netstat命令 + 黑洞路由

 netstat命令

   netstat命令用于显示与IP、TCP、UDP和ICMP协议相关的统计数据，一般用于检验本机各端口的网络连接情况。netstat是在内核中访问网络及相关信息的程序，它能提供TCP连接，TCP和UDP监听，进程内存管理的相关报告。

[root@localhost etc]# netstat  --help
usage: netstat [-vWeenNcCF] [<Af>] -r         netstat {-V|--version|-h|--help}
       netstat [-vWnNcaeol] [<Socket> ...]
       netstat { [-vWeenNac] -I[<Iface>] | [-veenNac] -i | [-cnNe] -M | -s [-6tuw] } [delay]

        -r, --route              display routing table
        -I, --interfaces=<Iface> display interface table for <Iface>
        -i, --interfaces         display interface table
        -g, --groups             display multicast group memberships
        -s, --statistics         display networking statistics (like SNMP)
        -M, --masquerade         display masqueraded connections

        -v, --verbose            be verbose
        -W, --wide               don't truncate IP addresses
        -n, --numeric            don't resolve names
        --numeric-hosts          don't resolve host names
        --numeric-ports          don't resolve port names
        --numeric-users          don't resolve user names
        -N, --symbolic           resolve hardware names
        -e, --extend             display other/more information
        -p, --programs           display PID/Program name for sockets
        -o, --timers             display timers
        -c, --continuous         continuous listing

        -l, --listening          display listening server sockets
        -a, --all                display all sockets (default: connected)
        -F, --fib                display Forwarding Information Base (default)
        -C, --cache              display routing cache instead of FIB
        -Z, --context            display SELinux security context for sockets

  <Socket>={-t|--tcp} {-u|--udp} {-U|--udplite} {-S|--sctp} {-w|--raw}
           {-x|--unix} --ax25 --ipx --netrom
  <AF>=Use '-6|-4' or '-A <af>' or '--<af>'; default: inet
  List of possible address families (which support routing):
    inet (DARPA Internet) inet6 (IPv6) ax25 (AMPR AX.25) 
    netrom (AMPR NET/ROM) ipx (Novell IPX) ddp (Appletalk DDP) 
    x25 (CCITT X.25) 
[root@localhost etc]# 

[root@localhost etc]# netstat  -r      /查看本机路由表
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
default         _gateway        0.0.0.0         UG        0 0          0 ens33
public1.114dns. 0.0.0.0         255.255.255.255 UH        0 0          0 *
192.168.25.0    0.0.0.0         255.255.255.0   U         0 0          0 ens33
192.168.122.0   0.0.0.0         255.255.255.0   U         0 0          0 virbr0

常用操作符

netstat -tulnp

[root@localhost etc]# netstat -tulnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:4330          0.0.0.0:*               LISTEN      3365/pmlogger       
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      1/systemd           
tcp        0      0 192.168.122.1:53        0.0.0.0:*               LISTEN      2604/dnsmasq        
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1070/sshd           
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      1064/cupsd          
tcp        0      0 127.0.0.1:6010          0.0.0.0:*               LISTEN      5582/sshd: root@pts 
tcp        0      0 127.0.0.1:44321         0.0.0.0:*               LISTEN      2592/pmcd           
tcp6       0      0 ::1:4330                :::*                    LISTEN      3365/pmlogger       
tcp6       0      0 :::111                  :::*                    LISTEN      1/systemd           
tcp6       0      0 :::22                   :::*                    LISTEN      1070/sshd           
tcp6       0      0 ::1:631                 :::*                    LISTEN      1064/cupsd          
tcp6       0      0 ::1:6010                :::*                    LISTEN      5582/sshd: root@pts 
tcp6       0      0 ::1:44321               :::*                    LISTEN      2592/pmcd           
udp        0      0 192.168.122.1:53        0.0.0.0:*                           2604/dnsmasq        
udp        0      0 0.0.0.0:67              0.0.0.0:*                           2604/dnsmasq        
udp        0      0 0.0.0.0:111             0.0.0.0:*                           1/systemd           
udp        0      0 0.0.0.0:39556           0.0.0.0:*                           1042/avahi-daemon:  
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           1042/avahi-daemon:  
udp        0      0 127.0.0.1:323           0.0.0.0:*                           1089/chronyd        
udp6       0      0 :::111                  :::*                                1/systemd           
udp6       0      0 :::50393                :::*                                1042/avahi-daemon:  
udp6       0      0 :::5353                 :::*                                1042/avahi-daemon:  
udp6       0      0 ::1:323                 :::*                                1089/chronyd        
[root@localhost etc]# ^C

 

