首先，使用netstat命令需要安裝net-tools工具包
yum -y install net-tools
這樣你就有了兩個linux的常用命令，netstat以及ifconfig
第一部分：用法
1、如果查看所有的linux的socker（套接字）
[root@production-001 ~]# netstat -a
顯示如下（我粘出了一部分），會打印出Active Internet connections (servers and established和Active UNIX domain sockets (servers and established)兩段；分別是活躍的網絡連接和活躍的unix套接字連接
Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 VM_0_7_cento:cslistener 0.0.0.0:* LISTEN tcp 0 0 VM_0_7_centos:6379 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:http 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN tcp 0 0 syt-production-00:48873 19.54.0.5:lsi-bobcat ESTABLISHED tcp 0 36 syt-production-001:ssh 12.12.11.19:51590 ESTABLISHED tcp6 0 0 [::]:mysql [::]:* LISTEN udp 0 0 0.0.0.0:bootpc 0.0.0.0:* udp 0 0 syt-production-001:ntp 0.0.0.0:* udp 0 0 VM_0_7_centos:ntp 0.0.0.0:* udp6 0 0 syt-production-001:ntp [::]:* udp6 0 0 VM_0_7_centos:ntp [::]:* Active UNIX domain sockets (servers and established) Proto RefCnt Flags Type State I-Node Path unix 2 [ ACC ] STREAM LISTENING 12048 /run/dbus/system_bus_socket unix 3 [ ] STREAM CONNECTED 899033 /usr/local/yd.socket.client unix 2 [ ACC ] STREAM LISTENING 14887 /var/run/lsm/ipc/sim unix 2 [ ACC ] STREAM LISTENING 1267868 /opt/mysql/mysql/data/mysql.sock unix 3 [ ] DGRAM 8032 /run/systemd/notify unix 2 [ ] DGRAM 8034 /run/systemd/cgroups-agent unix 2 [ ACC ] STREAM LISTENING 8042 /run/systemd/journal/stdout unix 5 [ ] DGRAM 8045 /run/systemd/journal/socket unix 11 [ ] DGRAM 8047 /dev/log unix 2 [ ACC ] STREAM LISTENING 14471 /run/systemd/private unix 2 [ ACC ] STREAM LISTENING 13980 /var/run/acpid.socket unix 2 [ ACC ] STREAM LISTENING 899772 /usr/local/yd.socket.server unix 2 [ ACC ] SEQPACKET LISTENING 14506 /run/udev/control
2、查詢所有的TCP或者UDP連接
TCP連接是-t，UDP連接是-u
[root@production-001 ~]# netstat -at
以下可以看到Local Address段顯示了主機的域名，這種情況會拖慢netstat命令的執行速度
Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 VM_0_7_cento:cslistener 0.0.0.0:* LISTEN tcp 0 0 VM_0_7_centos:6379 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:http 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN tcp 0 0 production-00:48873 19.54.0.5:lsi-bobcat ESTABLISHED tcp 0 36 production-001:ssh 12.12.11.19:51590 ESTABLISHED tcp 0 0 production-001:http dynamicip-176-215:53436 TIME_WAIT tcp6 0 0 [::]:mysql [::]:* LISTEN
3、拒絕名稱解析
[root@production-001 ~]# netstat -ant
Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 127.0.0.1:9000 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 172.17.0.7:48873 169.254.0.55:5574 ESTABLISHED tcp 0 36 172.17.0.7:22 12.12.11.19:51590 ESTABLISHED tcp6 0 0 :::3306 :::* LISTEN
4、顯示服務器監聽的連接（LISTEN狀態的連接，可用於查詢服務狀態）
[root@production-001 ~]# netstat -lnt
可以看出我的服務器跑了php、web、數據庫之類的服務
Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 127.0.0.1:9000 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp6 0 0 :::3306 :::* LISTEN
5、顯示socket對應的進程、用戶等，這也是我們最常用的兩種方法
如下查詢server的LISTEN狀態的TCP socket
[root@production-001 ~]# netstat -lnpt
Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:9000 0.0.0.0:* LISTEN 11821/php-fpm: mast tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN 2058/redis-server 1 tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 344/nginx: master p tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 3301/sshd tcp6 0 0 :::3306 :::* LISTEN 10668/mysqld
如下查詢server的所有存在的TCP socket
[root@production-001 ~]# netstat -anpt
Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:9000 0.0.0.0:* LISTEN 11821/php-fpm: mast tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN 2058/redis-server 1 tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 344/nginx: master p tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 3301/sshd tcp 0 0 172.17.0.7:48873 169.254.0.55:5574 ESTABLISHED 24217/YDService tcp 0 36 172.17.0.7:22 12.12.11.19:51590 ESTABLISHED 19772/sshd: root@pt tcp6 0 0 :::3306 :::* LISTEN 10668/mysqld
6、打印統計數據
[root@syt-production-001 ~]# netstat -s
Ip: 4938968 total packets received 0 forwarded 0 incoming packets discarded 4938957 incoming packets delivered 4805326 requests sent out 16 dropped because of missing route Icmp: 769554 ICMP messages received 16 input ICMP message failed. ICMP input histogram: destination unreachable: 28 timeout in transit: 1 echo requests: 769523 echo replies: 2 769525 ICMP messages sent 0 ICMP messages failed ICMP output histogram: destination unreachable: 2 echo replies: 769523 IcmpMsg: InType0: 2 InType3: 28 InType8: 769523 InType11: 1 OutType0: 769523 OutType3: 2 Tcp: 535366 active connections openings 6904 passive connection openings 828 failed connection attempts 634 connection resets received 2 connections established 4094321 segments received 3971608 segments send out 4377 segments retransmited 8 bad segments received. 5335 resets sent Udp: 142930 packets received 2 packets to unknown port received. 0 packet receive errors 143872 packets sent 0 receive buffer errors 0 send buffer errors UdpLite: TcpExt: 201 invalid SYN cookies received 637 resets received for embryonic SYN_RECV sockets 6606 TCP sockets finished time wait in fast timer 900 TCP sockets finished time wait in slow timer 888 delayed acks sent 5 delayed acks further delayed because of locked socket Quick ack mode was activated 438 times 8 SYNs to LISTEN sockets dropped 38 packets directly queued to recvmsg prequeue. 34 bytes directly in process context from backlog 124 bytes directly received in process context from prequeue 1145495 packet headers predicted 2 packets header predicted and directly queued to user 1666927 acknowledgments not containing data payload received 87604 predicted acknowledgments 2 times recovered from packet loss due to fast retransmit 2 congestion windows fully recovered without slow start 2172 congestion windows recovered without slow start after partial ack 2 timeouts after reno fast retransmit 191 timeouts in loss state 12 fast retransmits 42 retransmits in slow start 4019 other TCP timeouts 245 connections reset due to unexpected data 60 connections reset due to early user close 198 connections aborted due to timeout TCPSpuriousRTOs: 147 TCPRcvCoalesce: 529861 TCPOFOQueue: 348 TCPOFOMerge: 2 TCPChallengeACK: 14 TCPSYNChallenge: 13 TCPFastOpenCookieReqd: 1 TCPSpuriousRtxHostQueues: 3 TCPWantZeroWindowAdv: 16373 TCPSynRetrans: 550 TCPOrigDataSent: 1907609 TCPHystartTrainDetect: 6 TCPHystartTrainCwnd: 281 TCPHystartDelayDetect: 3 TCPHystartDelayCwnd: 288 TCPACKSkippedSynRecv: 4 TCPACKSkippedSeq: 1 IpExt: InNoRoutes: 4 InMcastPkts: 15886 OutMcastPkts: 14 InOctets: 1169867332 OutOctets: 581042663 InMcastOctets: 572027 OutMcastOctets: 669 InNoECTPkts: 4969489 InECT1Pkts: 10 InECT0Pkts: 32
第二部分：選項解釋（詳情可參閱netstat --help，拿過來翻譯工具走一波）
