linux netstat 命令详解

发布时间：2023-09-06 01:24责任编辑：郭大石关键词：暂无标签

简介

Netstat 命令用于显示各种网络相关信息，如网络连接，路由表，接口状态 (Interface Statistics)，masquerade 连接，多播成员 (Multicast Memberships) 等等。

输出信息含义

执行netstat后，其输出结果为

[root@localhost net]# netstat
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 52 localhost.localdoma:ssh 192.168.1.120:56520 ESTABLISHED
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ] DGRAM 8805 /run/systemd/notify
unix 2 [ ] DGRAM 8807 /run/systemd/cgroups-agent
unix 5 [ ] DGRAM 8825 /run/systemd/journal/socket

从整体上看，netstat的输出结果可以分为两个部分：

一个是Active Internet connections，称为有源TCP连接，其中"Recv-Q"和"Send-Q"指的是接收队列和发送队列。这些数字一般都应该是0。如果不是则表示软件包正在队列中堆积。这种情况只能在非常少的情况见到。

另一个是Active UNIX domain sockets，称为有源Unix域套接口(和网络套接字一样，但是只能用于本机通信，性能可以提高一倍)。
Proto显示连接使用的协议,RefCnt表示连接到本套接口上的进程号,Types显示套接口的类型,State显示套接口当前的状态,Path表示连接到套接口的其它进程使用的路径名。

常见参数

-a (all)显示所有选项，默认不显示LISTEN相关
-t (tcp)仅显示tcp相关选项
-u (udp)仅显示udp相关选项
-n 拒绝显示别名，能显示数字的全部转化成数字。
-l 仅列出有在 Listen (监听) 的服務状态

-p 显示建立相关链接的程序名
-r 显示路由信息，路由表
-e 显示扩展信息，例如uid等
-s 按各个协议进行统计
-c 每隔一个固定时间，执行该netstat命令。

提示：LISTEN和LISTENING的状态只有用-a或者-l才能看到

实用命令实例

1. 列出所有端口 (包括监听和未监听的)

[root@localhost net]# netstat -a
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN
tcp 0 0 localhost:smtp 0.0.0.0:* LISTEN
tcp 0 52 localhost.localdoma:ssh 192.168.1.120:56520 ESTABLISHED
tcp6 0 0 [::]:ssh [::]:* LISTEN
tcp6 0 0 localhost:smtp [::]:* LISTEN
raw6 0 0 [::]:ipv6-icmp [::]:* 7
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ] DGRAM 8805 /run/systemd/notify
unix 2 [ ] DGRAM 8807 /run/systemd/cgroups-agent
unix 2 [ ACC ] STREAM LISTENING 11629 /run/systemd/private
unix 2 [ ACC ] STREAM LISTENING 20594 /var/run/NetworkManager/private-dhcp
unix 2 [ ACC ] SEQPACKET LISTENING 11638 /run/udev/control
unix 2 [ ACC ] STREAM LISTENING 8822 /run/systemd/journal/stdout
unix 5 [ ] DGRAM 8825 /run/systemd/journal/socket
unix 13 [ ] DGRAM 8827 /dev/log
unix 2 [ ACC ] STREAM LISTENING 12163 /var/run/dbus/system_bus_socket
unix 2 [ ] DGRAM 11669 /run/systemd/shutdownd
unix 2 [ ACC ] STREAM LISTENING 18008 public/pickup
unix 2 [ ACC ] STREAM LISTENING 18012 public/cleanup
unix 2 [ ACC ] STREAM LISTENING 18015 public/qmgr
unix 2 [ ACC ] STREAM LISTENING 18019 private/tlsmgr
unix 2 [ ACC ] STREAM LISTENING 18022 private/rewrite
unix 2 [ ACC ] STREAM LISTENING 18025 private/bounce

列出所有 tcp 端口 netstat -at

[root@localhost net]# netstat -at
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN
tcp 0 0 localhost:smtp 0.0.0.0:* LISTEN
tcp 0 52 localhost.localdoma:ssh 192.168.1.120:56520 ESTABLISHED
tcp6 0 0 [::]:ssh [::]:* LISTEN
tcp6 0 0 localhost:smtp [::]:* LISTEN

列出所有 udp 端口 netstat -au

[root@localhost net]# netstat -au
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State

