[关闭]
@yangwenbo 2023-02-10T17:41:16.000000Z 字数 12879 阅读 177

centos7系统

netstat命令详解

1、简介

Netstat 命令用于显示各种网络相关信息，如网络连接，路由表，接口状态 (Interface Statistics)，masquerade 连接，多播成员 (Multicast Memberships) 等等。

2、安装telnet

2.1 下载安装包

rpm包下载位置:http://vault.centos.org/6.3/os/x86_64/Packages/

  1. [root@ywb ~]# cd rpm/
  2. [root@ywb rpm]# ll
  3. 总用量 224
  4. -rw-r--r-- 1 root root  59040 10月 17 13:24 telnet-0.17-47.el6.x86_64.rpm
  5. -rw-r--r-- 1 root root  37360 10月 17 13:24 telnet-server-0.17-47.el6.x86_64.rpm
  6. -rw-r--r-- 1 root root 123624 10月 17 13:24 xinetd-2.3.14-34.el6.x86_64.rpm

2.2 安装telnet相关

  1. [root@ywb rpm]# rpm -ivh xinetd-2.3.14-34.el6.x86_64.rpm 
  3. [root@ywb rpm]# rpm -ivh telnet-0.17-47.el6.x86_64.rpm 
  5. [root@ywb rpm]# rpm -ivh telnet-server-0.17-47.el6.x86_64.rpm

2.3 检查安装结果

  1. [root@ywb rpm]# rpm -qa | grep xinetd
  2. xinetd-2.3.14-34.el6.x86_64
  4. [root@ywb rpm]# rpm -qa | grep telnet
  5. telnet-0.17-47.el6.x86_64
  6. telnet-server-0.17-47.el6.x86_64

2.4 telnet服务之后,默认是不开启服务,修改文件/etc/xinetd.d/telnet来开启服务

  1. [root@ywb rpm]# vi /etc/xinetd.d/telnet
  2. [root@ywb rpm]# cat /etc/xinetd.d/telnet
  3. # default: on
  4. # description: The telnet server serves telnet sessions; it uses \
  5. #   unencrypted username/password pairs for authentication.
  6. service telnet
  7. {
  8.     flags       = REUSE
  9.     socket_type = stream        
  10.     wait        = no
  11.     user        = root
  12.     server      = /usr/sbin/in.telnetd
  13.     log_on_failure  += USERID
  14.     disable     = no     #这里把yes修改成no
  15. }

2.5 启动telnet和依赖的xinetd服务

  1. [root@ywb rpm]# systemctl start xinetd

2.6 查看启动状态

  1. [root@ywb rpm]# systemctl status xinetd
  2. ● xinetd.service - LSB: start and stop xinetd
  3.    Loaded: loaded (/etc/rc.d/init.d/xinetd; bad; vendor preset: enabled)
  4.    Active: active (running) since 四 2019-10-17 13:41:35 CST; 2s ago
  5.      Docs: man:systemd-sysv-generator(8)
  6.   Process: 7477 ExecStart=/etc/rc.d/init.d/xinetd start (code=exited, status=0/SUCCESS)
  7.  Main PID: 7484 (xinetd)
  8.    CGroup: /system.slice/xinetd.service
  9.            └─7484 xinetd -stayalive -pidfile /var/run/xinetd.pid
  11. 10月 17 13:41:35 ywb xinetd[7484]: removing discard
  12. 10月 17 13:41:35 ywb xinetd[7484]: removing discard
  13. 10月 17 13:41:35 ywb xinetd[7484]: removing echo
  14. 10月 17 13:41:35 ywb xinetd[7484]: removing echo
  15. 10月 17 13:41:35 ywb xinetd[7484]: removing tcpmux
  16. 10月 17 13:41:35 ywb xinetd[7484]: removing time
  17. 10月 17 13:41:35 ywb xinetd[7484]: removing time
  18. 10月 17 13:41:35 ywb systemd[1]: Started LSB: start and stop xinetd.
  19. 10月 17 13:41:35 ywb xinetd[7484]: xinetd Version 2.3.14 started with libwrap loadavg labeled-networ...d in.
  20. 10月 17 13:41:35 ywb xinetd[7484]: Started working: 1 available service
  21. Hint: Some lines were ellipsized, use -l to show in full.
  1. [root@ywb rpm]# which telnet
  2. /usr/bin/telnet

