[关闭]
@yangwenbo 2023-02-10T17:41:16.000000Z 字数 12879 阅读 205

centos7系统

netstat命令详解

1、简介

Netstat 命令用于显示各种网络相关信息,如网络连接,路由表,接口状态 (Interface Statistics),masquerade 连接,多播成员 (Multicast Memberships) 等等。

2、安装telnet

2.1 下载安装包

rpm包下载位置:http://vault.centos.org/6.3/os/x86_64/Packages/

  1. [root@ywb ~]# cd rpm/
  2. [root@ywb rpm]# ll
  3. 总用量 224
  4. -rw-r--r-- 1 root root 59040 10 17 13:24 telnet-0.17-47.el6.x86_64.rpm
  5. -rw-r--r-- 1 root root 37360 10 17 13:24 telnet-server-0.17-47.el6.x86_64.rpm
  6. -rw-r--r-- 1 root root 123624 10 17 13:24 xinetd-2.3.14-34.el6.x86_64.rpm

2.2 安装telnet相关

  1. [root@ywb rpm]# rpm -ivh xinetd-2.3.14-34.el6.x86_64.rpm
  2. [root@ywb rpm]# rpm -ivh telnet-0.17-47.el6.x86_64.rpm
  3. [root@ywb rpm]# rpm -ivh telnet-server-0.17-47.el6.x86_64.rpm

2.3 检查安装结果

  1. [root@ywb rpm]# rpm -qa | grep xinetd
  2. xinetd-2.3.14-34.el6.x86_64
  3. [root@ywb rpm]# rpm -qa | grep telnet
  4. telnet-0.17-47.el6.x86_64
  5. telnet-server-0.17-47.el6.x86_64

2.4 telnet服务之后,默认是不开启服务,修改文件/etc/xinetd.d/telnet来开启服务

  1. [root@ywb rpm]# vi /etc/xinetd.d/telnet
  2. [root@ywb rpm]# cat /etc/xinetd.d/telnet
  3. # default: on
  4. # description: The telnet server serves telnet sessions; it uses \
  5. # unencrypted username/password pairs for authentication.
  6. service telnet
  7. {
  8. flags = REUSE
  9. socket_type = stream
  10. wait = no
  11. user = root
  12. server = /usr/sbin/in.telnetd
  13. log_on_failure += USERID
  14. disable = no #这里把yes修改成no
  15. }

2.5 启动telnet和依赖的xinetd服务

  1. [root@ywb rpm]# systemctl start xinetd

2.6 查看启动状态

  1. [root@ywb rpm]# systemctl status xinetd
  2. xinetd.service - LSB: start and stop xinetd
  3. Loaded: loaded (/etc/rc.d/init.d/xinetd; bad; vendor preset: enabled)
  4. Active: active (running) since 2019-10-17 13:41:35 CST; 2s ago
  5. Docs: man:systemd-sysv-generator(8)
  6. Process: 7477 ExecStart=/etc/rc.d/init.d/xinetd start (code=exited, status=0/SUCCESS)
  7. Main PID: 7484 (xinetd)
  8. CGroup: /system.slice/xinetd.service
  9. └─7484 xinetd -stayalive -pidfile /var/run/xinetd.pid
  10. 10 17 13:41:35 ywb xinetd[7484]: removing discard
  11. 10 17 13:41:35 ywb xinetd[7484]: removing discard
  12. 10 17 13:41:35 ywb xinetd[7484]: removing echo
  13. 10 17 13:41:35 ywb xinetd[7484]: removing echo
  14. 10 17 13:41:35 ywb xinetd[7484]: removing tcpmux
  15. 10 17 13:41:35 ywb xinetd[7484]: removing time
  16. 10 17 13:41:35 ywb xinetd[7484]: removing time
  17. 10 17 13:41:35 ywb systemd[1]: Started LSB: start and stop xinetd.
  18. 10 17 13:41:35 ywb xinetd[7484]: xinetd Version 2.3.14 started with libwrap loadavg labeled-networ...d in.
  19. 10 17 13:41:35 ywb xinetd[7484]: Started working: 1 available service
  20. Hint: Some lines were ellipsized, use -l to show in full.
  1. [root@ywb rpm]# which telnet
  2. /usr/bin/telnet

