Netstat Commands for Linux Network Management
netstat (network statistics) is a command line tool for monitoring network connections both incoming and outgoing as well as viewing routing tables, interface statistics etc. netstat is available on all Unix-like Operating Systems and also available on Windows OS as well. It is very useful in terms of network troubleshooting and performance measurement. netstat is one of the most basic network service debugging tools, telling you what ports are open and whether any programs are listening on ports.
Linux Netstat Command
This tool is very important and much useful for Linux network administrators as well as system administrators to monitor and troubleshoot their network related problems and determine network traffic performance. This article shows usages of netstat command with their examples which may be useful in daily operation.
You might also be interested in following article
1. Listing all the LISTENING Ports of TCP and UDP connections
Listing all ports (both TCP and UDP) using netstat -a option.
# netstat -a | more Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:sunrpc *:* LISTEN
tcp 0 52 192.168.0.2:ssh 192.168.0.1:egs ESTABLISHED
tcp 1 0 192.168.0.2:59292 www.gov.com:http CLOSE_WAIT
tcp 0 0 localhost:smtp *:* LISTEN
tcp 0 0 *:59482 *:* LISTEN
udp 0 0 *:35036 *:*
udp 0 0 *:npmp-local *:* Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 16972 /tmp/orbit-root/linc-76b-0-6fa08790553d6
unix 2 [ ACC ] STREAM LISTENING 17149 /tmp/orbit-root/linc-794-0-7058d584166d2
unix 2 [ ACC ] STREAM LISTENING 17161 /tmp/orbit-root/linc-792-0-546fe905321cc
unix 2 [ ACC ] STREAM LISTENING 15938 /tmp/orbit-root/linc-74b-0-415135cb6aeab
2. Listing TCP Ports connections
Listing only TCP (Transmission Control Protocol) port connections using netstat -at.
# netstat -at Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 localhost:ipp *:* LISTEN
tcp 0 0 localhost:smtp *:* LISTEN
tcp 0 52 192.168.0.2:ssh 192.168.0.1:egs ESTABLISHED
tcp 1 0 192.168.0.2:59292 www.gov.com:http CLOSE_WAIT
3. Listing UDP Ports connections
Listing only UDP (User Datagram Protocol ) port connections using netstat -au.
# netstat -au Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
udp 0 0 *:35036 *:*
udp 0 0 *:npmp-local *:*
udp 0 0 *:mdns *:*
4. Listing all LISTENING Connections
Listing all active listening ports connections with netstat -l.
# netstat -l Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:sunrpc *:* LISTEN
tcp 0 0 *:58642 *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
udp 0 0 *:35036 *:*
udp 0 0 *:npmp-local *:* Active UNIX domain sockets (only servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 16972 /tmp/orbit-root/linc-76b-0-6fa08790553d6
unix 2 [ ACC ] STREAM LISTENING 17149 /tmp/orbit-root/linc-794-0-7058d584166d2
unix 2 [ ACC ] STREAM LISTENING 17161 /tmp/orbit-root/linc-792-0-546fe905321cc
unix 2 [ ACC ] STREAM LISTENING 15938 /tmp/orbit-root/linc-74b-0-415135cb6aeab
5. Listing all TCP Listening Ports
Listing all active listening TCP ports by using option netstat -lt.
# netstat -lt Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:dctp *:* LISTEN
tcp 0 0 *:mysql *:* LISTEN
tcp 0 0 *:sunrpc *:* LISTEN
tcp 0 0 *:munin *:* LISTEN
tcp 0 0 *:ftp *:* LISTEN
tcp 0 0 localhost.localdomain:ipp *:* LISTEN
tcp 0 0 localhost.localdomain:smtp *:* LISTEN
tcp 0 0 *:http *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 *:https *:* LISTEN
6. Listing all UDP Listening Ports
Listing all active listening UDP ports by using option netstat -lu.
# netstat -lu Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
udp 0 0 *:39578 *:*
udp 0 0 *:meregister *:*
udp 0 0 *:vpps-qua *:*
udp 0 0 *:openvpn *:*
udp 0 0 *:mdns *:*
udp 0 0 *:sunrpc *:*
udp 0 0 *:ipp *:*
udp 0 0 *:60222 *:*
udp 0 0 *:mdns *:*
7. Listing all UNIX Listening Ports
Listing all active UNIX listening ports using netstat -lx.
