Linux中sysadmin之netstat常用命令例解

sysadmin之netstat常用命令例解

**netstat**是一个基于命令行界面的网络实用工具，可显示当前的网络状态，包括传输控制协议层的连线状况、路由表、网络接口状态和网络协议的统计信息等[1]。netstat命令适用于类Unix系统（如macOS、Linux、Solaris和BSD）、IBM OS/2和Windows NT操作系统家族（如Windows XP、Windows Vista、Windows 7、Windows 8和Windows 10）。

netstat 功能强大，可以是解决网络相关问题和验证连接统计的方便工具。

• 以下是在【RHEL/CentOS】上测试的，当然【Ubuntu】也是可以的。

1)、netstat-帮助

netstat -help

usage: netstat [-vWeenNcCF] [<Af>] -r         netstat {-V|--version|-h|--help}
       netstat [-vWnNcaeol] [<Socket> ...]
       netstat { [-vWeenNac] -I[<Iface>] | [-veenNac] -i | [-cnNe] -M | -s [-6tuw] } [delay]

        -r, --route              display routing table
        -I, --interfaces=<Iface> display interface table for <Iface>
        -i, --interfaces         display interface table
        -g, --groups             display multicast group memberships
        -s, --statistics         display networking statistics (like SNMP)
        -M, --masquerade         display masqueraded connections

        -v, --verbose            be verbose
        -W, --wide               don't truncate IP addresses
        -n, --numeric            don't resolve names
        --numeric-hosts          don't resolve host names
        --numeric-ports          don't resolve port names
        --numeric-users          don't resolve user names
        -N, --symbolic           resolve hardware names
        -e, --extend             display other/more information
        -p, --programs           display PID/Program name for sockets
        -o, --timers             display timers
        -c, --continuous         continuous listing

        -l, --listening          display listening server sockets
        -a, --all                display all sockets (default: connected)
        -F, --fib                display Forwarding Information Base (default)
        -C, --cache              display routing cache instead of FIB
        -Z, --context            display SELinux security context for sockets

  <Socket>={-t|--tcp} {-u|--udp} {-U|--udplite} {-S|--sctp} {-w|--raw}
           {-x|--unix} --ax25 --ipx --netrom
  <AF>=Use '-6|-4' or '-A <af>' or '--<af>'; default: inet
  List of possible address families (which support routing):
    inet (DARPA Internet) inet6 (IPv6) ax25 (AMPR AX.25) 
    netrom (AMPR NET/ROM) ipx (Novell IPX) ddp (Appletalk DDP) 
    x25 (CCITT X.25) 

• 网络状态：【已连接】

2)、查看你服务器上的所有已建立的连接。

netstat -natu | grep 'ESTABLISHED'
tcp        0     21 68.183.37.102:22        222.186.31.135:21714    ESTABLISHED
tcp        0     36 68.183.37.102:22        52.148.155.182:49859    ESTABLISHED
tcp        0      0 68.183.37.102:22        61.177.142.158:55481    ESTABLISHED

3)、端口监听：

• 倘若我们已经开始了一些服务，这样可以监听特定的 IP：Port，能非常方便的进行验证。

netstat -an | grep 'LISTEN'
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN   
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN   
tcp6       0      0 :::111                  :::*                    LISTEN   
tcp6       0      0 :::80                   :::*                    LISTEN   
tcp6       0      0 :::22                   :::*                    LISTEN   