备注:个人感觉仅仅安装一个telnet-0.17-47.el6.x86_64.rpm包即可

  1. [root@ywb rpm]# rpm -ivh telnet-0.17-47.el6.x86_64.rpm
  2. [root@ywb rpm]# which telnet
  3. /usr/bin/telnet

3、输出信息含义

执行netstat后,其输出结果为

  1. [root@netstat ~]# netstat
  2. Active Internet connections (w/o servers)
  3. Proto Recv-Q Send-Q Local Address Foreign Address State
  4. tcp 0 52 ssh01:ssh 192.168.200.1:58307 ESTABLISHED
  5. Active UNIX domain sockets (w/o servers)
  6. Proto RefCnt Flags Type State I-Node Path
  7. unix 5 [ ] DGRAM 8960 /run/systemd/journal/socket
  8. unix 11 [ ] DGRAM 8962 /dev/log
  9. unix 2 [ ] DGRAM 13609 /run/systemd/shutdownd
  10. unix 2 [ ] DGRAM 17004 /var/run/chrony/chronyd.sock
  11. unix 3 [ ] DGRAM 8937 /run/systemd/notify
  12. unix 2 [ ] DGRAM 8939 /run/systemd/cgroups-agent
  13. #以下省略若干。。。

从整体上看,netstat的输出结果可以分为两个部分:

一个是Active Internet connections,称为有源TCP连接,其中"Recv-Q"和"Send-Q"指%0A的是接收队列和发送队列。这些数字一般都应该是0。如果不是则表示软件包正在队列中堆积。这种情况只能在非常少的情况见到。

另一个是Active UNIX domain sockets,称为有源Unix域套接口(和网络套接字一样,但是只能用于本机通信,性能可以提高一倍)。
Proto显示连接使用的协议,RefCnt表示连接到本套接口上的进程号,Types显示套接口的类型,State显示套接口当前的状态,Path表示连接到套接口的其它进程使用的路径名。

4、常见参数

  • -a (all)显示所有选项,默认不显示LISTEN相关
  • -t (tcp)仅显示tcp相关选项
  • -u (udp)仅显示udp相关选项
  • -n 拒绝显示别名,能显示数字的全部转化成数字。
  • -l 仅列出有在 Listen (监听) 的服務状态
  • -p 显示建立相关链接的程序名
  • -r 显示路由信息,路由表
  • -e 显示扩展信息,例如uid等
  • -s 按各个协议进行统计
  • -c 每隔一个固定时间,执行该netstat命令。

提示:LISTEN和LISTENING的状态只有用-a或者-l才能看到

5、实用命令实例

5.1 列出所有端口 (包括监听和未监听的)

