Linux netstat 命令

netstat 是Linux系统管理常用的一个命令，尤其是在进行网络相关问题排查的时候更是堪称‘瑞士***’。本人一直以来也只是对常用的几个选项如（a 、n、 p、 t、 u）等几个选项较为熟悉，但是对于netstat显示出来的连接的 状态信息，如下图650) this.width=650;" src="/upload/getfiles/default/2022/11/13/20221113101514229.jpg" title="1.png" />

多数还了解的不够透彻，今天有时间，特此照着man文档加深一下理解。

netstat - Print network connections, routing tables, interface statistics, masquerade connections, and multicast memberships

SYNOPSIS（概要）
       netstat  [address_family_options（地址族选项）]  [--tcp|-t] [--udp|-u] [--raw|-w] [--listening|-l] [--all|-a] [--numeric|-n] [--numeric-hosts][--numeric-ports][--numeric-ports] [--sym-bolic|-N] [--extend|-e[--extend|-e]] [--timers|-o] [--program|-p] [--verbose|-v] [--continuous|-c] [delay]
       netstat {--route|-r} [address_family_options] [--extend|-e[--extend|-e]]  [--verbose|-v]  [--numeric|-n]  [--numeric-hosts][--numeric-ports][--numeric-ports]  [--continu-ous|-c] [delay]
       netstat {--interfaces|-I|-i} [iface] [--all|-a] [--extend|-e] [--verbose|-v] [--program|-p] [--numeric|-n] [--numeric-hosts][--numeric-ports][--numeric-ports] [--continu-ous|-c] [delay]
       netstat {--groups|-g} [--numeric|-n] [--numeric-hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay]
       netstat {--masquerade|-M} [--extend|-e] [--numeric|-n] [--numeric-hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay]
       netstat {--statistics|-s} [--tcp|-t] [--udp|-u] [--raw|-w] [delay]
       netstat {--version|-V}
       netstat {--help|-h}
       address_family_options:
       [--protocol={inet,unix,ipx,ax25,netrom,ddp}[,...]]  [--unix|-x] [--inet|--ip] [--ax25] [--ipx] [--netrom] [--ddp]
NOTE
       This program is obsolete.  Replacement for netstat is ss.  Replacement for netstat -r is ip route.  Replacement for netstat -i is ip -s link.  Replacement for netstat  -g
is ip maddr.

注：这个程序已经是是老旧的/废弃的了（但是依然很常用）。新版本的系统以ss命令来替代netstat，以ip route来替代netstat -r，以ip maddr来替代netstat -g。

DESCRIPTION（摘要）
       Netstat prints information about the Linux networking subsystem.  The type of information printed is controlled by the first argument, as follows:

    netstat 打印Linux网络子系统的信息，输出的信息样式由第一个参数来控制，如下：

(none)
       By  default,  netstat  displays  a  list  of  open sockets.  If you don’t specify any address families, then the active sockets of all configured address families will be
printed.
    （无参数）默认的，netstat显示所有系统套接字的列表。如果你不指定任何的地址族，所有的被配置的地址族的活动套接字将会被显示。
   --route , -r
       Display the kernel routing tables.
    显示内核路由表
   --groups , -g
       Display multicast group membership information for IPv4 and IPv6.
    显示IPv4和IPv6的多播组成员信息。

   --interfaces=iface , -I=iface , -i
       Display a table of all network interfaces, or the specified iface.
    显示所有网络接口的信息表，或者显示指定的接口
   --masquerade , -M
       Display a list of masqueraded connections.
    显示伪装的连接
   --statistics , -s
       Display summary statistics for each protocol.

    按照协议类型显示各协议的汇总信息

OPTIONS（选项）
   --verbose , -v
       Tell the user what is going on by being verbose. Especially print some useful information about unconfigured address families.
   --numeric , -n       Show numerical addresses instead of trying to determine symbolic host, port or user names.
   --numeric-hosts
       shows numerical host addresses but does not affect the resolution of port or user names.
   --numeric-ports
       shows numerical port numbers but does not affect the resolution of host or user names.
   --numeric-users
       shows numerical user IDs but does not affect the resolution of host or port names.
   --protocol=family , -A （协议族类型）
       Specifies the address families (perhaps better described as low level protocols) for which connections are to be shown.  family is a comma (’,’) separated list of address
family keywords like inet, unix, ipx, ax25, netrom, and ddp.  This has the same effect as using the --inet, --unix (-x), --ipx, --ax25, --netrom, and --ddp options.
       The address family inet includes raw, udp and tcp protocol sockets.