-r, --route display routing table /顯示路由信息 -I, --interfaces=<Iface> display interface table for <Iface> /顯示某個網卡信息 -i, --interfaces display interface table /顯示網卡信息 -g, --groups display multicast group memberships /顯示多播組信息；什麼網卡、loopback口ipv4、ipv6的，還有wlan的等等信息 -s, --statistics display networking statistics (like SNMP) /打印netstat各種協議類型的連接統計信息 -M, --masquerade display masqueraded connections /顯示ip_masqueraded的連接，這裏解釋以下ip_masqueraded，實際是NAT實現的一種，可以使多個ip發送數據包的源ip轉換爲同一個ip去發送，用於僞裝原本發送數據的設備的ip -v, --verbose be verbose /打印詳細信息 -W, --wide don't truncate IP addresses /不截斷IP地址，避免該命令截斷ip連接 -n, --numeric don't resolve names /不解析名稱 --numeric-hosts don't resolve host names /不解析主機名稱 --numeric-ports don't resolve port names /不解析端口名稱 --numeric-users don't resolve user names /不解析用戶名稱 -N, --symbolic resolve hardware names /解析硬件名稱 -e, --extend display other/more information /顯示其他或者更多信息 -p, --programs display PID/Program name for sockets /打印socket連接的PID、進程名 -o, --timers display timers /顯示計時器 -c, --continuous continuous listing /連續監聽，會一直輸出 -l, --listening display listening server sockets /打印LISTEN狀態的連接 -a, --all display all sockets (default: connected) /打印所有 -F, --fib display Forwarding Information Base (default) /顯示轉發信息庫，路由表（默認） -C, --cache display routing cache instead of FIB /顯示路由緩存 -Z, --context display SELinux security context for sockets /顯示selinux安全上下文連接
第三部分：連接狀態解析
通常情況下：一個正常的TCP連接，都會有三個階段（1、TCP三次握手 2、數據傳送 3、TCP四次揮手）
SYN： (同步序列編號，Synchronize Sequence Numbers)該標誌僅在三次握手建立TCP連接時有效。表示一個新的TCP連接請求。
ACK： (確認編號，Acknowledgement Number)是對TCP請求的確認標誌，同時提示對端系統已經成功接收所有數據。
FIN：(結束標誌，finish)用來結束一個TCP回話.但對應端口仍處於開放狀態，準備接收後續數據。
1)、LISTEN：首先服務端需要打開一個socket進行監聽，狀態爲LISTEN. /* The socket is listening for incoming connections. 偵聽來自遠方TCP端口的連接請求 */
2)、SYN_SENT：客戶端通過應用程序調用connect進行active open.於是客戶端tcp發送一個SYN以請求建立一個連接.之後狀態置爲SYN_SENT. /*The socket is actively attempting to establish a connection. 在發送連接請求後等待匹配的連接請求 */
3)、SYN_RECV：服務端應發出ACK確認客戶端的SYN，同時自己向客戶端發送一個SYN. 之後狀態置爲SYN_RECV /* A connection request has been received from the network. 在收到和發送一個連接請求後等待對連接請求的確認 */
4)、ESTABLISHED： 代表一個打開的連接，雙方可以進行或已經在數據交互了。/* The socket has an established connection. 代表一個打開的連接，數據可以傳送給用戶 */
5)、FIN_WAIT1：主動關閉(active close)端應用程序調用close，於是其TCP發出FIN請求主動關閉連接，之後進入FIN_WAIT1狀態./* The socket is closed, and the connection is shutting down. 等待遠程TCP的連接中斷請求，或先前的連接中斷請求的確認 */
6)、CLOSE_WAIT：被動關閉(passive close)端TCP接到FIN後，就發出ACK以迴應FIN請求(它的接收也作爲文件結束符傳遞給上層應用程序),並進入CLOSE_WAIT. /* The remote end has shut down, waiting for the socket to close. 等待從本地用戶發來的連接中斷請求 */
7)、FIN_WAIT2：主動關閉端接到ACK後，就進入了FIN-WAIT-2 ./* Connection is closed, and the socket is waiting for a shutdown from the remote end. 從遠程TCP等待連接中斷請求 */
8)、LAST_ACK：被動關閉端一段時間後，接收到文件結束符的應用程序將調用CLOSE關閉連接。這導致它的TCP也發送一個 FIN，等待對方的ACK.就進入了LAST-ACK . /* The remote end has shut down, and the socket is closed. Waiting for acknowledgement. 等待原來發向遠程TCP的連接中斷請求的確認 */
9)、TIME_WAIT：在主動關閉端接收到FIN後，TCP就發送ACK包，並進入TIME-WAIT狀態。/* The socket is waiting after close to handle packets still in the network.等待足夠的時間以確保遠程TCP接收到連接中斷請求的確認 */
10)、CLOSING：比較少見./* Both sockets are shut down but we still don’t have all our data sent. 等待遠程TCP對連接中斷的確認 */
11)、CLOSED：被動關閉端在接受到ACK包後，就進入了closed的狀態。連接結束./* The socket is not being used. 沒有任何連接狀態 */
TIME_WAIT狀態的形成只發生在主動關閉連接的一方。
主動關閉方在接收到被動關閉方的FIN請求後，發送成功給對方一個ACK後，將自己的狀態由FIN_WAIT2修改爲TIME_WAIT，而必須再等2倍 的MSL(Maximum Segment Lifetime，MSL是一個數據報在internetwork中能存在的時間)時間之後雙方纔能把狀態 都改爲CLOSED以關閉連接。目前RHEL裏保持TIME_WAIT狀態的時間爲60秒。