2. 列出所有处于监听状态的 Sockets

只显示监听端口 netstat -l

[root@localhost net]# netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN
tcp 0 0 localhost:smtp 0.0.0.0:* LISTEN
tcp6 0 0 [::]:ssh [::]:* LISTEN
tcp6 0 0 localhost:smtp [::]:* LISTEN
raw6 0 0 [::]:ipv6-icmp [::]:* 7
Active UNIX domain sockets (only servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 11629 /run/systemd/private
unix 2 [ ACC ] STREAM LISTENING 20594 /var/run/NetworkManager/private-dhcp
unix 2 [ ACC ] SEQPACKET LISTENING 11638 /run/udev/control
unix 2 [ ACC ] STREAM LISTENING 8822 /run/systemd/journal/stdout
unix 2 [ ACC ] STREAM LISTENING 12163 /var/run/dbus/system_bus_socket
unix 2 [ ACC ] STREAM LISTENING 18008 public/pickup
unix 2 [ ACC ] STREAM LISTENING 18012 public/cleanup
unix 2 [ ACC ] STREAM LISTENING 18015 public/qmgr
unix 2 [ ACC ] STREAM LISTENING 18019 private/tlsmgr
unix 2 [ ACC ] STREAM LISTENING 18022 private/rewrite
unix 2 [ ACC ] STREAM LISTENING 18025 private/bounce
unix 2 [ ACC ] STREAM LISTENING 18028 private/defer
unix 2 [ ACC ] STREAM LISTENING 18031 private/trace
unix 2 [ ACC ] STREAM LISTENING 18034 private/verify
unix 2 [ ACC ] STREAM LISTENING 18037 public/flush
unix 2 [ ACC ] STREAM LISTENING 18040 private/proxymap
unix 2 [ ACC ] STREAM LISTENING 18043 private/proxywrite
unix 2 [ ACC ] STREAM LISTENING 18046 private/smtp
unix 2 [ ACC ] STREAM LISTENING 18049 private/relay
unix 2 [ ACC ] STREAM LISTENING 18052 public/showq
unix 2 [ ACC ] STREAM LISTENING 18055 private/error
unix 2 [ ACC ] STREAM LISTENING 18058 private/retry
unix 2 [ ACC ] STREAM LISTENING 18061 private/discard
unix 2 [ ACC ] STREAM LISTENING 18064 private/local
unix 2 [ ACC ] STREAM LISTENING 18067 private/virtual
unix 2 [ ACC ] STREAM LISTENING 18070 private/lmtp
unix 2 [ ACC ] STREAM LISTENING 18073 private/anvil
unix 2 [ ACC ] STREAM LISTENING 18076 private/scache

只列出所有监听 tcp 端口 netstat -lt

[root@localhost net]# netstat -lt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN
tcp 0 0 localhost:smtp 0.0.0.0:* LISTEN
tcp6 0 0 [::]:ssh [::]:* LISTEN
tcp6 0 0 localhost:smtp [::]:* LISTEN

只列出所有监听 udp 端口 netstat -lu

[root@localhost net]# netstat -lu
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State

只列出所有监听 UNIX 端口 netstat -lx

[root@localhost net]# netstat -lx
Active UNIX domain sockets (only servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 11629 /run/systemd/private
unix 2 [ ACC ] STREAM LISTENING 20594 /var/run/NetworkManager/private-dhcp
unix 2 [ ACC ] SEQPACKET LISTENING 11638 /run/udev/control
unix 2 [ ACC ] STREAM LISTENING 8822 /run/systemd/journal/stdout
unix 2 [ ACC ] STREAM LISTENING 12163 /var/run/dbus/system_bus_socket
unix 2 [ ACC ] STREAM LISTENING 18008 public/pickup
unix 2 [ ACC ] STREAM LISTENING 18012 public/cleanup
unix 2 [ ACC ] STREAM LISTENING 18015 public/qmgr
unix 2 [ ACC ] STREAM LISTENING 18019 private/tlsmgr
unix 2 [ ACC ] STREAM LISTENING 18022 private/rewrite
unix 2 [ ACC ] STREAM LISTENING 18025 private/bounce
unix 2 [ ACC ] STREAM LISTENING 18028 private/defer
unix 2 [ ACC ] STREAM LISTENING 18031 private/trace
unix 2 [ ACC ] STREAM LISTENING 18034 private/verify
unix 2 [ ACC ] STREAM LISTENING 18037 public/flush
unix 2 [ ACC ] STREAM LISTENING 18040 private/proxymap
unix 2 [ ACC ] STREAM LISTENING 18043 private/proxywrite
unix 2 [ ACC ] STREAM LISTENING 18046 private/smtp
unix 2 [ ACC ] STREAM LISTENING 18049 private/relay
unix 2 [ ACC ] STREAM LISTENING 18052 public/showq
unix 2 [ ACC ] STREAM LISTENING 18055 private/error
unix 2 [ ACC ] STREAM LISTENING 18058 private/retry
unix 2 [ ACC ] STREAM LISTENING 18061 private/discard
unix 2 [ ACC ] STREAM LISTENING 18064 private/local
unix 2 [ ACC ] STREAM LISTENING 18067 private/virtual
unix 2 [ ACC ] STREAM LISTENING 18070 private/lmtp
unix 2 [ ACC ] STREAM LISTENING 18073 private/anvil
unix 2 [ ACC ] STREAM LISTENING 18076 private/scache