5.1.1 列出所有端口 netstat -a
  1. [root@netstat ~]# netstat -a
  2. Active Internet connections (servers and established)
  3. Proto Recv-Q Send-Q Local Address Foreign Address State
  4. tcp 0 0 localhost:smtp 0.0.0.0:* LISTEN
  5. tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN
  6. tcp 0 52 netstat:ssh 192.168.200.1:58307 ESTABLISHED
  7. tcp6 0 0 localhost:smtp [::]:* LISTEN
  8. tcp6 0 0 [::]:ssh [::]:* LISTEN
  9. udp 0 0 localhost:323 0.0.0.0:*
  10. udp6 0 0 localhost:323 [::]:*
  11. Active UNIX domain sockets (servers and established)
  12. Proto RefCnt Flags Type State I-Node Path
  13. unix 5 [ ] DGRAM 8960 /run/systemd/journal/socket
  14. unix 11 [ ] DGRAM 8962 /dev/log
  15. unix 2 [ ACC ] STREAM LISTENING 13588 /run/lvm/lvmetad.socket
  16. unix 2 [ ACC ] STREAM LISTENING 18959 private/tlsmgr
  17. unix 2 [ ACC ] STREAM LISTENING 18962 private/rewrite
  18. unix 2 [ ACC ] SEQPACKET LISTENING 13605 /run/udev/control
  19. #以下省略若干。。。
5.1.2 列出所有 tcp 端口 netstat -at
  1. [root@netstat ~]# netstat -at
  2. Active Internet connections (servers and established)
  3. Proto Recv-Q Send-Q Local Address Foreign Address State
  4. tcp 0 0 localhost:smtp 0.0.0.0:* LISTEN
  5. tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN
  6. tcp 0 52 netstat:ssh 192.168.200.1:58307 ESTABLISHED
  7. tcp6 0 0 localhost:smtp [::]:* LISTEN
  8. tcp6 0 0 [::]:ssh [::]:* LISTEN
5.1.3 列出所有 udp 端口 netstat -au
  1. [root@netstat ~]# netstat -au
  2. Active Internet connections (servers and established)
  3. Proto Recv-Q Send-Q Local Address Foreign Address State
  4. udp 0 0 localhost:323 0.0.0.0:*
  5. udp6 0 0 localhost:323 [::]:*

5.2 列出所有处于监听状态的 Sockets

5.2.1 只显示监听端口 netstat -l
  1. [root@netstat ~]# netstat -l
  2. Active Internet connections (only servers)
  3. Proto Recv-Q Send-Q Local Address Foreign Address State
  4. tcp 0 0 localhost:smtp 0.0.0.0:* LISTEN
  5. tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN
  6. tcp6 0 0 localhost:smtp [::]:* LISTEN
  7. tcp6 0 0 [::]:ssh [::]:* LISTEN
  8. udp 0 0 localhost:323 0.0.0.0:*
  9. udp6 0 0 localhost:323 [::]:*
  10. Active UNIX domain sockets (only servers)
  11. Proto RefCnt Flags Type State I-Node Path
  12. unix 2 [ ACC ] STREAM LISTENING 13588 /run/lvm/lvmetad.socket
  13. unix 2 [ ACC ] STREAM LISTENING 18959 private/tlsmgr
  14. unix 2 [ ACC ] STREAM LISTENING 18962 private/rewrite
  15. unix 2 [ ACC ] SEQPACKET LISTENING 13605 /run/udev/control
  16. unix 2 [ ACC ] STREAM LISTENING 18965 private/bounce
  17. unix 2 [ ACC ] STREAM LISTENING 18968 private/defer
  18. unix 2 [ ACC ] STREAM LISTENING 13607 /run/lvm/lvmpolld.socket
  19. #以下省略。。。
5.2.2 只列出所有监听 tcp 端口 netstat -lt
  1. [root@netstat ~]# netstat -lt
  2. Active Internet connections (only servers)
  3. Proto Recv-Q Send-Q Local Address Foreign Address State
  4. tcp 0 0 localhost:smtp 0.0.0.0:* LISTEN
  5. tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN
  6. tcp6 0 0 localhost:smtp [::]:* LISTEN
  7. tcp6 0 0 [::]:ssh [::]:* LISTEN
5.2.3 只列出所有监听 udp 端口 netstat -lu
  1. [root@netstat ~]# netstat -lu
  2. Active Internet connections (only servers)
  3. Proto Recv-Q Send-Q Local Address Foreign Address State
  4. udp 0 0 localhost:323 0.0.0.0:*
  5. udp6 0 0 localhost:323 [::]:*
5.2.4 只列出所有监听 UNIX 端口 netstat -lx
  1. [root@netstat ~]# netstat -lx
  2. Active UNIX domain sockets (only servers)
  3. Proto RefCnt Flags Type State I-Node Path
  4. unix 2 [ ACC ] STREAM LISTENING 13588 /run/lvm/lvmetad.socket
  5. unix 2 [ ACC ] STREAM LISTENING 18959 private/tlsmgr
  6. unix 2 [ ACC ] STREAM LISTENING 18962 private/rewrite
  7. unix 2 [ ACC ] SEQPACKET LISTENING 13605 /run/udev/control
  8. unix 2 [ ACC ] STREAM LISTENING 18965 private/bounce
  9. unix 2 [ ACC ] STREAM LISTENING 18968 private/defer
  10. unix 2 [ ACC ] STREAM LISTENING 13607 /run/lvm/lvmpolld.socket
  11. unix 2 [ ACC ] STREAM LISTENING 18971 private/trace
  12. unix 2 [ ACC ] STREAM LISTENING 18974 private/verify
  13. #以下省略。。。

