The first and most simple command is to list out all the current connections. Simply run the netstat command with the a option.
$ netstat -a
The above command shows all connections from different protocols like tcp, udp and unix sockets. However this is not quite useful. Administrators often want to pick out specific connections based on protocols or port numbers for example.
To list out only tcp connections use the t options.
$ netstat -at
Similarly to list out only udp connections use the u option.
$ netstat -au
The above output shows both ipv4 and ipv6 connections.
By default, the netstat command tries to find out the hostname of each ip address in the connection by doing a reverse dns lookup. This slows down the output. If you do not need to know the host name and just the ip address is sufficient then suppress the hostname lookup with the n option.
$ netstat -ant
The above command shows ALL TCP connections with NO dns resolution. Got it ? Good.
4. List out only listening connections
Any network daemon/service keeps an open port to listen for incoming connections. These too are like socket connections and are listed out by netstat. To view only listening ports use the l options.
$ netstat -tnl
Now we can see only listening tcp ports/connections. If you want to see all listening ports, remove the t option. If you want to see only listening udp ports use the u option instead of t.
Make sure to remove the ‘a’ option, otherwise all connections would get listed and not just the listening connections.
When viewing the open/listening ports and connections, its often useful to know the process name/pid which has opened that port or connection. For example the Apache httpd server opens port 80. So if you want to check whether any http server is running or not, or which http server is running, apache or nginx, then track down the process name.
The process details are made available by the ‘p’ option.
~$ sudo netstat -nlpt
When using the p option, netstat must be run with root privileges, otherwise it cannot detect the pids of processes running with root privileges and most services like http and ftp often run with root privileges.
Along with process name/pid its even more useful to get the username/uid owning that particular process. Use the e option along with the p option to get the username too.
$ sudo netstat -ltpe
The above example lists out Listening connections of Tcp type with Process information and Extended information.
The extended information contains the username and inode of the process. This is a useful command for network administrators.
Note – If you use the n option with the e option, the uid would be listed and not the username.
The netstat command can also print out network statistics like total number of packets received and transmitted by protocol type and so on.
To list out statistics of all packet types
$ netstat -s
To print out statistics of only select protocols like TCP or UDP use the corresponding options like t and u along with the s option. Simple!
The kernel routing information can be printed with the r option. It is the same output as given by the route command. We also use the n option to disable the hostname lookup.
$ netstat -rn
The netstat command can also print out the information about the network interfaces. The i option does the task.
$ netstat -i
The above output contains information in a very raw format. To get a more human friendly version of the output use the e option along with i.
$ netstat -ie
The above output is similar to the output shown by the ifconfig command.
Netstat can output connection information continuously with the c option.
$ netstat -ct
The above command will output tcp connections continuously.
The g option will display the multicast group information for IPv4 and IPv6 protocols.$ netstat -g
Okay, we covered the basic examples of netstat command above. Now its time to do some geek stuff with style.
Active socket connections are in “ESTABLISHED” state. So to get all current active connections use netstat with grep as follows
$ netstat -atnp | grep ESTA
To watch a continous list of active connections, use the watch command along with netstat and grep$ watch -d -n0 “netstat -atnp | grep ESTA”
If you want to check if a server like http,smtp or ntp is running or not, use grep again.
$ sudo netstat -aple | grep ntp
So we found that ntp server is running. Grep for http or smtp or whatever you are looking for.
Well, that was most of what netstat is used for. If you are looking for more advanced information or want to dig deeper, read up the netstat manual (man netstat).
And do leave your feedback and suggestions in the comments box below.
Bài viết gốc được đăng bởi Icdung.top
You need to login in order to like this post: click here
YOU MIGHT ALSO LIKE