4)、使用【-l】参数显示所有监听端口和套接字。

netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State   
tcp        0      0 localhost:smtp          0.0.0.0:*               LISTEN   
tcp        0      0 0.0.0.0:sunrpc          0.0.0.0:*               LISTEN   
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN   
tcp6       0      0 [::]:sunrpc             [::]:*                  LISTEN   
tcp6       0      0 [::]:webcache           [::]:*                  LISTEN   
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN   
udp        0      0 0.0.0.0:805             0.0.0.0:*                       
udp        0      0 0.0.0.0:sunrpc          0.0.0.0:*                       
udp        0      0 localhost:323           0.0.0.0:*                       
udp6       0      0 [::]:805                [::]:*                           
udp6       0      0 [::]:sunrpc             [::]:*                           
udp6       0      0 ip6-localhost:323       [::]:*                           
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node   Path
unix  2      [ ACC ]     STREAM     LISTENING     15108    /run/dbus/system_bus_socket
unix  2      [ ACC ]     STREAM     LISTENING     8202     /run/systemd/journal/stdout
unix  2      [ ACC ]     SEQPACKET  LISTENING     12813    /run/udev/control
unix  2      [ ACC ]     STREAM     LISTENING     17542    public/pickup
unix  2      [ ACC ]     STREAM     LISTENING     15165    /var/run/rpcbind.sock
unix  2      [ ACC ]     STREAM     LISTENING     17546    public/cleanup
unix  2      [ ACC ]     STREAM     LISTENING     15605    /var/lib/gssproxy/default.sock
unix  2      [ ACC ]     STREAM     LISTENING     12706    /run/systemd/private
unix  2      [ ACC ]     STREAM     LISTENING     17549    public/qmgr
unix  2      [ ACC ]     STREAM     LISTENING     17571    public/flush
unix  2      [ ACC ]     STREAM     LISTENING     17553    private/tlsmgr
unix  2      [ ACC ]     STREAM     LISTENING     17586    public/showq
unix  2      [ ACC ]     STREAM     LISTENING     17556    private/rewrite
unix  2      [ ACC ]     STREAM     LISTENING     17559    private/bounce
unix  2      [ ACC ]     STREAM     LISTENING     17562    private/defer
unix  2      [ ACC ]     STREAM     LISTENING     17565    private/trace
unix  2      [ ACC ]     STREAM     LISTENING     17568    private/verify
unix  2      [ ACC ]     STREAM     LISTENING     17574    private/proxymap
unix  2      [ ACC ]     STREAM     LISTENING     17577    private/proxywrite
unix  2      [ ACC ]     STREAM     LISTENING     17580    private/smtp
unix  2      [ ACC ]     STREAM     LISTENING     17583    private/relay
unix  2      [ ACC ]     STREAM     LISTENING     17589    private/error
unix  2      [ ACC ]     STREAM     LISTENING     17592    private/retry
unix  2      [ ACC ]     STREAM     LISTENING     17595    private/discard
unix  2      [ ACC ]     STREAM     LISTENING     17598    private/local
unix  2      [ ACC ]     STREAM     LISTENING     17601    private/virtual
unix  2      [ ACC ]     STREAM     LISTENING     17604    private/lmtp
unix  2      [ ACC ]     STREAM     LISTENING     17607    private/anvil
unix  2      [ ACC ]     STREAM     LISTENING     17610    private/scache
unix  2      [ ACC ]     STREAM     LISTENING     15606    /run/gssproxy.sock

• 说明：利用grep过滤的结果。

5)、【PID 】使用的端口编号

• 如果我知道某应用程序已启动并了解 【PID】（进程标识符），但不确定其使用的端口编号是多少。例如：【 PID 3937】

netstat -anlp |grep 3937
tcp6       0      0 :::80                   :::*                    LISTEN      3937/httpd          
unix  3      [ ]         STREAM     CONNECTED     2442387  3937/httpd 