5.3 显示每个协议的统计信息

5.3.1 显示所有端口的统计信息 netstat -s
  1. [root@netstat ~]# netstat -s
  2. Ip:
  3. 363 total packets received
  4. 0 forwarded
  5. 0 incoming packets discarded
  6. 363 incoming packets delivered
  7. 309 requests sent out
  8. 16 dropped because of missing route
  9. Icmp:
  10. 0 ICMP messages received
  11. 0 input ICMP message failed.
  12. ICMP input histogram:
  13. 0 ICMP messages sent
  14. 0 ICMP messages failed
  15. ICMP output histogram:
  16. Tcp:
  17. 0 active connections openings
  18. 1 passive connection openings
  19. 0 failed connection attempts
  20. 0 connection resets received
  21. 1 connections established
  22. 263 segments received
  23. 195 segments send out
  24. 0 segments retransmited
  25. 0 bad segments received.
  26. 0 resets sent
  27. Udp:
  28. 99 packets received
  29. 0 packets to unknown port received.
  30. 0 packet receive errors
  31. 121 packets sent
  32. 0 receive buffer errors
  33. 0 send buffer erros
  34. UdpLite:
  35. TcpExt:
  36. 11 delayed acks sent
  37. 1 packets directly queued to recvmsg prequeue.
  38. 64 packet headers predicted
  39. 48 acknowledgments not containing data payload received
  40. 77 predicted acknowledgments
  41. TCPRcvCoalesce: 2
  42. TCPOrigDataSent: 151
  43. IpExt:
  44. InOctets: 28156
  45. OutOctets: 51542
  46. InNoECTPkts: 363
5.3.2 显示 TCP端口的统计信息 netstat -st
  1. [root@netstat ~]# netstat -st
  2. Tcp:
  3. 0 active connections openings
  4. 1 passive connection openings
  5. 0 failed connection attempts
  6. 0 connection resets received
  7. 1 connections established
  8. 338 segments received
  9. 262 segments send out
  10. 0 segments retransmited
  11. 0 bad segments received.
  12. 0 resets sent
  13. UdpLite:
  14. TcpExt:
  15. 14 delayed acks sent
  16. 1 packets directly queued to recvmsg prequeue.
  17. 92 packet headers predicted
  18. 55 acknowledgments not containing data payload received
  19. 107 predicted acknowledgments
  20. TCPRcvCoalesce: 2
  21. TCPOrigDataSent: 211
  22. IpExt:
  23. InOctets: 34932
  24. OutOctets: 62342
  25. InNoECTPkts: 444
5.3.3 显示 UDP 端口的统计信息 netstat -su
  1. [root@netstat ~]# netstat -su
  2. Udp:
  3. 105 packets received
  4. 0 packets to unknown port received.
  5. 0 packet receive errors
  6. 127 packets sent
  7. 0 receive buffer errors
  8. 0 send buffer errors
  9. UdpLite:
  10. IpExt:
  11. InOctets: 35516
  12. OutOctets: 63554
  13. InNoECTPkts: 452

