.41.242.183:80 CLOSE_WAIT
tcp6       0      0 ::ffff:192.168.123.103:43892 ::ffff:211.151.139.211:80 TIME_WAIT
tcp6       0      0 ::ffff:192.168.123.103:58915 ::ffff:115.238.140.101:80 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:56639 ::ffff:115.238.140.101:80 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:53001 ::ffff:117.21.182.151:80 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:35138 ::ffff:115.238.166.216:80 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:44504 ::ffff:183.129.205.206:80 TIME_WAIT
tcp6       0      0 ::ffff:192.168.123.103:49286 ::ffff:115.238.166.216:80 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:44812 ::ffff:123.126.34.24:80 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:33153 ::ffff:180.149.131.209:5287 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:56887 ::ffff:183.129.205.206:80 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:44746 ::ffff:121.14.125.26:8080 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:34833 ::ffff:183.129.205.191:80 TIME_WAIT
tcp6       0      0 ::ffff:192.168.123.103:51162 ::ffff:115.238.140.101:80 ESTABLISHED
tcp6       0      1 ::ffff:192.168.123.103:52975 ::ffff:117.41.242.183:80 CLOSE_WAIT
tcp6       0      1 ::ffff:192.168.123.103:49943 ::ffff:117.21.185.46:80 CLOSE_WAIT
tcp6       0      0 ::ffff:192.168.123.103:33272 ::ffff:180.153.106.27:80 TIME_WAIT
tcp6       0      0 ::ffff:192.168.123.103:33832 ::ffff:180.153.106.27:80 TIME_WAIT
tcp6       0      0 ::ffff:192.168.123.103:47326 ::ffff:211.151.139.211:80 TIME_WAIT
tcp6       0      1 ::ffff:192.168.123.103:54291 ::ffff:117.121.57.38:80 CLOSE_WAIT
tcp6       0      0 ::ffff:192.168.123.103:59307 ::ffff:115.238.166.215:80 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:53838 ::ffff:117.135.148.48:80 TIME_WAIT
tcp6       0      1 ::ffff:192.168.123.103:54452 ::ffff:74.125.235.198:80 CLOSE_WAIT
tcp6       0      0 ::ffff:192.168.123.103:53130 ::ffff:211.147.4.31:443 TIME_WAIT
tcp6       0      0 ::ffff:192.168.123.103:46034 ::ffff:183.129.205.206:80 TIME_WAIT
tcp6       0      0 ::ffff:192.168.123.103:46712 ::ffff:180.153.106.27:80 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:48966 ::ffff:183.129.205.238:80 ESTABLISHED
tcp6       0      1 ::ffff:192.168.123.103:57503 ::ffff:101.226.89.41:80 CLOSE_WAIT
tcp6       0      0 ::ffff:192.168.123.103:51160 ::ffff:115.238.140.102:80 ESTABLISHED
tcp6       0      0 ::ffff:192.168.123.103:54270 ::ffff:115.238.140.101:80 ESTABLISHED

以上列表中state状态说明
LISTEN 侦听来自远方的TCP端口的连接请求[4]
SYN-SENT 在发送连接请求后等待匹配的连接请求[4]
SYN-RECEIVED 在收到和发送一个连接请求后等待对方对连接请求的确认[4]
ESTABLISHED 代表一个打开的连接[4]
FIN-WAIT-1 等待远程TCP连接中断请求,或先前的连接中断请求的确认[4]
FIN-WAIT-2 从远程TCP等待连接中断请求[4]
CLOSE-WAIT 等待从本地用户发来的连接中断请求[4]
CLOSING 等待远程TCP对连接中断的确认[4]
LAST-ACK 等待原来的发向远程TCP的连接中断请求的确认[4]
TIME-WAIT 等待足够的时间以确保远程TCP接收到连接中断请求的确认[4]
CLOSED 没有任何连接状态[4]


