linux必先利其器之-netstat神器详解
netstat 命令详解
netstat是linux下查看网络信息经常用到的命令，今天我们来详细介绍它的使用。netstat 主要是显示网络连接，路由表，端口数据统计，执行进程和组播关系的作用。我们首先看下help 或者使用man netstat查看具体信息。
~$ netstat -h
usage: netstat [-vWeenNcCF] [] -r netstat {-V|--version|-h|--help}
netstat [-vWnNcaeol] [ ...]
netstat { [-vWeenNac] -i | [-cWnNe] -M | -s }
-r, --route display routing table
-i, --interfaces display interface table
-g, --groups display multicast group memberships
-s, --statistics display networking statistics (like SNMP)
-M, --masquerade display masqueraded connections
-v, --verbose be verbose
-W, --wide don't truncate IP addresses
-n, --numeric don't resolve names
--numeric-hosts don't resolve host names
--numeric-ports don't resolve port names
--numeric-users don't resolve user names
-N, --symbolic resolve hardware names
-e, --extend display other/more information
-p, --programs display PID/Program name for sockets
-c, --continuous continuous listing
-l, --listening display listening server sockets
-a, --all, --listening display all sockets (default: connected)
-o, --timers display timers
-F, --fib display Forwarding Information Base (default)
-C, --cache display routing cache instead of FIB
={-t|--tcp} {-u|--udp} {-w|--raw} {-x|--unix} --ax25 --ipx --netrom
=Use '-6|-4' or '-A ' or '--'; default: inet
List of possible address families (which support routing):
inet (DARPA Internet) inet6 (IPv6) ax25 (AMPR AX.25)
netrom (AMPR NET/ROM) ipx (Novell IPX) ddp (Appletalk DDP)
x25 (CCITT X.25)
结合 netstat -option -e | grep xxx 可以快速得到需求信息。
直接执行netstat -a会显示所有的socket， tcp ,udp unix,类型，追加-t 代表只看tcp的，-u udp的，-x unix的。
1：显示路由信息
~$ netstat -r
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
192.168.1.0 * 255.255.255.0 U 0 0 0 eth2
192.168.100.0 * 255.255.255.0 U 0 0 0 eth1
此命令和在命令行直接输入: route 命令效果基本相同，显示系统内存在的路由表，根据此路由表我们可以了解数据的转发路径。
2：输出端口统计
当我们想查看端口数据的接收发送具体情况时候，可以清楚看到端口最大传输单元大小，多少发送/接受成功，发送失败，丢弃，这个命令很好用。
:~$ netstat -i
Kernel Interface table
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
br-4b26bd39c37a 1500 0 0 0 0 0 0 0 0 0 BMU
br-7cd2cb091bc4 1500 0 97 0 0 0 11877 0 0 0 BMRU
docker0 1500 0 314609 0 0 0 476577 0 0 0 BMRU
eth0 1500 0 96232239 0 2450 0 39010081 0 0 0 BMRU
eth1 1500 0 834319 0 294 0 160171 0 0 0 BMRU
eth2 1500 0 82955438 0 173 0 88265174 0 0 0 BMRU
lo 65536 0 4635803 0 0 0 4635803 0 0 0 LRU
veth057385f 1500 0 212497 0 0 0 305985 0 0 0 BMRU
3:查看具体协议数据信息
Ip:
141075343 total packets received
10 with invalid addresses
760518 forwarded
0 incoming packets discarded
138706614 incoming packets delivered
126158220 requests sent out
36 reassemblies required
18 packets reassembled ok
Icmp:
1565357 ICMP messages received
854 input ICMP message failed.
ICMP input histogram:
destination unreachable: 179138
echo requests: 4
echo replies: 1386215
1622403 ICMP messages sent
0 ICMP messages failed
ICMP output histogram:
destination unreachable: 167243
echo request: 1455156
echo replies: 4
IcmpMsg:
InType0: 1386215
InType3: 179138
4：查看网络对应进程
因为是获取系统上的所有socket信息，需要获得root权限才能查看到具体进程id或者文件路径。
:~$ sudo netstat -p
[sudo] password for ive:
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags Type State I-Node PID/Program name Path
unix 2 [ ] DGRAM 15039915 46520/systemd /run/user/1015/systemd/notify
5： 列出所有处于监听状态的 Sockets
信息太长，截取了部分
$ netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:netbios-ssn *:* LISTEN
tcp 0 0 *:38796 *:* LISTEN