如上所见，【80】端口 正用于 【PID 3937】

6)、所有的协议统计

• 举例：由于丢弃数据包而频繁断开连接，【-s】参数将会显示出，我们急需和正要找寻的相关信息，也就是显示【数据包】总体统计信息。

netstat -s
Ip:
    731422 total packets received
    0 forwarded
    0 incoming packets discarded
    731399 incoming packets delivered
    787732 requests sent out
    16 dropped because of missing route
Icmp:
    5277 ICMP messages received
    120 input ICMP message failed.
    InCsumErrors: 6
    ICMP input histogram:
        destination unreachable: 193
        timeout in transit: 16
        echo requests: 5060
        echo replies: 2
    9355 ICMP messages sent
    0 ICMP messages failed
    ICMP output histogram:
        destination unreachable: 4295
        echo replies: 5060
IcmpMsg:
        InType0: 2
        InType3: 193
        InType8: 5060
        InType11: 16
        OutType0: 5060
        OutType3: 4295
Tcp:
    42 active connections openings
    35226 passive connection openings
    1693 failed connection attempts
    645 connection resets received
    2 connections established
    646705 segments received
    648037 segments send out
    99463 segments retransmited
    27377 bad segments received.
    150893 resets sent
    InCsumErrors: 27377
Udp:
    74547 packets received
    4814 packets to unknown port received.
    56 packet receive errors
    74584 packets sent
    0 receive buffer errors
    0 send buffer errors
    InCsumErrors: 56
UdpLite:
TcpExt:
    177 invalid SYN cookies received
    1693 resets received for embryonic SYN_RECV sockets
    316 TCP sockets finished time wait in fast timer
    3 packets rejects in established connections because of timestamp
    70248 delayed acks sent
    6 delayed acks further delayed because of locked socket
    Quick ack mode was activated 3082 times
    17 SYNs to LISTEN sockets dropped
    28179 packets directly queued to recvmsg prequeue.
    9802 bytes directly received in process context from prequeue
    72106 packet headers predicted
    94182 acknowledgments not containing data payload received
    40094 predicted acknowledgments
    332 times recovered from packet loss by selective acknowledgements
    8 congestion windows recovered without slow start by DSACK
    1173 congestion windows recovered without slow start after partial ack
    1029 timeouts after SACK recovery
    8 timeouts in loss state
    329 fast retransmits
    3 forward retransmits
    32 retransmits in slow start
    44785 other TCP timeouts
    TCPLossProbes: 9763
    TCPLossProbeRecovery: 1732
    54 SACK retransmits failed
    3144 DSACKs sent for old packets
    4 DSACKs sent for out of order packets
    695 DSACKs received
    1 DSACKs for out of order packets received
    44 connections reset due to unexpected data
    76 connections reset due to early user close
    6079 connections aborted due to timeout
    TCPDSACKIgnoredNoUndo: 448
    TCPSpuriousRTOs: 5
    TCPSackShiftFallback: 465
    IPReversePathFilter: 11
    TCPRcvCoalesce: 32369
    TCPOFOQueue: 4313
    TCPOFOMerge: 4
    TCPChallengeACK: 2
    TCPSynRetrans: 43670
    TCPOrigDataSent: 208010
    TCPACKSkippedSeq: 12
IpExt:
    InNoRoutes: 12
    InOctets: 133789295
    OutOctets: 151093769
    InNoECTPkts: 731338
    InECT1Pkts: 3
    InECT0Pkts: 1568
    InCEPkts: 108

7)、内核路由信息

• 若路由出问题，或者连接不正常，断网或网速过慢，或者链接出问题…
• 则可通过【-r】参数来快速查寻。

netstat -r
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
default         gateway         0.0.0.0         UG        0 0          0 eth0
10.16.0.0       0.0.0.0         255.255.0.0     U         0 0          0 eth0
68.183.32.0     0.0.0.0         255.255.240.0   U         0 0          0 eth0
link-local      0.0.0.0         255.255.0.0     U         0 0          0 eth0

8)、查看谁在使用某个端口的【PID】

• 以启动【Apache】或【Nginx】服务器为例，常遇到【80】端口被占用导致两者其一不能启动，则可通过netstat以下命令来快速解决端口冲突问题。

netstat -anlp |grep 80 | grep LISTEN
tcp6       0      0 :::80                   :::*                    LISTEN      3937/httpd          

• 通过查询可以看出，【3937/httpd】，也就是【Apache】正在使用【80】端口.

9)、如果正在使用AIX

netstat -Aan | grep $portnumber

• 显示协议控制块的地址以16进制的形式显示。
• 一旦你有了十六进制，那么就可以在下面执行，得到那个进程所持有的端口号。

rmsock $address_of_pcb tcpcb

10)、网络接口列表

• 若使用了多个以太网接口，且不能确定服务器接口是哪一个？

netstat -i
Kernel Interface table
Iface             MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0             1500   793026      0      0 0        849443      0      0      0 BMRU
lo              65536        6      0      0 0             6      0      0      0 LRU

11)、持续监听

• 当故障排除服务崩溃相关问题时，这是一个绝佳的选择。假设应用程序每隔几分钟就会随机崩溃。但是，不确定确切时间。您可以使用持续显示进程结果的参数。-c

netstat -anlpc |grep 8080
tcp6       0      0 :::8080                 :::*                    LISTEN      11766/httpd         
tcp6       0      0 :::8080                 :::*                    LISTEN      11766/httpd         
tcp6       0      0 :::8080                 :::*                    LISTEN      11766/httpd         
tcp6       0      0 :::8080                 :::*                    LISTEN      11766/httpd

当它停止更新，然后我们就能借此知道崩溃的原因。

小结：

netstat是【sysadmin】广泛使用的命令之一，我希望以上的例子能给你一个想法，你可以用它做什么。如果你想了解更多关于Linux方面的知识，敬请关注【sngee】！

---

学如人生，砥砺前行…
互勉互励，志之所趋…