表二
-----------------------------------------------------------------------------------------------------------------------------------------
shell@android:/ # cat /proc/net/tcp
cat /proc/net/tcp
  sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   ui
d  timeout inode
   0: 00000000:3E80 00000000:0000 0A 00000000:00000000 00:00000000 00000000 10049        0 104371 1 cbcdedc0 300 0 0 2 -1
   1: 00000000:F963 00000000:0000 0A 00000000:00000000 00:00000000 00000000 10049        0 103485 1 cbcdf6c0 300 0 0 2 -1
   2: 0100007F:2328 00000000:0000 0A 00000000:00000000 00:00000000 00000000 10049        0 104365 1 cbcde040 300 0 0 2 -1
   3: 0100007F:61A8 00000000:0000 0A 00000000:00000000 00:00000000 00000000  1000        0 2110 1 cbcdfb40 300 0 0 2 -1
   4: 00000000:070A 00000000:0000 0A 00000000:00000000 00:00000000 00000000 10049        0 104388 1 cbcde4c0 300 0 0 2 -1
   5: 00000000:232B 00000000:0000 0A 00000000:00000000 00:00000000 00000000 10049        0 104359 1 cbcde940 300 0 0 2 -1
   6: 00000000:232E 00000000:0000 0A 00000000:00000000 00:00000000 00000000 10049        0 104390 1 c1a3d6c0 300 0 0 2 -1
   7: 00000000:1D97 00000000:0000 0A 00000000:00000000 00:00000000 00000000 10049        0 103486 1 cbcdf240 300 0 0 2 -1
   8: 00000000:13BE 00000000:0000 0A 00000000:00000000 00:00000000 00000000 10049        0 104391 1 c1a3d240 300 0 0 2 -1
   9: 677BA8C0:E581 668CEE73:0050 08 00000000:00000001 00:00000000 00000000 10049        0 105395 1 c1a3cdc0 21 4 2 4 -1
  10: 677BA8C0:A8C2 1364B83D:0050 02 00000001:00000000 01:000000C2 00000002  1019        0 104846 2 c1a3c4c0 1200 0 0 2 2
  11: 677BA8C0:A564 F9CD81B7:0050 01 00000000:00000000 00:00000000 00000000 10049        0 104389 1 c1a3db40 39 0 0 3 2
  12: 677BA8C0:A8C1 1364B83D:0050 01 00000000:00000000 00:00000000 00000000  1013        0 104839 1 c1a3c040 25 4 0 2 -1

以上列表中状态说明

注1:文件中都是用的16进制,所以HTTP的80端口记录为0050。
注2:状态码对应如下
00  "ERROR_STATUS",
01  "TCP_ESTABLISHED",
02  "TCP_SYN_SENT",
03  "TCP_SYN_RECV",
04  "TCP_FIN_WAIT1",
05  "TCP_FIN_WAIT2",
06  "TCP_TIME_WAIT",
07  "TCP_CLOSE",
08  "TCP_CLOSE_WAIT",
09  "TCP_LAST_ACK",
0A  "TCP_LISTEN",
0B  "TCP_CLOSING",

表三
-----------------------------------------------------------------------------------------------------------------------------------------
127|shell@android:/ # ps
ps
USER     PID   PPID  VSIZE  RSS     WCHAN    PC         NAME
app_49    7491  137   337892 40992 ffffffff 2aabc4b0 S com.pplive.androidphone
app_49    7510  137   287792 12064 ffffffff 2aabc4b0 S com.pplive.androidphone.pushservice
app_49    12290 137   293844 13124 ffffffff 2aabc4b0 S com.pplive.androidphone:remote

通过以上命令可以得出:我们只取状态为 ESTABLISHED的数据
 tcp       0      0 192.168.123.103:42340  183.129.205.249:80     ESTABLISHED
 tcp       0      0 192.168.123.103:43201  61.184.100.19:80       ESTABLISHED
以下的 A564, A8C1是16进制的端口号,转换成10进制后端口号为: 42340, 43201;状态码为01,对应用的状态就是 TCP_ESTABLISHED
10049 , 1013就是UID号  其中10000以下的都是系统应用,10049-10000=49就是就是真实的UID:APP_49,
  11: 677BA8C0:A564 F9CD81B7:0050 01 00000000:00000000 00:00000000 00000000 10049        0 104389 1 c1a3db40 39 0 0 3 2
  12: 677BA8C0:A8C1 1364B83D:0050 01 00000000:00000000 00:00000000 00000000  1013        0 104839 1 c1a3c040 25 4 0 2 -1