找出SSH程序运行的端口

netstat -ap | grep ssh

[root@localhost etc]#  netstat -ap | grep ssh
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN      1070/sshd           
tcp        0      0 localhos:x11-ssh-offset 0.0.0.0:*               LISTEN      5582/sshd: root@pts 
tcp        0      0 localhost.localdoma:ssh 192.168.25.1:55254      ESTABLISHED 5556/sshd: root [pr 
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN      1070/sshd           
tcp6       0      0 localhos:x11-ssh-offset [::]:*                  LISTEN      5582/sshd: root@pts 
unix  2      [ ACC ]     STREAM     LISTENING     55581    3848/gnome-keyring-  /run/user/1000/keyring/ssh
unix  2      [ ACC ]     STREAM     LISTENING     73536    4528/gpg-agent       /run/user/0/gnupg/d.qedcazqwdmcnwdnzfb1p1cfh/S.gpg-agent.ssh
unix  2      [ ACC ]     STREAM     LISTENING     73683    4541/gpg-agent       /run/user/0/gnupg/d.858i8z48q33grx9ru7opfrjr/S.gpg-agent.ssh
unix  2      [ ACC ]     STREAM     LISTENING     71134    4509/gpg-agent       /run/user/0/gnupg/d.ws3npbnfsh9e1uqx1fae6jyr/S.gpg-agent.ssh
unix  2      [ ]         STREAM     CONNECTED     130925   5556/sshd: root [pr  
unix  2      [ ]         STREAM     CONNECTED     131925   5582/sshd: root@pts  
unix  2      [ ]         DGRAM                    131908   5556/sshd: root [pr  
unix  3      [ ]         STREAM     CONNECTED     131920   5556/sshd: root [pr  
unix  2      [ ]         STREAM     CONNECTED     130919   5556/sshd: root [pr  
unix  3      [ ]         STREAM     CONNECTED     131919   5582/sshd: root@pts  
unix  3      [ ]         STREAM     CONNECTED     29398    1070/sshd            
[root@localhost etc]# 

 

 

 

 netstat -pt

查看TCP建立完成的链接

[root@localhost etc]# netstat -pt
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 localhost.localdoma:ssh 192.168.25.1:55254      ESTABLISHED 5556/sshd: root [pr 
[root@localhost etc]# ^C
[root@localhost etc]# 

[root@localhost etc]# netstat -ptu
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 localhost.localdoma:ssh 192.168.25.1:55254      ESTABLISHED 5556/sshd: root [pr 
udp        0      0 localhost.locald:bootpc 192.168.25.254:bootps   ESTABLISHED 1051/NetworkManager 
[root@localhost etc]# 

 

添加黑洞路由

ip route  add  blackhole 114.114.114.114/32

[root@localhost etc]# netstat -r
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
default         _gateway        0.0.0.0         UG        0 0          0 ens33
public1.114dns. 0.0.0.0         255.255.255.255 UH        0 0          0 *
192.168.25.0    0.0.0.0         255.255.255.0   U         0 0          0 ens33
192.168.122.0   0.0.0.0         255.255.255.0   U         0 0          0 virbr0
[root@localhost etc]# 

[root@localhost etc]# ping 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.086 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.837 ms
64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.082 ms
64 bytes from 127.0.0.1: icmp_seq=4 ttl=64 time=0.086 ms
^C
--- 127.0.0.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 92ms
rtt min/avg/max/mdev = 0.082/0.272/0.837/0.326 ms
[root@localhost etc]# 
[root@localhost etc]# ping --help
ping: 不适用的选项 -- -
Usage: ping [-aAbBdDfhLnOqrRUvV64] [-c count] [-i interval] [-I interface]
            [-m mark] [-M pmtudisc_option] [-l preload] [-p pattern] [-Q tos]
            [-s packetsize] [-S sndbuf] [-t ttl] [-T timestamp_option]
            [-w deadline] [-W timeout] [hop1 ...] destination
Usage: ping -6 [-aAbBdDfhLnOqrRUvV] [-c count] [-i interval] [-I interface]
             [-l preload] [-m mark] [-M pmtudisc_option]
             [-N nodeinfo_option] [-p pattern] [-Q tclass] [-s packetsize]
             [-S sndbuf] [-t ttl] [-T timestamp_option] [-w deadline]
             [-W timeout] destination
[root@localhost etc]# ping -l 114.114.114.114
Usage: ping [-aAbBdDfhLnOqrRUvV64] [-c count] [-i interval] [-I interface]
            [-m mark] [-M pmtudisc_option] [-l preload] [-p pattern] [-Q tos]
            [-s packetsize] [-S sndbuf] [-t ttl] [-T timestamp_option]
            [-w deadline] [-W timeout] [hop1 ...] destination
Usage: ping -6 [-aAbBdDfhLnOqrRUvV] [-c count] [-i interval] [-I interface]
             [-l preload] [-m mark] [-M pmtudisc_option]
             [-N nodeinfo_option] [-p pattern] [-Q tclass] [-s packetsize]
             [-S sndbuf] [-t ttl] [-T timestamp_option] [-w deadline]
             [-W timeout] destination
[root@localhost etc]# ping 114.114.114.114
connect: 无效的参数
[root@localhost etc]#