   -c, --continuous
       This will cause netstat to print the selected information every second continuously（连续不断的）.
   -e, --extend
       Display additional information.  Use this option twice for maximum detail.
    显示更多的信息，用-ee 显示最多的信息
   -o, --timers
       Include information related to networking timers.
    显示和网络计时器相关的信息
   -p, --program
       Show the PID and name of the program to which each socket belongs.
    显示连接所属的PID和程序名称
   -l, --listening
       Show only listening sockets.  (These are omitted by default.)
    只显示监听的套接字（端口）默认是忽略这个选项的
   -a, --all
       Show both listening and non-listening (for TCP this means established connections) sockets.  With the --interfaces option, show interfaces that are not marked
   -F
       Print routing information from the FIB.  (This is the default.)
   -C
       Print routing information from the route cache.
   -Z --context
       If SELinux enabled print SELinux context.
   -T --notrim
       Stop trimming long addresses.
   delay
       Netstat will cycle printing through statistics every delay seconds

接下来是重头戏了，深入理解netstat的输出，这里才是实际能帮助我们、给我们提示的地方。

OUTPUT（输出）

650) this.width=650;" src="/upload/getfiles/default/2022/11/13/20221113101514741.jpg" title="2.png" />

   Active Internet connections (TCP, UDP, raw)
   Proto
       The protocol (tcp, udp, raw) used by the socket
   Recv-Q
       The count of bytes not copied by the user program connected to this socket.
    不是由连接到这个套接字的用户程序复制的字节数
   Send-Q
       The count of bytes not acknowledged by the remote host.
    还未被远程主机确认的字节数

    上面两个输出，我理解应该是接收和发送的网络队列情况

   Local Address
       Address  and port number of the local end of the socket.  Unless the --numeric (-n) option is specified, the socket address is resolved to its canonical host name (FQDN),
and the port number is translated into the corresponding service name.
   Foreign Address
       Address and port number of the remote end of the socket.  Analogous to "Local Address."
   State（连接状态，共12中状态，重点。这里需要和TCP三次握手各状态相对应）
       The state of the socket. Since there are no states in raw mode and usually no states used in UDP, this column may be left blank. Normally this can be one of several  val-ues:
       ESTABLISHED
          The socket has an established connection.

      代表一个打开的连接，双方可以进行或已经在数据交互了。代表一个打开的连接，数据可以传送给用户

       SYN_SENT
          The socket is actively attempting to establish a connection.

       客户端通过应用程序调用connect进行active open.于是客户端tcp发送一个SYN以请求建立一个连接.之后状态置为SYN_SENT.在发送连接请求后等待匹配的连接请求

       SYN_RECV
              A connection request has been received from the network.

       服务端应发出ACK确认客户端的SYN,同时自己向客户端发送一个SYN. 之后状态置为SYN_RECV.在收到和发送一个连接请求后等待对连接请求的确认

       FIN_WAIT1
          The socket is closed, and the connection is shutting down.

       主动关闭(active close)端应用程序调用close，于是其TCP发出FIN请求主动关闭连接，之后进入FIN_WAIT1状态.等待远程TCP的连接中断请求，或先前的连接中断请求的确认

       FIN_WAIT2
          Connection is closed, and the socket is waiting for a shutdown from the remote end.

       主动关闭端接到ACK后，就进入了 FIN-WAIT2 . 从远程TCP等待连接中断请求

       TIME_WAIT
          The socket is waiting after close to handle packets still in the network.
       在主动关闭端接收到FIN后，TCP 就发送ACK包，并进入TIME-WAIT状态。等待足够的时间以确保远程TCP接收到连接中断请求的确认

       CLOSED The socket is not being used.
    被动关闭端在接受到ACK包后，就进入了closed的状态。连接结束.没有任何连接状态

       CLOSE_WAIT
          The remote end has shut down, waiting for the socket to close.
    被动关闭(passive close)端TCP接到FIN后，就发出ACK以回应FIN请求(它的接收也作为文件结束符传递给上层应用程序),并进入CLOSE_WAIT.等待从本地用户发来的连接中断请求

       LAST_ACK
          The remote end has shut down, and the socket is closed. Waiting for acknowledgement.
    被动关闭端一段时间后，接收到文件结束符的应用程序将调用CLOSE关闭连接。这导致它的TCP也发送一个 FIN,等待对方的ACK.就进入了LAST-ACK .等待原来发向远程TCP的连接中断请求的确认

       LISTEN The socket is listening for incoming connections.  Such sockets are not included in the output unless you specify the --listening (-l) or --all (-a) option.
    首先服务端需要打开一个socket进行监听，状态为LISTEN.侦听来自远方TCP端口的连接请求

       CLOSING
          Both sockets are shut down but we still don’t have all our data sent.
    双方主机的套接字都已关闭，但是还没有完全发送完所有数据
       UNKNOWN （未知状态）
          The state of the socket is unknown.
   User
       The username or the user id (UID) of the owner of the socket.

    socket所属的用户名或者用户UID
   PID/Program name
       Slash-separated pair of the process id (PID) and process name of the process that owns the socket. --program causes this column to be included. You will also need superuser privileges to see this information on sockets you don‘t own.This identification information is not yet available for IPX sockets.

以上就是netstat的基本用法以及输出信息解释，日常要多实践才能深刻的理解其中含义，才能学以致用。共勉！

原文：http://kaifly.blog.51cto.com/3209616/1615401