备注：个人感觉仅仅安装一个telnet-0.17-47.el6.x86_64.rpm包即可

  1. [root@ywb rpm]# rpm -ivh telnet-0.17-47.el6.x86_64.rpm 
  2. [root@ywb rpm]# which telnet
  3. /usr/bin/telnet

3、输出信息含义

执行netstat后，其输出结果为

  1. [root@netstat ~]# netstat
  2. Active Internet connections (w/o servers)
  3. Proto Recv-Q Send-Q Local Address           Foreign Address         State      
  4. tcp        0     52 ssh01:ssh               192.168.200.1:58307     ESTABLISHED
  5. Active UNIX domain sockets (w/o servers)
  6. Proto RefCnt Flags       Type       State         I-Node   Path
  7. unix  5      [ ]         DGRAM                    8960     /run/systemd/journal/socket
  8. unix  11     [ ]         DGRAM                    8962     /dev/log
  9. unix  2      [ ]         DGRAM                    13609    /run/systemd/shutdownd
  10. unix  2      [ ]         DGRAM                    17004    /var/run/chrony/chronyd.sock
  11. unix  3      [ ]         DGRAM                    8937     /run/systemd/notify
  12. unix  2      [ ]         DGRAM                    8939     /run/systemd/cgroups-agent
  13. #以下省略若干。。。

从整体上看，netstat的输出结果可以分为两个部分：

一个是Active Internet connections，称为有源TCP连接，其中"Recv-Q"和"Send-Q"指%0A的是接收队列和发送队列。这些数字一般都应该是0。如果不是则表示软件包正在队列中堆积。这种情况只能在非常少的情况见到。

另一个是Active UNIX domain sockets，称为有源Unix域套接口(和网络套接字一样，但是只能用于本机通信，性能可以提高一倍)。
Proto显示连接使用的协议,RefCnt表示连接到本套接口上的进程号,Types显示套接口的类型,State显示套接口当前的状态,Path表示连接到套接口的其它进程使用的路径名。

4、常见参数

  • -a (all)显示所有选项，默认不显示LISTEN相关
  • -t (tcp)仅显示tcp相关选项
  • -u (udp)仅显示udp相关选项
  • -n 拒绝显示别名，能显示数字的全部转化成数字。
  • -l 仅列出有在 Listen (监听) 的服務状态
  • -p 显示建立相关链接的程序名
  • -r 显示路由信息，路由表
  • -e 显示扩展信息，例如uid等
  • -s 按各个协议进行统计
  • -c 每隔一个固定时间，执行该netstat命令。

提示：LISTEN和LISTENING的状态只有用-a或者-l才能看到

5、实用命令实例

5.1 列出所有端口 (包括监听和未监听的)

