netstat

netstat 命令可以帮助检查本机的网络状况，man netstat 可以看到对其的基本描述：

netstat - Print network connections, routing tables, interface statistics, masquerade connections, and multicast memberships

先来一个简单的例子，要显示tcp协议，使用-t参数，包括了tcp和tcp6

[plain] view plain copy print ?

1. netstat-t
2. ActiveInternetconnections(w/oservers)
3. ProtoRecv-QSend-QLocalAddressForeignAddressState
4. tcp00localhost:59226localhost:8527ESTABLISHED
5. tcp00bogon:44385117.79.93.222:httpTIME_WAIT
6. tcp00localhost:8527localhost:59305CLOSE_WAIT
7. tcp00localhost:8527localhost:59235ESTABLISHED
8. tcp01bogon:36113tf-in-f19.1e100.n:httpsSYN_SENT
9. tcp00bogon:49941117.79.93.196:httpTIME_WAIT
10. tcp00bogon:53574117.79.93.208:httpESTABLISHED
11. tcp00localhost:59259localhost:8527ESTABLISHED

数量太多，只显示了一部分。

添加一个-l参数，会只显示监听本地端口的TCP程序，现在一下子程序少了很多。

[plain] view plain copy print ?

1. netstat-tl
2. ActiveInternetconnections(onlyservers)
3. ProtoRecv-QSend-QLocalAddressForeignAddressState
4. tcp00localhost:8527*:*LISTEN
5. tcp00*:http*:*LISTEN
6. tcp00localhost:domain*:*LISTEN
7. tcp00localhost:ipp*:*LISTEN
8. tcp00*:https*:*LISTEN
9. tcp600ip6-localhost:8527[::]:*LISTEN
10. tcp600ip6-localhost:ipp[::]:*LISTEN

注意上面的Local Address一列，显示的不是ip地址，而是localhost, 如果想要显示IP地址，添加一个参数-n

[plain] view plain copy print ?

1. netstat-tln
2. ActiveInternetconnections(onlyservers)
3. ProtoRecv-QSend-QLocalAddressForeignAddressState
4. tcp00127.0.0.1:85270.0.0.0:*LISTEN
5. tcp000.0.0.0:800.0.0.0:*LISTEN
6. tcp00127.0.0.1:530.0.0.0:*LISTEN
7. tcp00127.0.0.1:6310.0.0.0:*LISTEN
8. tcp000.0.0.0:4430.0.0.0:*LISTEN
9. tcp600::1:8527:::*LISTEN
10. tcp600::1:631:::*LISTEN

如果还想显示进程名称和ID，再添加一个参数-p

[plain] view plain copy print ?

1. netstat-tlnp
2. ActiveInternetconnections(onlyservers)
3. ProtoRecv-QSend-QLocalAddressForeignAddressStatePID/Programname
4. tcp00127.0.0.1:85270.0.0.0:*LISTEN6506/ssh
5. tcp000.0.0.0:800.0.0.0:*LISTEN889/nginx
6. tcp00127.0.0.1:530.0.0.0:*LISTEN1268/dnsmasq
7. tcp00127.0.0.1:6310.0.0.0:*LISTEN590/cupsd
8. tcp000.0.0.0:4430.0.0.0:*LISTEN889/nginx
9. tcp600::1:8527:::*LISTEN6506/ssh
10. tcp600::1:631:::*LISTEN590/cupsd

配合grep，就可以查找监听本地某端口的进程

[plain] view plain copy print ?

1. netstat-tlnp|grep127.0.0.1:8527
2. tcp00127.0.0.1:85270.0.0.0:*LISTEN6506/ssh

配合awk，就可以快速找到进程名称

[plain] view plain copy print ?

1. netstat-tlnp|grep127.0.0.1:8527|awk'{print$7}'
2. 7458/ssh

再做一次awk查找，去掉斜线后面的，只保留进程id

[plain] view plain copy print ?

1. netstat-tlnp|grep127.0.0.1:8527|awk'{print$7}'|awk-F'/''{print$1}'
2. 7458