1.Netstat 命令的使用技巧
Netstat用于显示与IP、TCP、UDP和ICMP协议相关的统计数据,一般用于检验本机各端口的网络连接情况。
如果我们的计算机有时候接受到的数据报会导致出错数据删除或故障,我们不必感到奇怪,TCP/IP可以容许这些类型的错误,并能够自动重发数据报。但如果累计的出错情况数目占到所接收的IP数据报相当大的百分比,或者它的数目正迅速增加,那么我们就应该使用Netstat查一查为什么会出现这些情况了。
1、netstat 的一些常用选项
·netstat –s
本选项能够按照各个协议分别显示其统计数据。如果我们的应用程序(如Web浏览器)运行速度比较慢,或者不能显示Web页之类的数据,那么我们就可以用本选项来查看一下所显示的信息。我们需要仔细查看统计数据的各行,找到出错的关键字,进而确定问题所在。
·netstat –e
本选项用于显示关于以太网的统计数据。它列出的项目包括传送的数据报的总字节数、错误数、删除数、数据报的数量和广播的数量。这些统计数据既有发送的数据报数量,也有接收的数据报数量。这个选项可以用来统计一些基本的网络流量)。
·netstat –r
本选项可以显示关于路由表的信息,类似于后面所讲使用route print命令时看到的 信息。除了显示有效路由外,还显示当前有效的连接。
·netstat –a
本选项显示一个所有的有效连接信息列表,包括已建立的连接(ESTABLISHED),也包括监听连接请求(LISTENING)的那些连接。
·netstat –n
显示所有已建立的有效连接。
下面是 netstat 的输出示例:
C:/>netstat -e
Interface Statistics
Received Sent
Bytes 3995837940 47224622
Unicast packets 120099 131015
Non-unicast packets 7579544 3823
Discards 0 0
Errors 0 0
Unknown protocols 363054211
C:/Documents and Settings/wang>netstat -a
Active Connections
Proto Local Address Foreign Address State
TCP ncut1:smtp ncut1:0 LISTENING
TCP ncut1:http ncut1:0 LISTENING
TCP ncut1:epmap ncut1:0 LISTENING
TCP ncut1:https ncut1:0 LISTENING
TCP ncut1:microsoft-ds ncut1:0 LISTENING
TCP ncut1:1031 ncut1:0 LISTENING
TCP ncut1:1032 ncut1:0 LISTENING
TCP ncut1:6059 ncut1:0 LISTENING
TCP ncut1:12200 ncut1:0 LISTENING
TCP ncut1:1032 ncut1:4251 ESTABLISHED
TCP ncut1:1032 ncut1:4526 ESTABLISHED
TCP ncut1:1032 ncut1:4530 ESTABLISHED
TCP ncut1:1032 ncut1:4532 ESTABLISHED
TCP ncut1:1032 ncut1:4534 ESTABLISHED
TCP ncut1:1071 ncut1:0 LISTENING
TCP ncut1:2108 ncut1:1032 CLOSE_WAIT
TCP ncut1:2110 ncut1:1032 CLOSE_WAIT
TCP ncut1:4251 ncut1:1032 ESTABLISHED
TCP ncut1:4526 ncut1:1032 ESTABLISHED
TCP ncut1:4530 ncut1:1032 ESTABLISHED
TCP ncut1:4532 ncut1:1032 ESTABLISHED
TCP ncut1:4534 ncut1:1032 ESTABLISHED
TCP ncut1:19832 ncut1:0 LISTENING
TCP ncut1:19832 ncut1:1192 CLOSE_WAIT
TCP ncut1:netbios-ssn ncut1:0 LISTENING
TCP ncut1:1508 219.133.49.80:https CLOSE_WAIT
TCP ncut1:4252 211.100.30.67:https ESTABLISHED
TCP ncut1:4441 123.196.118.15:http FIN_WAIT_1
TCP ncut1:4461 202.10.69.17:http TIME_WAIT
TCP ncut1:4465 222.173.188.50:http TIME_WAIT
TCP ncut1:4469 119.254.4.67:http TIME_WAIT
TCP ncut1:4471 202.10.69.15:http TIME_WAIT
TCP ncut1:4473 202.10.69.17:http TIME_WAIT
TCP ncut1:4475 222.191.251.98:http TIME_WAIT
TCP ncut1:4497 bg-in-f165.google.com:http TIME_WAIT