3. 显示每个协议的统计信息

显示所有端口的统计信息 netstat -s

[root@localhost net]# netstat -s
Ip:
9682 total packets received
0 forwarded
0 incoming packets discarded
9669 incoming packets delivered
1675 requests sent out
Icmp:
33 ICMP messages received
0 input ICMP message failed.
ICMP input histogram:
destination unreachable: 31
echo replies: 2
37 ICMP messages sent
0 ICMP messages failed
ICMP output histogram:
destination unreachable: 31
echo request: 6
IcmpMsg:
InType0: 2
InType3: 31
OutType3: 31
OutType8: 6
Tcp:
0 active connections openings
1 passive connection openings
0 failed connection attempts
0 connection resets received
1 connections established
2517 segments received
1723 segments send out
0 segments retransmited
0 bad segments received.
0 resets sent
Udp:
0 packets received
30 packets to unknown port received.
0 packet receive errors
30 packets sent
0 receive buffer errors
0 send buffer errors
UdpLite:
TcpExt:
29 delayed acks sent
1 packets directly queued to recvmsg prequeue.
746 packet headers predicted
396 acknowledgments not containing data payload received
918 predicted acknowledgments
IPReversePathFilter: 3
TCPRcvCoalesce: 1
TCPAutoCorking: 5
TCPOrigDataSent: 1644
IpExt:
InNoRoutes: 10
InBcastPkts: 7089
InOctets: 838424
OutOctets: 526211
InBcastOctets: 653606
InNoECTPkts: 9682

显示 TCP 或 UDP 端口的统计信息 netstat -st 或 -su

[root@localhost net]# netstat -st
IcmpMsg:
InType0: 2
InType3: 31
OutType3: 31
OutType8: 6
Tcp:
0 active connections openings
1 passive connection openings
0 failed connection attempts
0 connection resets received
1 connections established
2625 segments received
1801 segments send out
0 segments retransmited
0 bad segments received.
0 resets sent
UdpLite:
TcpExt:
32 delayed acks sent
1 packets directly queued to recvmsg prequeue.
790 packet headers predicted
410 acknowledgments not containing data payload received
966 predicted acknowledgments
IPReversePathFilter: 3
TCPRcvCoalesce: 1
TCPAutoCorking: 5
TCPOrigDataSent: 1716
IpExt:
InNoRoutes: 10
InBcastPkts: 7400
InOctets: 874918
OutOctets: 535207
InBcastOctets: 681848
InNoECTPkts: 10101

[root@localhost net]# netstat -su
IcmpMsg:
InType0: 2
InType3: 31
OutType3: 31
OutType8: 6
Udp:
0 packets received
30 packets to unknown port received.
0 packet receive errors
30 packets sent
0 receive buffer errors
0 send buffer errors
UdpLite:
IpExt:
InNoRoutes: 10
InBcastPkts: 7540
InOctets: 895035
OutOctets: 541059
InBcastOctets: 694911
InNoECTPkts: 10343

4. 在 netstat 输出中显示 PID 和进程名称 netstat -p

netstat -p 可以与其它开关一起使用，就可以添加 “PID/进程名称” 到 netstat 输出中，这样 debugging 的时候可以很方便的发现特定端口运行的程序。

[root@localhost net]# netstat -pt
‘Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 52 localhost.localdoma:ssh 192.168.1.120:56520 ESTABLISHED 3047/sshd: root@pts

5. 在 netstat 输出中不显示主机，端口和用户名 (host, port or user)

当你不想让主机，端口和用户名显示，使用 netstat -n。将会使用数字代替那些名称。

同样可以加速输出，因为不用进行比对查询。

[root@localhost net]# netstat -an
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
tcp 0 52 192.168.1.205:22 192.168.1.120:56520 ESTABLISHED
tcp6 0 0 :::22 :::* LISTEN
tcp6 0 0 ::1:25 :::* LISTEN
raw6