# netstat -lx Active UNIX domain sockets (only servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 4171 @ISCSIADM_ABSTRACT_NAMESPACE
unix 2 [ ACC ] STREAM LISTENING 5767 /var/run/cups/cups.sock
unix 2 [ ACC ] STREAM LISTENING 7082 @/tmp/fam-root-
unix 2 [ ACC ] STREAM LISTENING 6157 /dev/gpmctl
unix 2 [ ACC ] STREAM LISTENING 6215 @/var/run/hald/dbus-IcefTIUkHm
unix 2 [ ACC ] STREAM LISTENING 6038 /tmp/.font-unix/fs7100
unix 2 [ ACC ] STREAM LISTENING 6175 /var/run/avahi-daemon/socket
unix 2 [ ACC ] STREAM LISTENING 4157 @ISCSID_UIP_ABSTRACT_NAMESPACE
unix 2 [ ACC ] STREAM LISTENING 60835836 /var/lib/mysql/mysql.sock
unix 2 [ ACC ] STREAM LISTENING 4645 /var/run/audispd_events
unix 2 [ ACC ] STREAM LISTENING 5136 /var/run/dbus/system_bus_socket
unix 2 [ ACC ] STREAM LISTENING 6216 @/var/run/hald/dbus-wsUBI30V2I
unix 2 [ ACC ] STREAM LISTENING 5517 /var/run/acpid.socket
unix 2 [ ACC ] STREAM LISTENING 5531 /var/run/pcscd.comm
8. Showing Statistics by Protocol
Displays statistics by protocol. By default, statistics are shown for the TCP, UDP, ICMP, and IP protocols. The -s parameter can be used to specify a set of protocols.
# netstat -s Ip:
2461 total packets received
0 forwarded
0 incoming packets discarded
2431 incoming packets delivered
2049 requests sent out
Icmp:
0 ICMP messages received
0 input ICMP message failed.
ICMP input histogram:
1 ICMP messages sent
0 ICMP messages failed
ICMP output histogram:
destination unreachable: 1
Tcp:
159 active connections openings
1 passive connection openings
4 failed connection attempts
0 connection resets received
1 connections established
2191 segments received
1745 segments send out
24 segments retransmited
0 bad segments received.
4 resets sent
Udp:
243 packets received
1 packets to unknown port received.
0 packet receive errors
281 packets sent
9. Showing Statistics by TCP Protocol
Showing statistics of only TCP protocol by using option netstat -st.
# netstat -st Tcp:
2805201 active connections openings
1597466 passive connection openings
1522484 failed connection attempts
37806 connection resets received
1 connections established
57718706 segments received
64280042 segments send out
3135688 segments retransmited
74 bad segments received.
17580 resets sent
10. Showing Statistics by UDP Protocol
# netstat -su Udp:
1774823 packets received
901848 packets to unknown port received.
0 packet receive errors
2968722 packets sent
11. Displaying Service name with PID
Displaying service name with their PID number, using option netstat -tp will display “PID/Program Name”.
# netstat -tp Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 192.168.0.2:ssh 192.168.0.1:egs ESTABLISHED 2179/sshd
tcp 1 0 192.168.0.2:59292 www.gov.com:http CLOSE_WAIT 1939/clock-applet
12. Displaying Promiscuous Mode
Displaying Promiscuous mode with -ac switch, netstat print the selected information or refresh screen every five second. Default screen refresh in every second.
# netstat -ac 5 | grep tcp tcp 0 0 *:sunrpc *:* LISTEN
tcp 0 0 *:58642 *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 localhost:ipp *:* LISTEN
tcp 0 0 localhost:smtp *:* LISTEN
tcp 1 0 192.168.0.2:59447 www.gov.com:http CLOSE_WAIT
tcp 0 52 192.168.0.2:ssh 192.168.0.1:egs ESTABLISHED
tcp 0 0 *:sunrpc *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 localhost:ipp *:* LISTEN
tcp 0 0 localhost:smtp *:* LISTEN
tcp 0 0 *:59482 *:* LISTEN
13. Displaying Kernel IP routing
Display Kernel IP routing table with netstat and route command.
# netstat -r Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
192.168.0.0 * 255.255.255.0 U 0 0 0 eth0
link-local * 255.255.0.0 U 0 0 0 eth0
default 192.168.0.1 0.0.0.0 UG 0 0 0 eth0
14. Showing Network Interface Transactions
Showing network interface packet transactions including both transferring and receiving packets with MTU size.
# netstat -i Kernel Interface table
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0 1500 0 4459 0 0 0 4057 0 0 0 BMRU
lo 16436 0 8 0 0 0 8 0 0 0 LRU
15. Showing Kernel Interface Table
Showing Kernel interface table, similar to ifconfig command.