5.4 在 netstat 输出中显示 PID 和进程名称 netstat -p

netstat -p 可以与其它开关一起使用,就可以添加 “PID/进程名称” 到 netstat 输出中,这样 debugging 的时候可以很方便的发现特定端口运行的程序。

  1. [root@netstat ~]# netstat -p
  2. Active Internet connections (w/o servers)
  3. Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
  4. tcp 0 52 netstat:ssh 192.168.200.1:58307 ESTABLISHED 1185/sshd: root@pts
  5. Active UNIX domain sockets (w/o servers)
  6. Proto RefCnt Flags Type State I-Node PID/Program name Path
  7. unix 5 [ ] DGRAM 8960 1/systemd /run/systemd/journal/socket
  8. unix 11 [ ] DGRAM 8962 1/systemd /dev/log
  9. unix 2 [ ] DGRAM 13609 1/systemd /run/systemd/shutdownd
  10. unix 2 [ ] DGRAM 17004 663/chronyd /var/run/chrony/chronyd.sock
  11. #以下省略若干。。。
  1. [root@netstat ~]# netstat -pt
  2. Active Internet connections (w/o servers)
  3. Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
  4. tcp 0 52 netstat:ssh 192.168.200.1:58307 ESTABLISHED 1185/sshd: root@pts

5.5 在 netstat 输出中不显示主机,端口和用户名 (host, port or user)

当你不想让主机,端口和用户名显示,使用 netstat -n。将会使用数字代替那些名称。
同样可以加速输出,因为不用进行比对查询。

  1. [root@netstat ~]# netstat -an
  2. Active Internet connections (servers and established)
  3. Proto Recv-Q Send-Q Local Address Foreign Address State
  4. tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
  5. tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
  6. tcp 0 52 192.168.200.30:22 192.168.200.1:58307 ESTABLISHED
  7. tcp6 0 0 ::1:25 :::* LISTEN
  8. tcp6 0 0 :::22 :::* LISTEN
  9. udp 0 0 127.0.0.1:323 0.0.0.0:*
  10. udp6 0 0 ::1:323 :::*
  11. Active UNIX domain sockets (servers and established)
  12. Proto RefCnt Flags Type State I-Node Path
  13. unix 5 [ ] DGRAM 8960 /run/systemd/journal/socket
  14. unix 11 [ ] DGRAM 8962 /dev/log
  15. #以下省略若干。。。
  1. #如果只是不想让这三个名称中的一个被显示,使用以下命令
  2. netsat -a --numeric-ports
  3. netsat -a --numeric-hosts
  4. netsat -a --numeric-users

5.6 持续输出 netstat 信息

netstat -c 将每隔一秒输出网络信息

  1. [root@netstat ~]# netstat -c
  2. Active Internet connections (w/o servers)
  3. Proto Recv-Q Send-Q Local Address Foreign Address State
  4. tcp 0 52 netstat:ssh 192.168.200.1:58307 ESTABLISHED
  5. Active UNIX domain sockets (w/o servers)
  6. Proto RefCnt Flags Type State I-Node Path
  7. unix 5 [ ] DGRAM 8960 /run/systemd/journal/socket
  8. unix 11 [ ] DGRAM 8962 /dev/log
  9. unix 2 [ ] DGRAM 13609 /run/systemd/shutdownd
  10. unix 2 [ ] DGRAM 17004 /var/run/chrony/chronyd.sock
  11. unix 3 [ ] DGRAM 8937 /run/systemd/notify
  12. unix 2 [ ] DGRAM 8939 /run/systemd/cgroups-agent
  13. #以下省略若干。。。

5.7 显示系统不支持的地址族 (Address Families)

netstat --verbose在输出的末尾,会有如下的信息

  1. #以上省略若干。。。
  2. netstat: no support for `AF IPX' on this system.
  3. netstat: no support for `AF AX25' on this system.
  4. netstat: no support for `AF X25' on this system.
  5. netstat: no support for `AF NETROM' on this system.