5.1.1 列出所有端口 netstat -a
  1. [root@netstat ~]# netstat -a
  2. Active Internet connections (servers and established)
  3. Proto Recv-Q Send-Q Local Address           Foreign Address         State      
  4. tcp        0      0 localhost:smtp          0.0.0.0:*               LISTEN     
  5. tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN     
  6. tcp        0     52 netstat:ssh             192.168.200.1:58307     ESTABLISHED
  7. tcp6       0      0 localhost:smtp          [::]:*                  LISTEN     
  8. tcp6       0      0 [::]:ssh                [::]:*                  LISTEN     
  9. udp        0      0 localhost:323           0.0.0.0:*                          
  10. udp6       0      0 localhost:323           [::]:*                             
  11. Active UNIX domain sockets (servers and established)
  12. Proto RefCnt Flags       Type       State         I-Node   Path
  13. unix  5      [ ]         DGRAM                    8960     /run/systemd/journal/socket
  14. unix  11     [ ]         DGRAM                    8962     /dev/log
  15. unix  2      [ ACC ]     STREAM     LISTENING     13588    /run/lvm/lvmetad.socket
  16. unix  2      [ ACC ]     STREAM     LISTENING     18959    private/tlsmgr
  17. unix  2      [ ACC ]     STREAM     LISTENING     18962    private/rewrite
  18. unix  2      [ ACC ]     SEQPACKET  LISTENING     13605    /run/udev/control
  19. #以下省略若干。。。
5.1.2 列出所有 tcp 端口 netstat -at
  1. [root@netstat ~]# netstat -at
  2. Active Internet connections (servers and established)
  3. Proto Recv-Q Send-Q Local Address           Foreign Address         State      
  4. tcp        0      0 localhost:smtp          0.0.0.0:*               LISTEN     
  5. tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN     
  6. tcp        0     52 netstat:ssh             192.168.200.1:58307     ESTABLISHED
  7. tcp6       0      0 localhost:smtp          [::]:*                  LISTEN     
  8. tcp6       0      0 [::]:ssh                [::]:*                  LISTEN
5.1.3 列出所有 udp 端口 netstat -au
  1. [root@netstat ~]# netstat -au
  2. Active Internet connections (servers and established)
  3. Proto Recv-Q Send-Q Local Address           Foreign Address         State      
  4. udp        0      0 localhost:323           0.0.0.0:*                          
  5. udp6       0      0 localhost:323           [::]:*

5.2 列出所有处于监听状态的 Sockets

5.2.1 只显示监听端口 netstat -l
  1. [root@netstat ~]# netstat -l
  2. Active Internet connections (only servers)
  3. Proto Recv-Q Send-Q Local Address           Foreign Address         State      
  4. tcp        0      0 localhost:smtp          0.0.0.0:*               LISTEN     
  5. tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN     
  6. tcp6       0      0 localhost:smtp          [::]:*                  LISTEN     
  7. tcp6       0      0 [::]:ssh                [::]:*                  LISTEN     
  8. udp        0      0 localhost:323           0.0.0.0:*                          
  9. udp6       0      0 localhost:323           [::]:*                             
  10. Active UNIX domain sockets (only servers)
  11. Proto RefCnt Flags       Type       State         I-Node   Path
  12. unix  2      [ ACC ]     STREAM     LISTENING     13588    /run/lvm/lvmetad.socket
  13. unix  2      [ ACC ]     STREAM     LISTENING     18959    private/tlsmgr
  14. unix  2      [ ACC ]     STREAM     LISTENING     18962    private/rewrite
  15. unix  2      [ ACC ]     SEQPACKET  LISTENING     13605    /run/udev/control
  16. unix  2      [ ACC ]     STREAM     LISTENING     18965    private/bounce
  17. unix  2      [ ACC ]     STREAM     LISTENING     18968    private/defer
  18. unix  2      [ ACC ]     STREAM     LISTENING     13607    /run/lvm/lvmpolld.socket
  19. #以下省略。。。
5.2.2 只列出所有监听 tcp 端口 netstat -lt
  1. [root@netstat ~]# netstat -lt
  2. Active Internet connections (only servers)
  3. Proto Recv-Q Send-Q Local Address           Foreign Address         State      
  4. tcp        0      0 localhost:smtp          0.0.0.0:*               LISTEN     
  5. tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN     
  6. tcp6       0      0 localhost:smtp          [::]:*                  LISTEN     
  7. tcp6       0      0 [::]:ssh                [::]:*                  LISTEN
5.2.3 只列出所有监听 udp 端口 netstat -lu
  1. [root@netstat ~]# netstat -lu
  2. Active Internet connections (only servers)
  3. Proto Recv-Q Send-Q Local Address           Foreign Address         State      
  4. udp        0      0 localhost:323           0.0.0.0:*                          
  5. udp6       0      0 localhost:323           [::]:*
5.2.4 只列出所有监听 UNIX 端口 netstat -lx
  1. [root@netstat ~]# netstat -lx
  2. Active UNIX domain sockets (only servers)
  3. Proto RefCnt Flags       Type       State         I-Node   Path
  4. unix  2      [ ACC ]     STREAM     LISTENING     13588    /run/lvm/lvmetad.socket
  5. unix  2      [ ACC ]     STREAM     LISTENING     18959    private/tlsmgr
  6. unix  2      [ ACC ]     STREAM     LISTENING     18962    private/rewrite
  7. unix  2      [ ACC ]     SEQPACKET  LISTENING     13605    /run/udev/control
  8. unix  2      [ ACC ]     STREAM     LISTENING     18965    private/bounce
  9. unix  2      [ ACC ]     STREAM     LISTENING     18968    private/defer
  10. unix  2      [ ACC ]     STREAM     LISTENING     13607    /run/lvm/lvmpolld.socket
  11. unix  2      [ ACC ]     STREAM     LISTENING     18971    private/trace
  12. unix  2      [ ACC ]     STREAM     LISTENING     18974    private/verify
  13. #以下省略。。。

