[Linux] netstat命令和ss命令

╰半夏微凉° 2022-10-22 09:11 223阅读 0赞

**1. netstat输出结果**

netstat的输出结果可以分为两个部分  
Part1 => Active Internet connections 有源TCP连接，其中"Recv-Q"和"Send-Q"指接收队列和发送队列；这些数字如果不为0则表示软件包正在队列中堆积。  
Part2 => Active UNIX domain sockets 有源Unix域套接口，只能用于本机通信，性能可以提高一倍。

注：netstat默认不显示udp协议、不显示状态为LISTEN

[root@xxserver bin]# netstat
    Active Internet connections (w/o servers)
    Proto Recv-Q Send-Q Local Address           Foreign Address         State
    tcp       32      0 HA-node1-cluster-he:35762 HA-node1-cluster-h:efi-mg CLOSE_WAIT
    tcp       32      0 HA-node1-cluster-he:48560 HA-node2-cluster-h:efi-mg CLOSE_WAIT
    tcp        0      0 xxserver:ssh             169.177.166.247:53827   ESTABLISHED
    ……
    tcp6       0      0 localhost:44208         localhost:mysql         ESTABLISHED
    tcp6       0      0 localhost:61613         localhost:34190         ESTABLISHED
    Active UNIX domain sockets (w/o servers)
    Proto RefCnt Flags       Type       State         I-Node   Path
    unix  3      [ ]         DGRAM                    11527    /run/systemd/notify
    unix  2      [ ]         DGRAM 
    ……
    unix  3      [ ]         STREAM     CONNECTED     32670    /run/dbus/system_bus_socket

**2.常用参数**

\-a 显示所有选项，默认不显示LISTEN相关  
\-t 仅显示tcp相关选项  
\-u 仅显示udp相关选项  
\-w 仅显示RAW相关选项  
\-x 仅显示unix相关选项  
\-n 拒绝显示别名，能显示数字的全部转化成数字  
\-l 仅列出有在 Listen (监听) 的服务状态  
\-p 显示正在使用Socket的程序名和PID  
\-r 显示路由表  
\-i 显示网络接口列表  
\-s 按各个协议进行统计  
\-c 每隔一个固定时间执行该netstat命令

举例：

(1) -a 列出所有端口(包括监听和未监听的)  
netstat -a  列出所有端口  
netstat -at 列出所有 tcp 端口   
netstat -au 列出所有 udp 端口

(2) -l 只显示监听端口  
只显示监听端口 netstat -l  
只列出所有监听 tcp 端口 netstat -lt  
只列出所有监听 udp 端口 netstat -lu  
只列出所有监听 UNIX 端口 netstat -lx

说明：为什么udp和raw的State不打印LISTEN? 查看 man netstat解释如下

Since there are no states in raw mode and usually no states used in UDP and UDPLite, this column may be left blank.

[root@xxserver bin]# netstat -l
    Active Internet connections (only servers)
    Proto Recv-Q Send-Q Local Address           Foreign Address         State
    tcp        0      0 0.0.0.0:rsync           0.0.0.0:*               LISTEN
    tcp6       0      0 [::]:42242              [::]:*                  LISTEN
    ……
    udp        0      0 HA-node1-ne:45334         0.0.0.0:*
    udp6       0      0 192.169.4.202:snmptrap  [::]:*
    raw6       0      0 [::]:ipv6-icmp          [::]:*                  7
    Active UNIX domain sockets (only servers)
    Proto RefCnt Flags       Type       State         I-Node   Path
    unix  2      [ ACC ]     STREAM     LISTENING     42703    private/relay
    unix  2      [ ACC ]     STREAM     LISTENING     42712    private/retry
    ……

(3) netstat -s 显示每个协议的统计信息

(4) netstat -p 输出中显示PID和进程名称

[root@xxserver ~]# netstat -ap
    tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN      22533/sshd
    udp6       0      0 192.169.4.202:snmptrap  [::]:*                              26680/java
    ……

(5) netstat -n 输出中不显示主机、端口和用户名 (host, port or user)

[root@xxserver ~]# netstat -anp | grep ssh
    tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      22533/sshd
    udp6       0      0 192.169.4.202:162       :::*                                26680/java
    ……

说明：如果仅不想让其中一个被显示，使用以下命令  
\# netsat -a --numeric-ports  
\# netsat -a --numeric-hosts  
\# netsat -a --numeric-users