5.8 显示核心路由信息 netstat -r

  1. [root@netstat ~]# netstat -r
  2. Kernel IP routing table
  3. Destination Gateway Genmask Flags MSS Window irtt Iface
  4. default gateway 0.0.0.0 UG 0 0 0 ens32
  5. link-local 0.0.0.0 255.255.0.0 U 0 0 0 ens32
  6. 192.168.200.0 0.0.0.0 255.255.255.0 U 0 0 0 ens32

注意:使用 netstat -rn 显示数字格式,不查询主机名称。

5.9 找出程序运行的端口

并不是所有的进程都能找到,没有权限的会不显示,使用 root 权限查看所有的信息。

  1. [root@netstat ~]# netstat -ap | grep ssh
  2. tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN 921/sshd
  3. tcp 0 52 netstat:ssh 192.168.200.1:58307 ESTABLISHED 1185/sshd: root@pts
  4. tcp6 0 0 [::]:ssh [::]:* LISTEN 921/sshd
  5. unix 3 [ ] STREAM CONNECTED 18279 921/sshd
  6. unix 2 [ ] DGRAM 19409 1185/sshd: root@pts

找出运行在指定端口的进程

  1. [root@netstat ~]# netstat -an | grep ':8080'
  2. tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN

5.10 显示网络接口列表

  1. [root@netstat ~]# netstat -i
  2. Kernel Interface table
  3. Iface MTU RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
  4. ens32 1500 1753 0 0 0 1603 0 0 0 BMRU
  5. lo 65536 0 0 0 0 0 0 0 0 LRU
  1. #显示详细信息,像是 ifconfig 使用 netstat -ie
  2. [root@netstat ~]# netstat -ie
  3. Kernel Interface table
  4. ens32: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
  5. inet 192.168.200.30 netmask 255.255.255.0 broadcast 192.168.200.255
  6. inet6 fe80::20c:29ff:fef9:d01f prefixlen 64 scopeid 0x20<link>
  7. ether 00:0c:29:f9:d0:1f txqueuelen 1000 (Ethernet)
  8. RX packets 1778 bytes 155872 (152.2 KiB)
  9. RX errors 0 dropped 0 overruns 0 frame 0
  10. TX packets 1622 bytes 916017 (894.5 KiB)
  11. TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
  12. lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
  13. inet 127.0.0.1 netmask 255.0.0.0
  14. inet6 ::1 prefixlen 128 scopeid 0x10<host>
  15. loop txqueuelen 1000 (Local Loopback)
  16. RX packets 0 bytes 0 (0.0 B)
  17. RX errors 0 dropped 0 overruns 0 frame 0
  18. TX packets 0 bytes 0 (0.0 B)
  19. TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

5.11 IP和TCP分析

  1. #查看连接某服务端口最多的的IP地址
  2. [root@netstat ~]# netstat -nat | grep "192.168.200.30:22" |awk '{print $5}'|awk -F: '{print $1}'|sort|uniq -c|sort -nr|head -20
  3. 18 221.136.168.36
  4. 3 154.74.45.242
  5. 2 78.173.31.236
  6. 2 62.183.207.98
  7. 2 192.168.1.14
  8. 2 182.48.111.215
  9. 2 124.193.219.34
  1. #TCP各种状态列表
  2. [root@netstat ~]# netstat -nat |awk '{print $6}'
  3. established)
  4. Foreign
  5. LISTEN
  6. LISTEN
  7. LISTEN
  8. ESTABLISHED
  9. ESTABLISHED
  10. LISTEN
  11. LISTEN
  1. #先把状态全都取出来,然后使用uniq -c统计,之后再进行排序
  2. [root@netstat ~]# netstat -nat |awk '{print $6}'|sort|uniq -c|sort -rn
  3. 5 LISTEN
  4. 2 ESTABLISHED
  5. 1 Foreign
  6. 1 established)
添加新批注
在作者公开此批注前,只有你和作者可见。
回复批注