5.3 显示每个协议的统计信息

5.3.1 显示所有端口的统计信息 netstat -s
  1. [root@netstat ~]# netstat -s
  2. Ip:
  3.     363 total packets received
  4.     0 forwarded
  5.     0 incoming packets discarded
  6.     363 incoming packets delivered
  7.     309 requests sent out
  8.     16 dropped because of missing route
  9. Icmp:
  10.     0 ICMP messages received
  11.     0 input ICMP message failed.
  12.     ICMP input histogram:
  13.     0 ICMP messages sent
  14.     0 ICMP messages failed
  15.     ICMP output histogram:
  16. Tcp:
  17.     0 active connections openings
  18.     1 passive connection openings
  19.     0 failed connection attempts
  20.     0 connection resets received
  21.     1 connections established
  22.     263 segments received
  23.     195 segments send out
  24.     0 segments retransmited
  25.     0 bad segments received.
  26.     0 resets sent
  27. Udp:
  28.     99 packets received
  29.     0 packets to unknown port received.
  30.     0 packet receive errors
  31.     121 packets sent
  32.     0 receive buffer errors
  33.     0 send buffer erros
  34. UdpLite:
  35. TcpExt:
  36.     11 delayed acks sent
  37.     1 packets directly queued to recvmsg prequeue.
  38.     64 packet headers predicted
  39.     48 acknowledgments not containing data payload received
  40.     77 predicted acknowledgments
  41.     TCPRcvCoalesce: 2
  42.     TCPOrigDataSent: 151
  43. IpExt:
  44.     InOctets: 28156
  45.     OutOctets: 51542
  46.     InNoECTPkts: 363
5.3.2 显示 TCP端口的统计信息 netstat -st
  1. [root@netstat ~]# netstat -st
  2. Tcp:
  3.     0 active connections openings
  4.     1 passive connection openings
  5.     0 failed connection attempts
  6.     0 connection resets received
  7.     1 connections established
  8.     338 segments received
  9.     262 segments send out
  10.     0 segments retransmited
  11.     0 bad segments received.
  12.     0 resets sent
  13. UdpLite:
  14. TcpExt:
  15.     14 delayed acks sent
  16.     1 packets directly queued to recvmsg prequeue.
  17.     92 packet headers predicted
  18.     55 acknowledgments not containing data payload received
  19.     107 predicted acknowledgments
  20.     TCPRcvCoalesce: 2
  21.     TCPOrigDataSent: 211
  22. IpExt:
  23.     InOctets: 34932
  24.     OutOctets: 62342
  25.     InNoECTPkts: 444
5.3.3 显示 UDP 端口的统计信息 netstat -su
  1. [root@netstat ~]# netstat -su
  2. Udp:
  3.     105 packets received
  4.     0 packets to unknown port received.
  5.     0 packet receive errors
  6.     127 packets sent
  7.     0 receive buffer errors
  8.     0 send buffer errors
  9. UdpLite:
  10. IpExt:
  11.     InOctets: 35516
  12.     OutOctets: 63554
  13.     InNoECTPkts: 452