(6) netstat -c 持续输出netstat信息  
默认1秒打印一次 netstat -auc | grep snmp  
设置5秒打印一次 netstat -auc 5 | grep snmp

[root@xxxserver ~]# netstat -auc | grep snmp
    Tue Mar 30 17:08:23 CST 2021
    udp6       0      0 192.169.4.202:snmptrap  [::]:*
    udp6       0      0 192.169.4.202:snmptrap  [::]:*
    udp6       0      0 192.169.4.202:snmptrap  [::]:*
    udp6       0      0 192.169.4.202:snmptrap  [::]:*
    ^C
    [root@xxxserver ~]#

(7) 显示路由信息 netstat -r 输出结果同route

(8) 显示网络接口列表 netstat -i，netstat -ie输出结果同ifconfig

[root@xxxserver ~]# netstat -i
    Kernel Interface table
    Iface             MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
    ens164           1500  4649150      0     30 0       6231154      0      0      0 BMRU
    ens192           1500  4596573      0     29 0       2720436      0      0      0 BMRU
    lo              65536 16194199      0      0 0      16194199      0      0      0 LRU
    virbr0           1500        0      0      0 0             0      0      0      0 BMU
    [root@xxxserver ~]#

**3.套接口的State**

**Active Internet connections**  
   State  
       The  state  of the socket. Since there are no states in raw mode and usually no states used in UDP and  
       UDPLite, this column may be left blank. Normally this can be one of several values:

ESTABLISHED  
              The socket has an established connection.  
       SYN\_SENT  
              The socket is actively attempting to establish a connection.  
       SYN\_RECV  
              A connection request has been received from the network.  
       FIN\_WAIT1  
              The socket is closed, and the connection is shutting down.  
       FIN\_WAIT2  
              Connection is closed, and the socket is waiting for a shutdown from the remote end.  
       TIME\_WAIT  
              The socket is waiting after close to handle packets still in the network.  
       CLOSE  The socket is not being used.  
       CLOSE\_WAIT  
              The remote end has shut down, waiting for the socket to close.  
       LAST\_ACK  
              The remote end has shut down, and the socket is closed. Waiting for acknowledgement.  
       LISTEN The socket is listening for incoming connections.  Such sockets are not included in the  output  
              unless you specify the --listening (-l) or --all (-a) option.  
       CLOSING  
              Both sockets are shut down but we still don't have all our data sent.  
       UNKNOWN  
              The state of the socket is unknown.

各个状态解释可参考另一篇博文，**TCP的连接建立和释放 **[https://blog.csdn.net/wy\_hhxx/article/details/103980331][https_blog.csdn.net_wy_hhxx_article_details_103980331]

**Active UNIX domain Sockets**  
   State  
       This field will contain one of the following Keywords:

FREE   The socket is not allocated  
       LISTENING  
              The socket is listening for a connection request.  Such sockets are only included in the output  
              if you specify the --listening (-l) or --all (-a) option.  
       CONNECTING  
              The socket is about to establish a connection.  
       CONNECTED  
              The socket is connected.  
       DISCONNECTING  
              The socket is disconnecting.  
       (empty)  
              The socket is not connected to another one.  
       UNKNOWN  
              This state should never happen.

参考资料：

Linux netstat命令详解及state的含义 https://blog.csdn.net/libaineu2004/article/details/82465215

========================================================================

ss命令，偷个懒 囧

ss比netstat快的主要原因是，netstat是遍历/proc下面每个PID目录，ss直接读/proc/net下面的统计信息。所以ss执行的时候消耗资源以及消耗的时间都比netstat少很多。

ss命令和netstat命令比较   [https://cloud.tencent.com/developer/article/1026969][https_cloud.tencent.com_developer_article_1026969]  
Linux网络状态工具ss命令使用详解   [http://www.ttlsa.com/linux-command/ss-replace-netstat/][http_www.ttlsa.com_linux-command_ss-replace-netstat]

[https_blog.csdn.net_wy_hhxx_article_details_103980331]: https://blog.csdn.net/wy_hhxx/article/details/103980331
[https_cloud.tencent.com_developer_article_1026969]: https://cloud.tencent.com/developer/article/1026969
[http_www.ttlsa.com_linux-command_ss-replace-netstat]: http://www.ttlsa.com/linux-command/ss-replace-netstat/