# netstat -ie Kernel Interface table
eth0 Link encap:Ethernet HWaddr 00:0C:29:B4:DA:21
inet addr:192.168.0.2 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:feb4:da21/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:4486 errors:0 dropped:0 overruns:0 frame:0
TX packets:4077 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2720253 (2.5 MiB) TX bytes:1161745 (1.1 MiB)
Interrupt:18 Base address:0x2000 lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:8 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:480 (480.0 b) TX bytes:480 (480.0 b)
16. Displaying IPv4 and IPv6 Information
Displays multicast group membership information for both IPv4 and IPv6.
# netstat -g IPv6/IPv4 Group Memberships
Interface RefCnt Group
--------------- ------ ---------------------
lo 1 all-systems.mcast.net
eth0 1 224.0.0.251
eth0 1 all-systems.mcast.net
lo 1 ff02::1
eth0 1 ff02::202
eth0 1 ff02::1:ffb4:da21
eth0 1 ff02::1
17. Print Netstat Information Continuously
To get netstat information every few second, then use the following command, it will print netstat information continuously, say every few seconds.
# netstat -c Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 tecmint.com:http sg2nlhg007.shr.prod.s:36944 TIME_WAIT
tcp 0 0 tecmint.com:http sg2nlhg010.shr.prod.s:42110 TIME_WAIT
tcp 0 132 tecmint.com:ssh 115.113.134.3.static-:64662 ESTABLISHED
tcp 0 0 tecmint.com:http crawl-66-249-71-240.g:41166 TIME_WAIT
tcp 0 0 localhost.localdomain:54823 localhost.localdomain:smtp TIME_WAIT
tcp 0 0 localhost.localdomain:54822 localhost.localdomain:smtp TIME_WAIT
tcp 0 0 tecmint.com:http sg2nlhg010.shr.prod.s:42091 TIME_WAIT
tcp 0 0 tecmint.com:http sg2nlhg007.shr.prod.s:36998 TIME_WAIT
18. Finding non supportive Address
Finding un-configured address families with some useful information.
# netstat --verbose netstat: no support for `AF IPX' on this system.
netstat: no support for `AF AX25' on this system.
netstat: no support for `AF X25' on this system.
netstat: no support for `AF NETROM' on this system.
19. Finding Listening Programs
Find out how many listening programs running on a port.
# netstat -ap | grep http tcp 0 0 *:http *:* LISTEN 9056/httpd
tcp 0 0 *:https *:* LISTEN 9056/httpd
tcp 0 0 tecmint.com:http sg2nlhg008.shr.prod.s:35248 TIME_WAIT -
tcp 0 0 tecmint.com:http sg2nlhg007.shr.prod.s:57783 TIME_WAIT -
tcp 0 0 tecmint.com:http sg2nlhg007.shr.prod.s:57769 TIME_WAIT -
tcp 0 0 tecmint.com:http sg2nlhg008.shr.prod.s:35270 TIME_WAIT -
tcp 0 0 tecmint.com:http sg2nlhg009.shr.prod.s:41637 TIME_WAIT -
tcp 0 0 tecmint.com:http sg2nlhg009.shr.prod.s:41614 TIME_WAIT -
unix 2 [ ] STREAM CONNECTED 88586726 10394/httpd
20. Displaying RAW Network Statistics
# netstat --statistics --raw Ip:
62175683 total packets received
52970 with invalid addresses
0 forwarded
Icmp:
875519 ICMP messages received
destination unreachable: 901671
echo request: 8
echo replies: 16253
IcmpMsg:
InType0: 83
IpExt:
InMcastPkts: 117
That’s it, If you are looking for more information and options about netstat command, refer netstat manual docs or use man netstat command to know all the information. If we’ve missed anything in the list, please inform us using our comment section below. So, we could keep updating this list based on your comments.
1、通过netstat命令可以查询所有的tcp连接状态：
# netstat -anp | grep tcp
2、结合awk命令，统计出tcp连接不同状态的数量：
# netstat -na | awk '/^tcp/ {++S[$NF]} END {for(a in S) print a, S[a]}'
TIME_WAIT 4
ESTABLISHED 6
LISTEN 12
SYN_RECV 表示正在等待处理的请求数；
ESTABLISHED 表示正常数据传输状态；
TIME_WAIT 表示处理完毕，等待超时结束的请求数
To find out the number of connections from an IP.
netstat -ntu | awk ‘{print $5}’ | cut -d: -f1 | uniq -c | sort -n
In the above command AWK print out the 5th column of netstat output, the CUT part cuts every line at the first space character and take the first piece, than we just have to SORT the results and take the UNIQUE values.
To find out the largest number of established connections.
netstat -na | grep ‘ESTABLISHED’ | awk ‘{print $4}’ | cut -d: -f1 | uniq -c | sort -rn
In the above command GREP is been used to find the line containing “ESTABLISHED“, AWK print out the 4th column of netstat output. CUT part cuts every line at the first space character and take the first piece, than we just have to SORT the results and take the UNIQUE values.