5.4 在 netstat 输出中显示 PID 和进程名称 netstat -p

netstat -p 可以与其它开关一起使用，就可以添加 “PID/进程名称” 到 netstat 输出中，这样 debugging 的时候可以很方便的发现特定端口运行的程序。

  1. [root@netstat ~]# netstat -p
  2. Active Internet connections (w/o servers)
  3. Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
  4. tcp        0     52 netstat:ssh             192.168.200.1:58307     ESTABLISHED 1185/sshd: root@pts 
  5. Active UNIX domain sockets (w/o servers)
  6. Proto RefCnt Flags       Type       State         I-Node   PID/Program name     Path
  7. unix  5      [ ]         DGRAM                    8960     1/systemd            /run/systemd/journal/socket
  8. unix  11     [ ]         DGRAM                    8962     1/systemd            /dev/log
  9. unix  2      [ ]         DGRAM                    13609    1/systemd            /run/systemd/shutdownd
  10. unix  2      [ ]         DGRAM                    17004    663/chronyd          /var/run/chrony/chronyd.sock
  11. #以下省略若干。。。
  1. [root@netstat ~]# netstat -pt
  2. Active Internet connections (w/o servers)
  3. Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
  4. tcp        0     52 netstat:ssh             192.168.200.1:58307     ESTABLISHED 1185/sshd: root@pts

5.5 在 netstat 输出中不显示主机，端口和用户名 (host, port or user)

当你不想让主机，端口和用户名显示，使用 netstat -n。将会使用数字代替那些名称。
同样可以加速输出，因为不用进行比对查询。

  1. [root@netstat ~]# netstat -an
  2. Active Internet connections (servers and established)
  3. Proto Recv-Q Send-Q Local Address           Foreign Address         State      
  4. tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN     
  5. tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     
  6. tcp        0     52 192.168.200.30:22       192.168.200.1:58307     ESTABLISHED
  7. tcp6       0      0 ::1:25                  :::*                    LISTEN     
  8. tcp6       0      0 :::22                   :::*                    LISTEN     
  9. udp        0      0 127.0.0.1:323           0.0.0.0:*                          
  10. udp6       0      0 ::1:323                 :::*                               
  11. Active UNIX domain sockets (servers and established)
  12. Proto RefCnt Flags       Type       State         I-Node   Path
  13. unix  5      [ ]         DGRAM                    8960     /run/systemd/journal/socket
  14. unix  11     [ ]         DGRAM                    8962     /dev/log
  15. #以下省略若干。。。
  1. #如果只是不想让这三个名称中的一个被显示，使用以下命令
  2. netsat -a --numeric-ports
  3. netsat -a --numeric-hosts
  4. netsat -a --numeric-users

5.6 持续输出 netstat 信息

netstat -c 将每隔一秒输出网络信息

  1. [root@netstat ~]# netstat -c
  2. Active Internet connections (w/o servers)
  3. Proto Recv-Q Send-Q Local Address           Foreign Address         State      
  4. tcp        0     52 netstat:ssh             192.168.200.1:58307     ESTABLISHED
  5. Active UNIX domain sockets (w/o servers)
  6. Proto RefCnt Flags       Type       State         I-Node   Path
  7. unix  5      [ ]         DGRAM                    8960     /run/systemd/journal/socket
  8. unix  11     [ ]         DGRAM                    8962     /dev/log
  9. unix  2      [ ]         DGRAM                    13609    /run/systemd/shutdownd
  10. unix  2      [ ]         DGRAM                    17004    /var/run/chrony/chronyd.sock
  11. unix  3      [ ]         DGRAM                    8937     /run/systemd/notify
  12. unix  2      [ ]         DGRAM                    8939     /run/systemd/cgroups-agent
  13. #以下省略若干。。。

5.7 显示系统不支持的地址族 (Address Families)

netstat --verbose在输出的末尾，会有如下的信息

  1. #以上省略若干。。。
  2. netstat: no support for `AF IPX' on this system.
  3. netstat: no support for `AF AX25' on this system.
  4. netstat: no support for `AF X25' on this system.
  5. netstat: no support for `AF NETROM' on this system.