通过分析表一,二,三生成 表四:
本地IP本地10进制端口 对方IP对方端口 本地16进制端口原UID号 转码UID号PID号 包名
192.168.123.10342340183.129.205.24980A56410049 APP_497491,7510com.pplive.androidphone/com.pplive.androidphone.pushservice/ com.pplive.androidphone:remote
192.168.123.10343201  61.184.100.1980 A8C1 1013


以下转自:http://blog.csdn.net/myarrow/article/details/8930827



1. Android的netstat

    netstat代码如下所示:

[html]  view plain copy
  1. int netstat_main(int argc, char *argv[])  
  2. {  
  3.     printf("Proto Recv-Q Send-Q Local Address          Foreign Address        State\n");  
  4.     ipv4("/proc/net/tcp",  "tcp");  
  5.     ipv4("/proc/net/udp",  "udp");  
  6.     ipv6("/proc/net/tcp6", "tcp6");  
  7.     ipv6("/proc/net/udp6", "udp6");  
  8.     return 0;  
  9. }  


如:cat /proc/net/tcp6内容如下:

# cat /proc/net/tcp6                                
  sl  local_address                         remote_address                        st tx_queue rx_queue tr tm->when retrnsmt  

                                                                         uid     timeout inode
   0: 00000000000000000000000000000000:EA6000000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 10031        0 8220 1 eded9b80 300 0 0 2 -1
   1: 00000000000000000000000000000000:1873 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 10071        0 8214 1 eded8000 300 0 0 2 -1
   2: 0000000000000000FFFF00008204A8C0:E066 0000000000000000FFFF0000CEEB7D4A:0050 08 00000000:00000001 00:00000000 00000000  1000        0 5015 1 eded8b00 21 4 22 10 -1
   3: 0000000000000000FFFF00008204A8C0:EA600000000000000000FFFF00005B04A8C0:CECD 01 00000000:00000000 00:00000000 00000000 10031        0 8376 1 ededa100 300 0 0 10 -1


如对于端口EA60 (60000)的uid为10031,大于10000的uid为app。

2. 在pid中如何寻找对应的uid

   如我的10031在app_31中。

app_31    2761  1378  454512 28132 ffffffff 400e7ae8 S cn.mytest.test

# cat /proc/2761/cgroup                               
2:cpu:/bg_non_interactive
1:cpuacct:/uid/10031

 

其实很简单,app_xx对应的uid为10000+xx


  • 0
    点赞
  • 2
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
有多种方法可以查看Linux系统中应用程序的端口号,以下是其中一些常用的方法: 1. 使用netstat命令 可以使用以下命令列出当前Linux系统中所有在监听端口应用程序: ``` netstat -tulnp ``` 其中,参数含义为: - -t:列出所有TCP连接 - -u:列出所有UDP连接 - -l:只列出监听的端口 - -n:不进行域名解析 - -p:显示进程ID和进程名 2. 使用lsof命令 lsof命令可以列出当前Linux系统中所有打开的文件,包括网络文件,因此也可以用来查看应用程序的端口号。以下命令可以列出所有在监听端口应用程序: ``` lsof -i -P -n | grep LISTEN ``` 其中,参数含义为: - -i:只列出网络文件 - -P:不进行端口号到服务名的转换 - -n:不进行域名解析 - grep LISTEN:只显示在监听的端口 3. 使用ss命令 ss命令是netstat的替代品,更加高效。以下命令可以列出当前Linux系统中所有在监听端口应用程序: ``` ss -tulwn ``` 其中,参数含义为: - -t:列出所有TCP连接 - -u:列出所有UDP连接 - -l:只列出监听的端口 - -w:显示完整的socket信息 - -n:不进行域名解析 4. 使用/proc文件系统 可以在/proc文件系统中查找应用程序打开的网络套接字,以此来确定应用程序的端口号。以下命令可以列出当前Linux系统中所有在监听端口应用程序: ``` ls /proc/*/fd/* | xargs -I{} sh -c 'readlink "{}" | grep socket && echo {}' | awk -F'[ /]' '{print $3, $11}' | sort -n | uniq ``` 其中,命令的具体含义可以参考[这篇文章](https://unix.stackexchange.com/questions/13345/how-can-i-get-a-list-of-all-open-network-ports-on-linux)。

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值