在工作中，经常用到很多linux命令，netstat这个也属于查看网络情况的一个常用命令，以前常常用到，但只是知道带上一些参数：比如-anp 、-ln之类的组合，具体的含义和Output出来的一些选项都只是知道个大概，在查看了man文档以及部分资料后，这里整理下对于该命令的一些理解和说明。
]# man netstat
可以看到介绍如下：
NAME
netstat - Print network connections, routing tables, interface statistics, masquerade connections, and multi-cast memberships
基本可以阐述为一个查看网络情况的命令。
常用的选项有：
-a：将目前系统上所有的联机、监听、Socket数据都列出来
-t：列出tcp网络封包的数据
-u：列出udp网络封包的数据
-n：不以程序的服务名称，以port number来显示
-l：列出目前正在网络监听(listen)的服务
-p：列出该网络服务程序的PID
当然man文档中有所以选项的说明：
OPTIONS
--verbose , -v
Tell the user what is going on by being verbose. Especially print some useful information about unconfigured
address families.
--numeric , -n
Show numerical addresses instead of trying to determine symbolic host, port or user names.
--numeric-hosts
shows numerical host addresses but does not affect the resolution of port or user names.
--numeric-ports
shows numerical port numbers but does not affect the resolution of host or user names.
--numeric-users
shows numerical user IDs but does not affect the resolution of host or port names.
--protocol=family , -A
Specifies the address families (perhaps better described as low level protocols) for which connections are to
be shown. family is a comma (’,’) separated list of address family keywords like inet, unix, ipx, ax25,
netrom, and ddp. This has the same effect as using the --inet, --unix (-x), --ipx, --ax25, --netrom, and --ddp
options.
The address family inet includes raw, udp and tcp protocol sockets.
-c, --continuous
This will cause netstat to print the selected information every second continuously.
-e, --extend
Display additional information. Use this option twice for maximum detail.
-o, --timers
Include information related to networking timers.
-p, --program
Show the PID and name of the program to which each socket belongs.
-l, --listening
Show only listening sockets. (These are omitted by default.)
-a, --all
Show both listening and non-listening sockets. With the --interfaces option, show interfaces that are not
marked
-F
Print routing information from the FIB. (This is the default.)
-C
Print routing information from the route cache.
-Z --context
If SELinux enabled print SELinux context.
-T --notrim
Stop trimming long addresses.
delay
Netstat will cycle printing through statistics every delay seconds. UP.
直接不带选项输入命令：
~]# netstat
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 Slave1.Hadoop:53494 192.168.6.7:5667 TIME_WAIT
tcp 0 0 Slave1.Hadoop:27017 Slave2.Hadoop:38188 ESTABLISHED
tcp 0 0 Slave1.Hadoop:imap ::ffff:192.168.8.153:50678 ESTABLISHED
tcp 0 0 Slave1.Hadoop:imap ::ffff:192.168.8.153:49658 ESTABLISHED
tcp 0 0 Slave1.Hadoop:imap ::ffff:192.168.8.153:49660 ESTABLISHED
tcp 0 0 Slave1.Hadoop:asr ::ffff:192.168.6.7:46707 ESTABLISHED
tcp 0 0 Slave1.Hadoop:imap ::ffff:192.168.8.153:49634 ESTABLISHED
tcp 0 0 Slave1.Hadoop:42228 ::ffff:192.168.8.4:ncube-lm ESTABLISHED
tcp 0 0 Slave1.Hadoop:42527 ::ffff:192.168.8.4:ncube-lm ESTABLISHED
tcp 0 0 Slave1.Hadoop:42530 ::ffff:192.168.8.4:ncube-lm ESTABLISHED
tcp 0 0 Slave1.Hadoop:42531 ::ffff:192.168.8.4:ncube-lm ESTABLISHED
tcp 0 0 Slave1.Hadoop:42528 ::ffff:192.168.8.4:ncube-lm ESTABLISHED
tcp 0 0 Slave1.Hadoop:42529 ::ffff:192.168.8.4:ncube-lm ESTABLISHED
tcp 0 0 Slave1.Hadoop:36207 ::ffff:192.168.8.4:ncube-lm ESTABLISHED
tcp 0 0 Slave1.Hadoop:36206 ::ffff:192.168.8.4:ncube-lm ESTABLISHED
tcp 0 0 Slave1.Hadoop:48458 ::ffff:192.168.6.7:5801 ESTABLISHED
tcp 0 0 Slave1.Hadoop:imap ::ffff:192.168.8.153:59769 ESTABLISHED
tcp 0 0 Slave1.Hadoop:imap ::ffff:192.168.8.153:59774 ESTABLISHED
tcp 0 0 Slave1.Hadoop:45622 ::ffff:192.168.6.7:5701 ESTABLISHED
tcp 0 0 Slave1.Hadoop:imap ::ffff:192.168.8.153:58650 ESTABLISHED
tcp 0 0 Slave1.Hadoop:razor Slave2.Hadoop:54565 ESTABLISHED
tcp 0 0 Slave1.Hadoop:47092 Slave2.Hadoop:compaq-wcp ESTABLISHED
tcp 0 0 Slave1.Hadoop:35664 Slave2.Hadoop:troff ESTABLISHED
tcp 0 0 Slave1.Hadoop:ssh ::ffff:192.168.8.234:53735 ESTABLISHED
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags Type State I-Node Path
unix 29 [ ] DGRAM 6973 /dev/log
unix 2 [ ] DGRAM 1471 @/org/kernel/udev/udevd
unix 2 [ ] DGRAM 7545 @/org/freedesktop/hal/udev_event
unix 2 [ ] DGRAM 23027536
unix 3 [ ] STREAM CONNECTED 23027127 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 23027126
unix 3 [ ] STREAM CONNECTED 23027121
unix 3 [ ] STREAM CONNECTED 23027120
unix 3 [ ] STREAM CONNECTED 23026616 /var/run/dovecot/login/default
........
从上面可以看出显示了两个部分：与网络相关的部分、与本机程序自己的相关部分。
1、先来看看网络相关部分的OUTPUT
Proto：protocol的缩写，网络的封包协议，主要分为TCP与UDP协议，另外从文档看还有个raw；
Recv-Q：非由用户程序链接到此socket的复制的总bytes数；
Send-Q：非由远程主机程序传送过来的acknowledged总管bytes数；
Local Address：本地端的IP：port情况；
Foregin Address：远程主机的IP：port情况；
State：联机状态，主要有建立(ESTABLISED)及监听(LISTEN)；
2、由于linux系统上面的程序是可以接受不同程序所发送来的信息，那就是linux上头的插槽挡(socket file)，这里看看linux本机系统相关部分的OUTPUT说明：
Proto：由于是本机，一般就是unix；
RefCnt：连接到此socket的程序数量；
Flags：联机的旗标；
Type：socket存取的类型，主要有确认联机的STREAM与不需要确认的DGRAM两种；
State：若为CONNECTED表示多个程序之间已经联机建立；
Path：连接到此socket的相关程序的路径！或者是相关数据输出的路径
具体的文档如下：
OUTPUT
Active Internet connections (TCP, UDP, raw)
Proto
The protocol (tcp, udp, raw) used by the socket.
Recv-Q
The count of bytes not copied by the user program connected to this socket.
Send-Q
The count of bytes not acknowledged by the remote host.
Local Address
Address and port number of the local end of the socket. Unless the --numeric (-n) option is specified, the
socket address is resolved to its canonical host name (FQDN), and the port number is translated into the corre-
sponding service name.
Foreign Address
Address and port number of the remote end of the socket. Analogous to "Local Address."
State
The state of the socket. Since there are no states in raw mode and usually no states used in UDP, this column
may be left blank. Normally this can be one of several values:
ESTABLISHED
The socket has an established connection.
SYN_SENT
The socket is actively attempting to establish a connection.
SYN_RECV
A connection request has been received from the network.
FIN_WAIT1
The socket is closed, and the connection is shutting down.
FIN_WAIT2
Connection is closed, and the socket is waiting for a shutdown from the remote end.
TIME_WAIT
The socket is waiting after close to handle packets still in the network.
CLOSED The socket is not being used.
CLOSE_WAIT
The remote end has shut down, waiting for the socket to close.
LAST_ACK
The remote end has shut down, and the socket is closed. Waiting for acknowledgement.
LISTEN The socket is listening for incoming connections. Such sockets are not included in the output unless
you specify the --listening (-l) or --all (-a) option.
CLOSING
Both sockets are shut down but we still don’t have all our data sent.
UNKNOWN
The state of the socket is unknown.
User
The username or the user id (UID) of the owner of the socket.
PID/Program name
Slash-separated pair of the process id (PID) and process name of the process that owns the socket. --program
causes this column to be included. You will also need superuser privileges to see this information on sockets
you don’t own. This identification information is not yet available for IPX sockets.
Timer
(this needs to be written)
Active UNIX domain Sockets
Proto
The protocol (usually unix) used by the socket.
RefCnt
The reference count (i.e. attached processes via this socket).
Flags
The flags displayed is SO_ACCEPTON (displayed as ACC), SO_WAITDATA (W) or SO_NOSPACE (N). SO_ACCECPTON is used
on unconnected sockets if their corresponding processes are waiting for a connect request. The other flags are
not of normal interest.
Type
There are several types of socket access:
SOCK_DGRAM
The socket is used in Datagram (connectionless) mode.
SOCK_STREAM
This is a stream (connection) socket.
SOCK_RAW
The socket is used as a raw socket.
SOCK_RDM
This one serves reliably-delivered messages.
SOCK_SEQPACKET
This is a sequential packet socket.
SOCK_PACKET
Raw interface access socket.
UNKNOWN
Who ever knows what the future will bring us - just fill in here :-)
State
This field will contain one of the following Keywords:
FREE The socket is not allocated
LISTENING
The socket is listening for a connection request. Such sockets are only included in the output if you
specify the --listening (-l) or --all (-a) option.
CONNECTING
The socket is about to establish a connection.
CONNECTED
The socket is connected.
DISCONNECTING
The socket is disconnecting.
(empty)
The socket is not connected to another one.
UNKNOWN
This state should never happen.
PID/Program name
Process ID (PID) and process name of the process that has the socket open. More info available in Active
Internet connections section written above.
Path
This is the path name as which the corresponding processes attached to the socket.
Active IPX sockets
(this needs to be done by somebody who knows it)
Active NET/ROM sockets
(this needs to be done by somebody who knows it)
Active AX.25 sockets
(this needs to be done by somebody who knows it)
NOTES
Starting with Linux release 2.2 netstat -i does not show interface statistics for alias interfaces. To get per
alias interface counters you need to setup explicit rules using the ipchains(8) command.
FILES
/etc/services -- The services translation file
/proc -- Mount point for the proc filesystem, which gives access to kernel status information via the following
files.
/proc/net/dev -- device information
/proc/net/raw -- raw socket information
/proc/net/tcp -- TCP socket information
/proc/net/udp -- UDP socket information
/proc/net/igmp -- IGMP multicast information
/proc/net/unix -- Unix domain socket information
/proc/net/ipx -- IPX socket information
/proc/net/ax25 -- AX25 socket information
/proc/net/appletalk -- DDP (appletalk) socket information
/proc/net/nr -- NET/ROM socket information
/proc/net/route -- IP routing information
/proc/net/ax25_route -- AX25 routing information
/proc/net/ipx_route -- IPX routing information
/proc/net/nr_nodes -- NET/ROM nodelist
/proc/net/nr_neigh -- NET/ROM neighbours
/proc/net/ip_masquerade -- masqueraded connections
/proc/net/snmp -- statistics
可能主要是Recv-Q和Send-Q比较拗口难以理解，这里找到一个比较不错的解释：
"Proto" is short for protocol, which is either TCP or UDP. "Recv-Q" and "Send-Q" mean receiving queue and sending queue. These should always be zero; if they're not you might have a problem. Packets should not be piling up in either queue, except briefly, as this example shows:
tcp 0 593 192.168.1.5:34321 venus.euao.com:smtp ESTABLISHED
That happened when I hit the "check mail" button in KMail; a brief queuing of outgoing packets is normal behavior. If the receiving queue is consistently jamming up, you might be experiencing a denial-of-service attack. If the sending queue does not clear quickly, you might have an application that is sending them out too fast, or the receiver cannot accept them quickly enough.
"Local address" is either your IP and port number, or IP and the name of a service. "Foreign address" is the hostname and service you are connected to. The asterisk is a placeholder for IP addresses, which of course cannot be known until a remote host connects. "State" is the current status of the connection. Any TCP state can be displayed here, but these three are the ones you want to see。
大概意思为：Recv-Q Send-Q分别表示网络接收队列，发送队列；
这两个值通常应该为0，如果不为0可能是有问题的。packets在两个队列里都不应该有堆积状态。可接受短暂的非0情况。如文中的示例，短暂的Send-Q队列发送pakets非0是正常状态。
Recv-Q：表示收到的数据已经在本地接收缓冲，但是还有多少没有被进程取走，recv()
Send-Q：对方没有收到的数据或者说没有Ack的,还是本地缓冲区.
通过netstat的这两个值就可以简单判断程序收不到包到底是包没到还是包没有被进程recv。
所以在网络出现问题的情况下，我们可以用netstat命令来跟踪查找问题，从而解决问题。
相关推荐
Linux 命令之 netstat Netstat 命令是 Linux 系统中一个非常重要的命令，它可以用来查看 Linux 系统中正在使用的服务和端口情况。下面是 Netstat 命令的详细介绍。 Netstat 命令的基本用法 Netstat 命令的基本...
Linux netstat命令详解 Linux netstat命令是一种非常有用的网络命令，用于显示各种网络相关信息，如网络连接、路由表、接口状态、masquerade连接、多播成员等等。本文将详细介绍netstat命令的使用和输出结果的解释...
在深入探讨Linux中netstat命令的丰富功能与应用之前，我们先简要回顾一下netstat的基本定义：netstat是Linux系统中一个强大的网络诊断工具，主要用于显示与IP、TCP、UDP和ICMP协议相关的统计数据，尤其适用于监测和...
Linux中的Netstat命令是一个强大的工具，它用于显示与网络相关的统计数据，包括IP、TCP、UDP和ICMP协议。这些信息对于诊断和优化网络连接、排查问题以及监控系统状态至关重要。以下是对Netstat命令常用选项的详细...
Linux 中的 netstat 命令使用教程 netstat 命令是 Linux 系统中一个非常有用的网络命令，用于显示与 IP、TCP、UDP 和 ICMP 协议相关的统计数据，一般用于检验本机各端口的网络连接情况。下面是对 netstat 命令的...
Linux中的`netstat`命令是网络管理员和系统管理员的重要工具，它用于查看和分析网络连接、路由表、接口状态以及多种网络相关信息。这个命令能够帮助我们监控系统的网络活动，找出可能存在的问题，如端口占用、连接...
Linux是一种开源的、基于Unix的操作系统内核，由林纳斯·托瓦兹（Linus Torvalds）在1991年首次发布。它遵循自由软件和开源开发的原则，任何人都可以自由地使用、修改和分发Linux内核。Linux内核是操作系统的核心...
**Linux网络管理命令——netstat命令详解** 在Linux操作系统中，`netstat`是一个非常重要的网络管理工具，它能够提供关于TCP/IP网络连接、路由表、接口统计等丰富的信息。理解并熟练掌握`netstat`命令，对于系统...
Netstat命令是Linux及类Unix系统中用于查看网络状态的强大工具。它可以帮助用户监控和管理网络连接、路由表、接口状态、多播成员等信息。Netstat对于网络管理员来说非常重要，能够帮助他们诊断网络问题并了解系统的...
本篇课件“Linux基础课件网络管理命令netstat命令共12页”将深入讲解这个实用的命令，帮助用户更好地理解和掌握Linux网络管理。 `netstat`，全称Network Statistics，它提供了对TCP/IP协议栈的统计信息，包括网络...
`netstat`命令是Linux操作系统中的一个强大工具，它用于查看和分析网络状态，包括连接、监听、路由等信息。这个命令对系统管理员和网络调试人员尤其有用，可以帮助他们了解系统的网络活动，诊断网络问题，或者监控...
Linux 网络状态工具 netstat 和 ss 使用详解 Netstat 是一个广泛使用的...在 Linux 系统中，Netstat 和 SS 命令都是非常有用的网络状态工具，帮助管理员和开发者快速了解系统的网络状态，解决网络问题和优化网络性能。
### Netstat命令详解 #### 一、概述 `netstat`命令是计算机系统中一个非常重要的工具，主要用于显示与IP、TCP、UDP和ICMP协议相关的统计数据，可以帮助用户检查网络连接的状态以及诊断网络问题。通过`netstat`，...
#### 四、Linux系统下的Netstat命令使用 ##### 1. 基本语法 ``` netstat [-veenNcCF] [] netstat [-vnNcaeol] [] netstat {[-veenNac]-i [] | [-cnNe]-M | -s} [delay] ``` ##### 2. 参数详解 - `-r` 或 `--routed...
"常用Linux命令rpm包"指的是包含了若干常用Linux命令的RPM软件包，这些命令在日常系统管理和故障排查中非常实用。以下是对这些命令的详细解释： 1. **netstat**：网络状态工具，用于查看网络连接、路由表、接口统计...
`netstat` 是一个命令行工具，用于显示网络连接、路由表、网络接口统计等信息，而 `rmsock` 是一个不太常见的命令，它可能用于删除或管理套接字（socket）连接。让我们深入探讨这两个工具以及如何在Linux系统中根据...
Linux 网络监控命令（netstat） Linux 网络监控命令（netstat）是一种强大的网络监控工具，能够显示 Linux 系统中的网络状态信息。通过使用不同的选项和参数，netstat 命令可以显示各种网络信息，包括 Socket 信息...
Linux netstat命令 Linux netstat命令用于显示网络状态。 利用netstat指令可让你得知整个Linux系统的网络情况。 语法netstat [-acCeFghilMnNoprstuvVwx][-A][--ip] 参数说明： -a或–all 显示所有连线中的Socket。 -...
在Linux操作系统中，管理和监控网络服务以及其使用的端口是系统管理员的重要工作之一。`netstat`（网络状态）是一个非常实用的命令行工具，它提供了查看网络连接、路由表、接口统计等多种功能。在本场景中，我们将...