5.8 显示核心路由信息 netstat -r

  1. [root@netstat ~]# netstat -r
  2. Kernel IP routing table
  3. Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
  4. default         gateway         0.0.0.0         UG        0 0          0 ens32
  5. link-local      0.0.0.0         255.255.0.0     U         0 0          0 ens32
  6. 192.168.200.0   0.0.0.0         255.255.255.0   U         0 0          0 ens32

注意：使用 netstat -rn 显示数字格式，不查询主机名称。

5.9 找出程序运行的端口

并不是所有的进程都能找到，没有权限的会不显示，使用 root 权限查看所有的信息。

  1. [root@netstat ~]# netstat -ap | grep ssh
  2. tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN      921/sshd            
  3. tcp        0     52 netstat:ssh             192.168.200.1:58307     ESTABLISHED 1185/sshd: root@pts 
  4. tcp6       0      0 [::]:ssh                [::]:*                  LISTEN      921/sshd            
  5. unix  3      [ ]         STREAM     CONNECTED     18279    921/sshd             
  6. unix  2      [ ]         DGRAM                    19409    1185/sshd: root@pts

找出运行在指定端口的进程

  1. [root@netstat ~]# netstat -an | grep ':8080'
  2. tcp        0      0 0.0.0.0:8080            0.0.0.0:*               LISTEN

5.10 显示网络接口列表

  1. [root@netstat ~]# netstat -i
  2. Kernel Interface table
  3. Iface             MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
  4. ens32            1500     1753      0      0 0          1603      0      0      0 BMRU
  5. lo              65536        0      0      0 0             0      0      0      0 LRU
  1. #显示详细信息，像是 ifconfig 使用 netstat -ie
  2. [root@netstat ~]# netstat -ie
  3. Kernel Interface table
  4. ens32: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
  5.         inet 192.168.200.30  netmask 255.255.255.0  broadcast 192.168.200.255
  6.         inet6 fe80::20c:29ff:fef9:d01f  prefixlen 64  scopeid 0x20<link>
  7.         ether 00:0c:29:f9:d0:1f  txqueuelen 1000  (Ethernet)
  8.         RX packets 1778  bytes 155872 (152.2 KiB)
  9.         RX errors 0  dropped 0  overruns 0  frame 0
  10.         TX packets 1622  bytes 916017 (894.5 KiB)
  11.         TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
  13. lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
  14.         inet 127.0.0.1  netmask 255.0.0.0
  15.         inet6 ::1  prefixlen 128  scopeid 0x10<host>
  16.         loop  txqueuelen 1000  (Local Loopback)
  17.         RX packets 0  bytes 0 (0.0 B)
  18.         RX errors 0  dropped 0  overruns 0  frame 0
  19.         TX packets 0  bytes 0 (0.0 B)
  20.         TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

5.11 IP和TCP分析

  1. #查看连接某服务端口最多的的IP地址
  2. [root@netstat ~]# netstat -nat | grep "192.168.200.30:22" |awk '{print $5}'|awk -F: '{print $1}'|sort|uniq -c|sort -nr|head -20
  3. 18 221.136.168.36
  4. 3 154.74.45.242
  5. 2 78.173.31.236
  6. 2 62.183.207.98
  7. 2 192.168.1.14
  8. 2 182.48.111.215
  9. 2 124.193.219.34
  1. #TCP各种状态列表
  2. [root@netstat ~]# netstat -nat |awk '{print $6}'
  3. established)
  4. Foreign
  5. LISTEN
  6. LISTEN
  7. LISTEN
  8. ESTABLISHED
  9. ESTABLISHED
  10. LISTEN
  11. LISTEN
  1. #先把状态全都取出来,然后使用uniq -c统计，之后再进行排序
  2. [root@netstat ~]# netstat -nat |awk '{print $6}'|sort|uniq -c|sort -rn
  3.       5 LISTEN
  4.       2 ESTABLISHED
  5.       1 Foreign
  6.       1 established)
添加新批注
在作者公开此批注前，只有你和作者可见。
回复批注