当前位置：网站首页>Netstat common scene record

Netstat common scene record

2022-07-18 21:14:00 【MrMoving】

Parameter description

netstat The parameters of the command are described as follows ：
-a: Show ports in all connections ( Without this parameter, the ports in listening status are not displayed by default )
-n: Don't make DNS polling , Show IP( It can speed up the operation )
-r: Show routing table information
-t: Show TCP Port connection status of the transmission protocol
-u: Show UDP Port connection status of the transmission protocol
-l: Only the ports in listening state are listed (state by listen)
-p: Display the corresponding process id And program name
-c: At regular intervals , Execute this netstat command

Return information explanation 

[[email protected] app]# netstat -anp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      2717/master
tcp        0      0 10.10.1.132:6379        0.0.0.0:*               LISTEN      9717/redis-server 1
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1874/nginx: master
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1291/sshd
tcp        0      0 10.10.1.132:6379        10.0.20.3:62257         ESTABLISHED 9717/redis-server 1
tcp        0      0 10.10.1.132:6379        10.10.1.113:51015       ESTABLISHED 9717/redis-server 1       
tcp6       0      0 :::8080                 :::*                    LISTEN      6727/java           
tcp6       0      0 :::8081                 :::*                    LISTEN      2239/java           
tcp6       0      0 :::43381                :::*                    LISTEN      6819/java           
tcp6       0      0 :::22                   :::*                    LISTEN      925/sshd

Proto: The name of the agreement （tcp Agreement or udp agreement )

recv-Q: Network receive queue , Indicates that the received data has been buffered locally , But how much is not taken away by the process recv()
send-Q: Network send queue , It means that the other party did not receive the data or did not Ack Of , Still in the local buffer recv-Q,send-Q These two values should usually be 0, If not for 0 There may be a problem .packets There should be no stacking in either queue . It's not acceptable 0 situation .

Local Address: Represents an open assignment on the local server ip:port
Foreign Address: An external port that communicates with the local port socket. Show rules and Local Address identical
About 0.0.0.0 And :: respectively ipv4 And ipv6 Default of in ip, There is no further explanation here . The third of the three colons is ip Separation from ports

State: Link state

PID/Program:PID Process id,Program That is, use the socket Applications for

Expand ,state explain

state describe
LISTEN First, the server needs to open a socket monitor , Status as LISTEN./* The socket is listening for incoming connections. Listening from far away TCP Connection request for port */
SYN_SENT The client calls... Through the application connect Conduct active open. So the client tcp Send a SYN To request a connection . Then the state is set to SYN_SENT./*The socket is actively attempting to establish a connection. Wait for the matching connection request after sending the connection request */
SYN_RECV The server should send ACK Confirm the... Of the client SYN, At the same time, I send a SYN. Then the state is set to SYN_RECV/* A connection request has been received from the network. Wait for confirmation of the connection request after receiving and sending a connection request */
ESTABLISHED Represents an open connection , Both parties can interact or already interact in data ./* The socket has an established connection. Represents an open connection , Data can be transmitted to users */
FIN_WAIT1 Active shut down (active close) End application call close, So it TCP issue FIN Request to actively close the connection , After entering FIN_WAIT1 state ./* The socket is closed, and the connection is shutting down. Waiting for remote TCP Connection interrupt request for , Or confirmation of previous connection interruption request */
CLOSE_WAIT Passive closure (passive close) End TCP Receive FIN after , Just send out ACK In response to FIN request ( Its reception is also passed to the upper application as a file Terminator ), And enter CLOSE_WAIT./* The remote end has shut down, waiting for the socket to close. Waiting for the connection interrupt request from the local user */
FIN_WAIT2 Active closing termination to ACK after , It's in FIN-WAIT-2 ./* Connection is closed, and the socket is waiting for a shutdown from the remote end. From remote TCP Wait for connection interrupt request */
LAST_ACK After a period of passive shutdown , Applications that receive the end of file The sequence will call CLOSE Close the connection . This leads to its TCP Also send a FIN, Waiting for each other's ACK. It's in LAST-ACK ./* The remote end has shut down, and the socket is closed. Waiting for acknowledgement. Wait for the original send to remote TCP The confirmation of the interrupt request */
TIME_WAIT Received at active shutdown FIN after ,TCP Is sent ACK package , And enter TIME-WAIT state ./* The socket is waiting after close to handle packets still in the network. Wait enough time to make sure that the remote TCP Receive confirmation of connection interrupt request */
CLOSING Relatively rare ./* Both sockets are shut down but we still don’t have all our data sent. Waiting for remote TCP Confirmation of connection interruption */
CLOSED The passive closing end receives ACK After package , It's in closed The state of . End of connection ./* The socket is not being used. There is no connection state */
UNKNOWN Unknown Socket state ./* The state of the socket is unknown. */

remarks ：
SYN: ( Sync sequence number ,Synchronize Sequence Numbers) The logo is only established on three handshakes TCP Valid when connected . Means a new TCP Connection request .
ACK: ( Confirmation number ,Acknowledgement Number) It's right TCP The confirmation mark of the request , At the same time, it indicates that the peer system has successfully received all data .
FIN: ( End mark ,FINish) To end a TCP Come back . But the corresponding port is still open , Ready to receive subsequent data .

原网站

版权声明
本文为[MrMoving]所创，转载请带上原文链接，感谢
https://yzsam.com/2022/199/202207161737541141.html

边栏推荐

猜你喜欢

随机推荐