linux netstat 命令

netstat 查看联机相关信息
常用参数：
-a (all)所有进程
-l 值显示listen状态的连接
-n 不使用主机名与服务名称，使用 IP 与 port number
-t 只显示TCP连接
-u 只显示UDP连接
-p 列出pid与程序名
-r 列出路由表 route table
-c 可以设定几秒钟后自动更新一次，例如 -c 5 每五秒更新一次网络状态的显示

> netstat -anp |more
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name   
tcp        0      0 127.0.0.1:9000              0.0.0.0:*                   LISTEN      25742/php-fpm       
tcp        0      0 0.0.0.0:3690                0.0.0.0:*                   LISTEN      19173/svnserve      
tcp        0      0 0.0.0.0:3306                0.0.0.0:*                   LISTEN      14108/mysqld        
tcp        0      0 0.0.0.0:80                  0.0.0.0:*                   LISTEN      4130/nginx          
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      1409/sshd           
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      1511/master         
tcp      401      0 127.0.0.1:39450             127.0.0.1:80	            CLOSE_WAIT  28512/AliYunDunUpda                   
tcp        0     48 127.0.0.1:22                127.0.0.1:50535             ESTABLISHED 22850/sshd           
tcp        0      0 127.0.0.1:60964             127.0.0.1:80                ESTABLISHED 28571/AliYunDun  

  
...

返回列说明：
Proto：联机协议
Recv-Q：发送bytes
Send-Q：接收bytes
Local Address ：本地地址
Foreign Address：远程地址 ip:port
State：状态，常用状态
ESTABLISED 已建立连接
SYN_SENT：尝试建立一个连接（去远端）
SYN_RECV：接收到一个连接请求
TIME_WAIT：该socket已挂断，但 socket 还在网络上等待传输完数据结束
CLOSE_WAIT：远程连接已关闭，等待socket关闭
CLOSED：socket未被使用
LISTEN：监听状态
PID/Program name：程序pid/名称

查看本机开了多少端口

> netstat -tulnp 
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name   
tcp        0      0 127.0.0.1:9000              0.0.0.0:*                   LISTEN      25742/php-fpm       
tcp        0      0 0.0.0.0:3690                0.0.0.0:*                   LISTEN      19173/svnserve      
tcp        0      0 0.0.0.0:3306                0.0.0.0:*                   LISTEN      14108/mysqld        
tcp        0      0 0.0.0.0:80                  0.0.0.0:*                   LISTEN      4130/nginx          
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      1409/sshd           
...

查看端口被哪个程序占用

> netstat -anp|grep "3306"
tcp        0      0 0.0.0.0:3306                0.0.0.0:*                   LISTEN      14108/mysqld 

以程序名查看所占用的端口

> netstat -anp|grep mysql
tcp        0      0 0.0.0.0:3306                0.0.0.0:*                   LISTEN      14108/mysqld 

查看路由信息

> netstat -r
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
x.x.x.x     *			255.255.240.0   U         0 0          0 eth0
link-local      *               255.255.0.0     U         0 0          0 eth0
default         x.x.x.x		0.0.0.0         UG        0 0          0 eth0

查看端口连接数：

> netstat -nt|awk '{print $4}'|sort|uniq -c|sort -nr
     35 127.0.0.1:10049
      7 127.0.0.1:20028
      7 127.0.0.1:18130
      7 127.0.0.1:18112
      7 127.0.0.1:14028
      6 127.0.0.1:1527
      6 127.0.0.1:28116
      5 127.0.0.1:20044
      5 127.0.0.1:20009
      5 127.0.0.1:20002
      5 127.0.0.1:18109
      5 127.0.0.1:18104
      5 127.0.0.1:10051
      5 127.0.0.1:10002
      4 127.0.0.1:28113
      4 127.0.0.1:28104
      4 127.0.0.1:11007
      4 127.0.0.1:10035
      3 127.0.0.1:22
      2 127.0.0.1:33338
      2 127.0.0.1:18146
      1 (w/o
      1 Local
      1 127.0.0.1:41959
      1 127.0.0.1:41291
      1 127.0.0.1:41290
      1 127.0.0.1:36075

统计信息：

> netstat -s
Ip:
    3609211802 total packets received
    245501 with invalid addresses
    0 forwarded
    0 incoming packets discarded
    1198596643 incoming packets delivered
    860787782 requests sent out
    304 dropped because of missing route
    74 reassemblies required
    11 packets reassembled ok
    11 fragments received ok
    74 fragments created
Icmp:
    11838 ICMP messages received
    576 input ICMP message failed.
    ICMP input histogram:
        destination unreachable: 4266
        timeout in transit: 244
        redirects: 3202
        echo requests: 2486
        echo replies: 1631
        timestamp request: 5
        address mask request: 2
    37730 ICMP messages sent
    0 ICMP messages failed
    ICMP output histogram:
        destination unreachable: 4304
        echo request: 30935
        echo replies: 2486
        timestamp replies: 5
IcmpMsg:
        InType0: 1631
        InType3: 4266
        InType5: 3202
        InType8: 2486
        InType11: 244
        InType13: 5
        InType15: 2
        InType17: 2
        OutType0: 2486
        OutType3: 4304
        OutType8: 30935
        OutType14: 5
Tcp:
    3731195 active connections openings
    71957398 passive connection openings
    344124268 failed connection attempts
    162984 connection resets received
    33 connections established
    1183422017 segments received
    810208122 segments send out
    49410639 segments retransmited
    6759 bad segments received.
    126582702 resets sent
Udp:
    1126773 packets received
    344 packets to unknown port received.
    0 packet receive errors
    1131427 packets sent
.....