To check max number of connections to server.
netstat -nap |grep ‘tcp\|udp’ | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n | tail
Netstat Commands for Linux Network Management的更多相关文章
- Linux Network Management
Linux网络管理 (YouTube视频教程) ISO/OSI七层模型 ISO: The International Organization for Standardization 国际标准化组织 ...
- Performance Tuning Using Linux Process Management Commands
[root@bigdata-server-02 /]# ps --help all Usage: ps [options] Basic options: -A, -e all processes -a ...
- Queueing in the Linux Network Stack !!!!!!!!!!!!!!!
https://www.coverfire.com/articles/queueing-in-the-linux-network-stack/ Queueing in the Linux Networ ...
- Netruon 理解（12）：使用 Linux bridge 将 Linux network namespace 连接外网
学习 Neutron 系列文章: (1)Neutron 所实现的虚拟化网络 (2)Neutron OpenvSwitch + VLAN 虚拟网络 (3)Neutron OpenvSwitch + GR ...
- Simple Network Management Protocol - SNMP Tutorial
30.9 Simple Network Management Protocol Network management protocols specify communication between t ...
- linux network name space
linux network namespace概念类似于网络中的 VRF (virtual routing and forwarding).但是,你不知道VRF的概念也没关系,下面我们通过一个简单的介 ...
- Network management system scheduling for low power and lossy networks
In one embodiment, a network management system (NMS) determines an intent to initialize a request-re ...
- Netruon 理解（11）：使用 NAT 将 Linux network namespace 连接外网
学习 Neutron 系列文章: (1)Neutron 所实现的虚拟化网络 (2)Neutron OpenvSwitch + VLAN 虚拟网络 (3)Neutron OpenvSwitch + GR ...
- SNMP: Simple? Network Management Protocol（转）
转自:http://www.rane.com/note161.html An SNMP Overview The Message Format The Actual Bytes Introductio ...
随机推荐
- Entity Framework 6.x 学习之 - 创建带连接表的实体模型 with Database First
一.Modeling a Many-to-Many Relationship with No Payload 1. 创建数据库表 CREATE TABLE [Album] ( , ), ) COLLA ...
- mysqlbinlog命令介绍及实战
MySQL的binlog日志的作用 - 1:用来记录mysql内部增删改查等对MySQL数据有更新内容的记录.像show和select一般不会记录 - 2:mysqlbinlog --base64-o ...
- Java RMI 框架（远程方法调用）
转自:http://haolloyin.blog.51cto.com/1177454/332426 RMI(即Remote Method Invoke 远程方法调用).在Java中,只要一个类exte ...
- 团队作业6——展示博客（alpha阶段）
Deadline: 2018-5-9 10:00PM,以提交至班级博客时间为准. 5.10周四实验课将进行alpha阶段项目复审,请在5.10之前,根据以下要求,完成alpha版本的展示,并以此作为参 ...
- Docker 使用官方镜像
Docker 使用官方镜像 如何使用官方镜像 Docker 中国官方镜像加速可通过 registry.docker-cn.com 访问.目前该镜像库只包含流行的公有镜像,而私有镜像仍需要从美国镜像库中 ...
- js设计模式总结1
js设计模式有很多种,知道不代表会用,更不代表理解,为了更好的理解每个设计模式,对每个设计模式进行总结,以后只要看到总结,就能知道该设计模式的作用,以及模式存在的优缺点,使用范围. 本文主要参考张容铭 ...
- H5+App开发框架汇总
MUI:http://dcloudio.github.io/mui/(使用H5+app模式,号称是最接近原生,但是目前在手机和电脑浏览器无法使用) app-framework:http://app-f ...
- Repeater控件添加onmouseover和onmouseout事件
网友有问题,在Repeater控件中,需要添加onmouseover和onmouseout事件功能.Insus.NET有叫他参考<onmouseover和onmouseout在Repeater控 ...
- Java使用递归的方法进行冒泡排序
对于递归来说,我只了解它的概念,没有具体使用过,近期也是尝试着用递归写了一下冒泡排序和大家分享,希望能帮助大家了解递归 递归是什么?通俗的讲:在方法内部调用自己 花了几分钟整出来的,下面是递归冒泡排序 ...
- Java基础——GUI编程（二）
一.事件监听机制 -- 事件源:awt 或swing包中的那些图形界面组件,即发生事件的组件 -- 事件:Event 用户对组件的一个操作 -- 监听器:Listener 负责处理事件的方法 二. ...