netstat命令的详细用法示例

wangbinde

                Source:  http://www.cyberciti.biz/tips/netstat-command-tutorial-examples.html
This is useful to find out if your server is under attack or not. You can also list abusive IP  address using this method.
# netstat -nat | awk '{print  $6}' | sort | uniq -c | sort -n
Output:
      1 CLOSE_WAIT
         1 established)
         1 Foreign
         3 FIN_WAIT1
         3 LAST_ACK
        13 ESTABLISHED
        17 LISTEN
       154 FIN_WAIT2
       327 TIME_WAIT
Dig out more information about a specific ip  address:
# netstat -nat |grep {IP-address} | awk '{print $6}' | sort |  uniq -c | sort -n
         2 LAST_ACK
         2 LISTEN
         4 FIN_WAIT1
        14 ESTABLISHED
        91 TIME_WAIT
       130 FIN_WAIT2
Busy server can give out more  information:
# netstat -nat |grep 202.54.1.10 | awk '{print $6}' | sort  | uniq -c | sort -n
Output:
  15 CLOSE_WAIT
  37 LAST_ACK
  64 FIN_WAIT_1
  65 FIN_WAIT_2
1251 TIME_WAIT
3597 SYN_SENT
5124 ESTABLISHED
Get List Of All Unique IP  Address
To print list of all unique IP address connected  to server, enter:
# netstat -nat | awk '{ print $5}' | cut -d: -f1 |  sed -e '/^$/d' | uniq
To print total of all unique IP address,  enter:
# netstat -nat | awk '{ print $5}' | cut -d: -f1 | sed -e  '/^$/d' | uniq | wc -l
Output:
449
Find Out If Box is Under DoS  Attack or Not
If you think your Linux box is under
attack, print out a list of open connections on your box and sorts them
by according to IP address, enter:
# netstat -atun | awk '{print $5}' | cut -d: -f1 | sed  -e '/^$/d' |sort | uniq -c | sort -n
Output:
       1 10.0.77.52
         2 10.1.11.3
         4 12.109.42.21
         6 12.191.136.3
.....
...
....
       13 202.155.209.202
        18 208.67.222.222
        28 0.0.0.0
       233 127.0.0.1
You can simply block all abusive
IPs using iptables
or just  
null route them
.
Get Live View of TCP  Connections
You can use
tcptrack command
to display the status of TCP connections that it sees on a given
network interface. tcptrack monitors their state and displays
information such as state, source/destination addresses and bandwidth
usage in a sorted, updated list very much like the top command.
Display Summary Statistics for  Each Protocol
Simply use netstat -s:
# netstat -s |  less
# netstat -t -s | less
# netstat -u -s |  less
# netstat -w -s | less
# netstat  -s
Output:
Ip:
       88354557 total packets received
       0 forwarded
       0 incoming packets discarded
       88104061 incoming packets delivered
       96037391 requests sent out
       13 outgoing packets dropped
       66 fragments dropped after timeout
       295 reassemblies required
       106 packets reassembled ok
       66 packet reassembles failed
       34 fragments failed
Icmp:
       18108 ICMP messages received
       58 input ICMP message failed.
       ICMP input histogram:
           destination unreachable: 7173
           timeout in transit: 472
           redirects: 353
           echo requests: 10096
       28977 ICMP messages sent
       0 ICMP messages failed
       ICMP output histogram:
           destination unreachable: 18881
           echo replies: 10096
Tcp:
       1202226 active connections openings
       2706802 passive connection openings
       7394 failed connection attempts
       47018 connection resets received
       23 connections established
       87975383 segments received
       95235730 segments send out
       681174 segments retransmited
       2044 bad segments received.
       80805 resets sent
Udp:
       92689 packets received
       14611 packets to unknown port received.
       0 packet receive errors
       96755 packets sent
TcpExt:
       48452 invalid SYN cookies received
       7357 resets received for embryonic SYN_RECV sockets
       43 ICMP packets dropped because they were out-of-window
       5 ICMP packets dropped because socket was locked
       2672073 TCP sockets finished time wait in fast timer
       441 time wait sockets recycled by time stamp
       368562 delayed acks sent
       430 delayed acks further delayed because of locked socket
       Quick ack mode was activated 36127 times
       32318597 packets directly queued to recvmsg prequeue.
       741479256 packets directly received from backlog
       1502338990 packets directly received from prequeue
       18343750 packets header predicted
       10220683 packets header predicted and directly queued to user
       17516622 acknowledgments not containing data received
       36549771 predicted acknowledgments
       102672 times recovered from packet loss due to fast retransmit
       Detected reordering 1596 times using reno fast retransmit
       Detected reordering 1 times using time stamp
       8 congestion windows fully recovered
       32 congestion windows partially recovered using Hoe heuristic
       19 congestion windows recovered after partial ack
       0 TCP data loss events
       39951 timeouts after reno fast retransmit
       29653 timeouts in loss state
       197005 fast retransmits
       186937 retransmits in slow start
       131433 other TCP timeouts
       TCPRenoRecoveryFail: 20217
       147 times receiver scheduled too late for direct processing
       29010 connections reset due to unexpected data
       365 connections reset due to early user close
       6979 connections aborted due to timeout
Display Interface  Table
You can easily display dropped and total  transmitted packets with netstat for eth0:
# netstat  --interfaces=eth0
Output:
Kernel Interface table
Iface          MTU Met       RX-OK RX-ERR RX-DRP RX-OVR       TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0          1500      0  2040929         0         0         0  3850539         0  
               
               

本文来自ChinaUnix博客，如果查看原文请点：http://blog.chinaunix.net/u/19769/showart_1149624.html