服务和端口查询 netstat, lsof

1. 展示网络状态 netstat

• netstat -a/-l/-t: 列出所有端口/ 监听端口 / tcp端口

➜  ~ netstat -a | head -4 (内容过多只展示4行)
Active Internet connections (including servers)
Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)
tcp4       0      0  100.100.56.144.60454   140.143.52.226.https   ESTABLISHED
tcp4       0      0  100.100.56.144.60449   ec2-3-224-115-94.https ESTABLISHED
➜  ~ netstat -l | head -4
Active Internet connections
Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)
tcp4       0      0  100.100.56.144.60504   aeab55d76dd13c9b.https ESTABLISHED
tcp4       0      0  100.100.56.144.60503   ec2-52-45-142-23.https ESTABLISHED
➜  ~ netstat -t | head -4
Active Internet connections
Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)
tcp4       0      0  100.100.56.144.60518   aeab55d76dd13c9b.https ESTABLISHED
tcp4       0      0  100.100.56.144.60504   aeab55d76dd13c9b.https ESTABLISHED

• netstat -p [protocol]: 列出协议为[protocol] 的网络状态

➜  ~ netstat -p udp | head -4
Active Internet connections
Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)
udp4       0      0  *.*                    *.*
udp4       0      0  *.63491                *.*
➜  ~ netstat -p tcp
Active Internet connections
Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)
tcp4       0      0  100.100.56.144.60244   140.143.52.226.https   ESTABLISHED
tcp4       0      0  100.100.56.144.60237   39.97.4.86.https       ESTABLISHED

• netstat -nr: 列出路由表

➜  ~ netstat -nr | head -10 （内容过多只展示10行）
Routing tables

Internet:
Destination        Gateway            Flags        Netif Expire
default            100.100.56.254     UGSc           en0
100.100.56/23      link#4             UCS            en0      !
100.100.56.109     1c:36:bb:2a:cd:cc  UHLWI          en0      !
100.100.56.116     8c:85:90:41:67:92  UHLWI          en0    187
100.100.56.121     d0:81:7a:cb:e:50   UHLWI          en0     64
100.100.56.144/32  link#4             UCS            en0      !

2. 列出打开的文件和对应进程 lsof

• lsof -i :port : 找到占用端口port的进程

➜  linux_commands lsof -i :80
COMMAND    PID    USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
Google     652 qiushye   22u  IPv4 0x25ea66220a8400ff      0t0  TCP 100.100.56.144:51632->10.200.20.65:http (ESTABLISHED)
Google     652 qiushye   26u  IPv4 0x25ea66220e3c281f      0t0  TCP 100.100.56.144:51431->10.200.20.65:http (ESTABLISHED)
WeChat    1857 qiushye  178u  IPv6 0x25ea6621e1fab37f      0t0  TCP 100.100.56.144:65296->116.128.133.100:http (ESTABLISHED)

• lsof -u [username]: 找到由用户[username]打开的文件

➜  linux_commands lsof -u qiushye | head -3
COMMAND     PID    USER   FD      TYPE             DEVICE   SIZE/OFF                NODE NAME
loginwind   188 qiushye  cwd       DIR                1,4        704                   2 /
loginwind   188 qiushye  txt       REG                1,4    1261472 1152921500312502614 /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow

• lsof -c [cmd]: 找到由命令[cmd]打开的文件

➜  linux_commands lsof -c loginwind | head -3
COMMAND   PID    USER   FD   TYPE             DEVICE SIZE/OFF                NODE NAME
loginwind 188 qiushye  cwd    DIR                1,4      704                   2 /
loginwind 188 qiushye  txt    REG                1,4  1261472 1152921500312502614 /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow

• lsof -p [PID]: 根据进程pid找到对应文件

➜  linux_commands lsof -p 188 | head -3
COMMAND   PID    USER   FD   TYPE             DEVICE SIZE/OFF                NODE NAME
loginwind 188 qiushye  cwd    DIR                1,4      704                   2 /
loginwind 188 qiushye  txt    REG                1,4  1261472 1152921500312502614 /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow

•  lsof [file]: 找到打开[file]文件的进程
• lsof -D [dir]: 找到在目录[dir]下打开文件的进程

➜  linux_commands lsof /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow
COMMAND   PID    USER   FD   TYPE DEVICE SIZE/OFF                NODE NAME
loginwind 188 qiushye  txt    REG    1,4  1261472 1152921500312502614 /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow
➜  linux_commands lsof +D /System/Library/CoreServices/loginwindow.app/Contents/MacOS
COMMAND   PID    USER   FD   TYPE DEVICE SIZE/OFF                NODE NAME
loginwind 188 qiushye  txt    REG    1,4  1261472 1152921500312502614 /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow