Linux netstat 命令入門知識

netstat 是Linux系統管理常用的一個命令，尤其是在進行網路相關問題排查的時候更是堪稱‘瑞士***’。本人一直以來也只是對常用的幾個選項如（a 、n、 p、 t、 u）等幾個選項較為熟悉，但是對於netstat顯示出來的連線的 狀態資訊，如下圖

多數還了解的不夠透徹，今天有時間，特此照著man文件加深一下理解。

Linux netstat命令詳解 http://www.linuxidc.com/Linux/2012-12/75667.htm

使用netstat檢測及監測網路連線  http://www.linuxidc.com/Linux/2014-09/106497.htm

Netstat 的10個基本用法 http://www.linuxidc.com/Linux/2014-01/94644.htm

Linux netstat命令 http://www.linuxidc.com/Linux/2013-06/85528.htm

Linux命令：service & netstat  http://www.linuxidc.com/Linux/2011-12/48395.htm

Linux下用netstat命令檢視網路負載狀況的一條語句 http://www.linuxidc.com/Linux/2011-08/41429.htm

LPI認證考試學習之Linux netstat 命令詳解 http://www.linuxidc.com/Linux/2009-12/23197.htm

netstat - Print network connections, routing tables, interface statistics, masquerade connections, and multicast memberships

SYNOPSIS（概要）
      netstat  [address_family_options（地址族選項）]  [--tcp|-t] [--udp|-u] [--raw|-w] [--listening|-l] [--all|-a] [--numeric|-n] [--numeric-hosts][--numeric-ports][--numeric-ports] [--sym-bolic|-N] [--extend|-e[--extend|-e]] [--timers|-o] [--program|-p] [--verbose|-v] [--continuous|-c] [delay]
      netstat {--route|-r} [address_family_options] [--extend|-e[--extend|-e]]  [--verbose|-v]  [--numeric|-n]  [--numeric-hosts][--numeric-ports][--numeric-ports]  [--continu-ous|-c] [delay]
      netstat {--interfaces|-I|-i} [iface] [--all|-a] [--extend|-e] [--verbose|-v] [--program|-p] [--numeric|-n] [--numeric-hosts][--numeric-ports][--numeric-ports] [--continu-ous|-c] [delay]
      netstat {--groups|-g} [--numeric|-n] [--numeric-hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay]
      netstat {--masquerade|-M} [--extend|-e] [--numeric|-n] [--numeric-hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay]
      netstat {--statistics|-s} [--tcp|-t] [--udp|-u] [--raw|-w] [delay]
      netstat {--version|-V}
      netstat {--help|-h}
      address_family_options:
      [--protocol={inet,unix,ipx,ax25,netrom,ddp}[,...]]  [--unix|-x] [--inet|--ip] [--ax25] [--ipx] [--netrom] [--ddp]
NOTE
      This program is obsolete.  Replacement for netstat is ss.  Replacement for netstat -r is ip route.  Replacement for netstat -i is ip -s link.  Replacement for netstat  -g
is ip maddr.
註：這個程式已經是是老舊的/廢棄的了（但是依然很常用）。新版本的系統以ss命令來替代netstat，以ip route來替代netstat -r，以ip maddr來替代netstat -g。

DESCRIPTION（摘要）
      Netstat prints information about the Linux networking subsystem.  The type of information printed is controlled by the first argument, as follows:
    netstat 列印Linux網路子系統的資訊，輸出的資訊樣式由第一個引數來控制，如下：
(none)
      By  default,  netstat  displays  a  list  of  open sockets.  If you don’t specify any address families, then the active sockets of all configured address families will be
printed.
    （無引數）預設的，netstat顯示所有系統通訊端的列表。如果你不指定任何的地址族，所有的被設定的地址族的活動通訊端將會被顯示。
  --route , -r
      Display the kernel routing tables.
    顯示核心路由表
  --groups , -g
      Display multicast group membership information for IPv4 and IPv6.
    顯示IPv4和IPv6的多播組成員資訊。
  --interfaces=iface , -I=iface , -i
      Display a table of all network interfaces, or the specified iface.
    顯示所有網路介面的資訊表，或者顯示指定的介面
  --masquerade , -M
      Display a list of masqueraded connections.
    顯示偽裝的連線
  --statistics , -s
      Display summary statistics for each protocol.
    按照協定型別顯示各協定的匯總資訊

OPTIONS（選項）
  --verbose , -v
      Tell the user what is going on by being verbose. Especially print some useful information about unconfigured address families.
  --numeric , -n      Show numerical addresses instead of trying to determine symbolic host, port or user names.
  --numeric-hosts
      shows numerical host addresses but does not affect the resolution of port or user names.
  --numeric-ports
      shows numerical port numbers but does not affect the resolution of host or user names.
  --numeric-users
      shows numerical user IDs but does not affect the resolution of host or port names.
  --protocol=family , -A （協定族型別）
      Specifies the address families (perhaps better described as low level protocols) for which connections are to be shown.  family is a comma (’,’) separated list of address
family keywords like inet, unix, ipx, ax25, netrom, and ddp.  This has the same effect as using the --inet, --unix (-x), --ipx, --ax25, --netrom, and --ddp options.
      The address family inet includes raw, udp and tcp protocol sockets.

  -c, --continuous
      This will cause netstat to print the selected information every second continuously（連續不斷的）.
  -e, --extend
      Display additional information.  Use this option twice for maximum detail.
    顯示更多的資訊，用-ee 顯示最多的資訊
  -o, --timers
      Include information related to networking timers.
    顯示和網路計時器相關的資訊
  -p, --program
      Show the PID and name of the program to which each socket belongs.
    顯示連線所屬的PID和程式名稱
  -l, --listening
      Show only listening sockets.  (These are omitted by default.)
    只顯示監聽的通訊端（埠）預設是忽略這個選項的
  -a, --all
      Show both listening and non-listening (for TCP this means established connections) sockets.  With the --interfaces option, show interfaces that are not marked
  -F
      Print routing information from the FIB.  (This is the default.)
  -C
      Print routing information from the route cache.
  -Z --context
      If SELinux enabled print SELinux context.
  -T --notrim
      Stop trimming long addresses.
  delay
      Netstat will cycle printing through statistics every delay seconds

接下來是重頭戲了，深入理解netstat的輸出，這裡才是實際能幫助我們、給我們提示的地方。

更多詳情見請繼續閱讀下一頁的精彩內容： http://www.linuxidc.com/Linux/2015-02/114108p2.htm