Netstat is a console command that can provide detailed information about network connections, routing table, interface statistics, and similar network connection information.
The netstat command is
used with various parameters. These parameters and their meanings are as follows.
-a : Prints all TCP and UDP connections to the screen.
-e : Displays statistics of incoming and outgoing packet
counts.-n : Displays all connections numerically.
-o : Lists all connections by PID number and application name.
-p : Prints the application and PID numbers used by connections to the
screen.-s : Prints statistical data according to rules to the screen.
-r : Displays the contents of the IP routing table.
The meanings of connection states in the Netstat output are as
follows.
ESTABLISHED : The socket connection has been established.
SYN_SENT : The socket is trying to establish a connection.
SYN_RECV : A connection request has arrived from the
network.FIN_WAIT1 : The socket has been closed, the connection is about to be terminated.
FIN_WAIT2 : The connection has been terminated. The socket is waiting for the other end to terminate the
connection.TIME_WAIT : The socket is waiting to receive packets that may arrive after it closes.
CLOSED : The socket is not in use.
CLOSE_WAIT : The other end has closed the connection. The socket
is waiting to close.LAST_ACK : The other end has terminated the connection and closed the socket. Waiting for confirmation.
LISTEN : The socket is in listening mode for incoming connections.
CLOSING
: Local and remote sockets have been closed but have not sent all their data.
Some Example Commands to Get Netstat Output via SSH
Lists All TCP and UDP Connections.
netstat -ntuPrints
SYN_SENT and SYN_RECV connection states among all TCP and UDP connections to the screen. You can change the part after grep to your preference and see other connections on the screen.
netstat -ntu | grep SYNPrints only
ESTABLISHED connections to the screen.
netstat -ntu | grep ESTABLISHEDThe following command sorts the entire IP list including values printed with the ffff table from smallest to
largest. You can also add grep to the command to list by connection state.
netstat -ntu | awk ‘ {print $5} ’ | awk ‘ {sub(“::ffff:”,“”);print} ’ | cut -f1 -d ‘:’ | sort | uniq -c | sort -n | grep -v -e server -e Address
127.0.0.1 -e 0.0.0.0
Leave a Comment
* Your comment will be published after approval.
Comments
0No comments yet. Be the first to comment!