[Linux] netstat命令和ss命令

1. netstat输出结果

netstat的输出结果可以分为两个部分
Part1 => Active Internet connections 有源TCP连接，其中"Recv-Q"和"Send-Q"指接收队列和发送队列；这些数字如果不为0则表示软件包正在队列中堆积。
Part2 => Active UNIX domain sockets 有源Unix域套接口，只能用于本机通信，性能可以提高一倍。

注：netstat默认不显示udp协议、不显示状态为LISTEN

[root@xxserver bin]# netstat
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp       32      0 HA-node1-cluster-he:35762 HA-node1-cluster-h:efi-mg CLOSE_WAIT
tcp       32      0 HA-node1-cluster-he:48560 HA-node2-cluster-h:efi-mg CLOSE_WAIT
tcp        0      0 xxserver:ssh             169.177.166.247:53827   ESTABLISHED
……
tcp6       0      0 localhost:44208         localhost:mysql         ESTABLISHED
tcp6       0      0 localhost:61613         localhost:34190         ESTABLISHED
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags       Type       State         I-Node   Path
unix  3      [ ]         DGRAM                    11527    /run/systemd/notify
unix  2      [ ]         DGRAM 
……
unix  3      [ ]         STREAM     CONNECTED     32670    /run/dbus/system_bus_socket

 

2.常用参数

-a 显示所有选项，默认不显示LISTEN相关
-t 仅显示tcp相关选项
-u 仅显示udp相关选项
-w 仅显示RAW相关选项
-x 仅显示unix相关选项
-n 拒绝显示别名，能显示数字的全部转化成数字
-l 仅列出有在 Listen (监听) 的服务状态
-p 显示正在使用Socket的程序名和PID
-r 显示路由表
-i 显示网络接口列表
-s 按各个协议进行统计
-c 每隔一个固定时间执行该netstat命令

举例：

(1) -a 列出所有端口(包括监听和未监听的)
netstat -a  列出所有端口
netstat -at 列出所有 tcp 端口 
netstat -au 列出所有 udp 端口

(2) -l 只显示监听端口
只显示监听端口 netstat -l
只列出所有监听 tcp 端口 netstat -lt
只列出所有监听 udp 端口 netstat -lu
只列出所有监听 UNIX 端口 netstat -lx

说明：为什么udp和raw的State不打印LISTEN? 查看 man netstat解释如下

Since there are no states in raw mode and usually no states used in UDP and UDPLite, this column may be left blank.

[root@xxserver bin]# netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 0.0.0.0:rsync           0.0.0.0:*               LISTEN
tcp6       0      0 [::]:42242              [::]:*                  LISTEN
……
udp        0      0 HA-node1-ne:45334         0.0.0.0:*
udp6       0      0 192.169.4.202:snmptrap  [::]:*
raw6       0      0 [::]:ipv6-icmp          [::]:*                  7
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node   Path
unix  2      [ ACC ]     STREAM     LISTENING     42703    private/relay
unix  2      [ ACC ]     STREAM     LISTENING     42712    private/retry
……

(3) netstat -s 显示每个协议的统计信息

(4) netstat -p 输出中显示PID和进程名称 

[root@xxserver ~]# netstat -ap
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN      22533/sshd
udp6       0      0 192.169.4.202:snmptrap  [::]:*                              26680/java
……

(5) netstat -n 输出中不显示主机、端口和用户名 (host, port or user)

[root@xxserver ~]# netstat -anp | grep ssh
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      22533/sshd
udp6       0      0 192.169.4.202:162       :::*                                26680/java
……

说明：如果仅不想让其中一个被显示，使用以下命令
# netsat -a --numeric-ports
# netsat -a --numeric-hosts
# netsat -a --numeric-users

(6) netstat -c 持续输出netstat信息
默认1秒打印一次 netstat -auc | grep snmp
设置5秒打印一次 netstat -auc 5 | grep snmp

[root@xxxserver ~]# netstat -auc | grep snmp
Tue Mar 30 17:08:23 CST 2021
udp6       0      0 192.169.4.202:snmptrap  [::]:*
udp6       0      0 192.169.4.202:snmptrap  [::]:*
udp6       0      0 192.169.4.202:snmptrap  [::]:*
udp6       0      0 192.169.4.202:snmptrap  [::]:*
^C
[root@xxxserver ~]# 

(7) 显示路由信息 netstat -r 输出结果同route

(8) 显示网络接口列表 netstat -i，netstat -ie输出结果同ifconfig

[root@xxxserver ~]# netstat -i
Kernel Interface table
Iface             MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
ens164           1500  4649150      0     30 0       6231154      0      0      0 BMRU
ens192           1500  4596573      0     29 0       2720436      0      0      0 BMRU
lo              65536 16194199      0      0 0      16194199      0      0      0 LRU
virbr0           1500        0      0      0 0             0      0      0      0 BMU
[root@xxxserver ~]#

 

3.套接口的State

Active Internet connections
   State
       The  state  of the socket. Since there are no states in raw mode and usually no states used in UDP and
       UDPLite, this column may be left blank. Normally this can be one of several values:

       ESTABLISHED
              The socket has an established connection.
       SYN_SENT
              The socket is actively attempting to establish a connection.
       SYN_RECV
              A connection request has been received from the network.
       FIN_WAIT1
              The socket is closed, and the connection is shutting down.
       FIN_WAIT2
              Connection is closed, and the socket is waiting for a shutdown from the remote end.
       TIME_WAIT
              The socket is waiting after close to handle packets still in the network.
       CLOSE  The socket is not being used.
       CLOSE_WAIT
              The remote end has shut down, waiting for the socket to close.
       LAST_ACK
              The remote end has shut down, and the socket is closed. Waiting for acknowledgement.
       LISTEN The socket is listening for incoming connections.  Such sockets are not included in the  output
              unless you specify the --listening (-l) or --all (-a) option.
       CLOSING
              Both sockets are shut down but we still don't have all our data sent.
       UNKNOWN
              The state of the socket is unknown.

各个状态解释可参考另一篇博文，TCP的连接建立和释放 https://blog.csdn.net/wy_hhxx/article/details/103980331

Active UNIX domain Sockets
   State
       This field will contain one of the following Keywords:

       FREE   The socket is not allocated
       LISTENING
              The socket is listening for a connection request.  Such sockets are only included in the output
              if you specify the --listening (-l) or --all (-a) option.
       CONNECTING
              The socket is about to establish a connection.
       CONNECTED
              The socket is connected.
       DISCONNECTING
              The socket is disconnecting.
       (empty)
              The socket is not connected to another one.
       UNKNOWN
              This state should never happen.

 

参考资料：

Linux netstat命令详解及state的含义 https://blog.csdn.net/libaineu2004/article/details/82465215

========================================================================  

ss命令，偷个懒 囧

ss比netstat快的主要原因是，netstat是遍历/proc下面每个PID目录，ss直接读/proc/net下面的统计信息。所以ss执行的时候消耗资源以及消耗的时间都比netstat少很多。

ss命令和netstat命令比较   https://cloud.tencent.com/developer/article/1026969
Linux网络状态工具ss命令使用详解   http://www.ttlsa.com/linux-command/ss-replace-netstat/