TCP ncut1:4507 bg-in-f165.google.com:http TIME_WAIT
TCP ncut1:4509 222.173.188.50:http TIME_WAIT
TCP ncut1:4511 222.191.251.98:http TIME_WAIT
TCP ncut1:4513 116.114.22.7:http FIN_WAIT_1
TCP ncut1:4515 116.114.22.7:http FIN_WAIT_1
TCP ncut1:4527 211.100.26.76:http ESTABLISHED
TCP ncut1:4531 211.100.26.92:http ESTABLISHED
TCP ncut1:4533 211.100.26.85:http ESTABLISHED
TCP ncut1:4535 220.194.60.130:http SYN_SENT
UDP ncut1:microsoft-ds *:*
UDP ncut1:isakmp *:*
UDP ncut1:ms-sql-m *:*
UDP ncut1:3456 *:*
UDP ncut1:4000 *:*
UDP ncut1:4001 *:*
UDP ncut1:4002 *:*
UDP ncut1:4003 *:*
UDP ncut1:4004 *:*
UDP ncut1:4005 *:*
UDP ncut1:4500 *:*
UDP ncut1:29909 *:*
UDP ncut1:29919 *:*
UDP ncut1:29929 *:*
UDP ncut1:ntp *:*
UDP ncut1:1025 *:*
UDP ncut1:1462 *:*
UDP ncut1:1900 *:*
UDP ncut1:3549 *:*
UDP ncut1:3807 *:*
UDP ncut1:3892 *:*
UDP ncut1:ntp *:*
UDP ncut1:netbios-ns *:*
UDP ncut1:netbios-dgm *:*
UDP ncut1:1900 *:*
C:/>netstat -s
IP Statistics
Packets Received = 5378528
Received Header Errors = 738854
Received Address Errors = 23150
Datagrams Forwarded = 0
Unknown Protocols Received = 0
Received Packets Discarded = 0
Received Packets Delivered = 4616524
Output Requests = 132702
Routing Discards = 157
Discarded Output Packets = 0
Output Packet No Route = 0
Reassembly Required = 0
Reassembly Successful = 0
Reassembly Failures =
Datagrams Successfully Fragmented = 0
Datagrams Failing Fragmentation = 0
Fragments Created = 0
ICMP Statistics
Received Sent
Messages 693 4
Errors 0 0
Destination Unreachable 685 0
Time Exceeded 0 0
Parameter Problems 0 0
Source Quenches 0 0
Redirects 0 0
Echoes 4 0
Echo Replies 0 4
Timestamps 0 0
Timestamp Replies 0 0
Address Masks 0 0
Address Mask Replies 0 0
TCP Statistics
Active Opens = 597
Passive Opens = 135
Failed Connection Attempts = 107
Reset Connections = 91
Current Connections = 8
Segments Received = 106770
Segments Sent = 118431
Segments Retransmitted = 461
UDP Statistics
Datagrams Received = 4157136
No Ports = 351928
Receive Errors = 2
Datagrams Sent = 13809
2、Netstat的妙用
经常上网的人一般都使用ICQ的,不知道我们有没有被一些讨厌的人骚扰,想投诉却又不知从和下手?其实,我们只要知道对方的IP,就可以向他所属的ISP投诉了。但怎样才能通过ICQ知道对方的IP呢?如果对方在设置ICQ时选择了不显示IP地址,那我们是无法在信息栏中看到的。其实,我们只需要通过Netstat就可以很方便的做到这一点:当他通过ICQ或其他的工具与我们相连时(例如我们给他发一条ICQ信息或他给我们发一条信息),我们立刻在DOS 命令提示符下输入netstat -n或netstat -a就可以看到对方上网时所用的IP或ISP域名了,甚至连所用Port都完全暴露了。