[Shell] netstat

# Network Management with NetStat

 

 - NetStat (네트워크 통계)는 라우팅 테이블, 인터페이스 통계 등을 볼 수 있을 뿐만아니라 수신 및 발신 네트워크 연결을 모니터링하기 위한 CLI 도구이다.

 - 이는 네트워크의 문제 해결과 성능 측정에서 매우 유용하다.

 - NetStat은 가장 기본적인 네트워크 서비스 디버깅 도구 중 하나로, 열려있는 포트와 포트에서 수신 중인 프로그램이 있는지의 여부를 알려준다.

 - NetStat은 리눅스 네트워크 관리자와 시스템 관리자가 네트워크 관련 문제를 모니터링하고 해결하고 네트워크 트래픽 성능을 결정하는 데 매우 중요하고 유용하다.

 

# List all LISTENING Ports of TCP and UDP connections

 - Listing all ports (both TCP and UDP) using netstat -a option.

# netstat -a | more

 

# List TCP Port connections

 - Listing only TCP (Transmission Control Protocol) port connections using netstat -at

# netstat -at

 

# List UDP Port connections

 - Listing only UDP (User Datagram Protocol) port connections using netstat -au

# netstat -au

 

# List all LISTENING Connections

 - Listing all active listening ports connections with netstat -l

# netstat -l

 

# List all TCP Listening Posts

 - Listing all active listening TCP ports by using option netstat -lt

# netstat -lt

 

# List all UDP Listening Posts

 - Listing all active listening UDP ports by using option netstat -lu

# netstat -lu

 

# List all UNIX Listening Ports

 - Listing all active UNIX listening ports using netstat -lx

# netstat -lx

 

# Show Statistics by Protocol

 - Displays statistics by protocol. By default, statistics are shown for the TCP, UDP, ICMP, and IP protocols. The -s parameter can be used to specify a set of protocols.

# netstat -s

 

# Show Statistics by TCP Protocol

 - Showing statistics of only TCP protocol by using option netstat -st

# netstat -st

 

# Show Statistics by UDP Protocol

# netstat -su

 

# Display Service name with PID

 - Displaying service name with their PID number, using option netstat -tp will display “PID/Program Name”.

# netstat -tp

 

# Display Promiscuous Mode

 - Displaying Promiscuous mode with -ac switch, netstat print the selected information or refresh screen every five second. Default screen refresh in every second.

# netstat -ac 5 | grep tcp

 

 

# Display Kernel IP routing

 - Display Kernel IP routing table with netstat and route command.

# netstat -r

 

 

# Show Network Interface Transactions

 - Showing network interface packet transactions including both transferring and receiving packets with MTU size

# netstat -i

 

# Show Kernel Interface Table

 - Showing Kernel interface table, similar to ifconfig command.

# netstat -ie

 

# Display IPv4 and IPv6 Information

 - Displays multicast group membership information for both IPv4 and IPv6.

# netstat -g

 

# Print Netstat Information Continuously

 - To get netstat information every few second, then use the following command, it will print netstat information continuously, say every few seconds.

# netstat -c

 

# Find non supportive Address

 - Finding un-configured address families with some useful information.

# netstat --verbose

 

# Find Listening Programs

 - Find out how many listening programs running on a port.

# netstat -ap | grep http

 

# Display RAW Network Statistics

# netstat --statistics --raw

 

# Display all ports in the LISTEN state

# netstat -an | grep LISTEN

 

---

 [ Option ]

   --verbose, -v
       Tell the user what is going on by being verbose. Especially print
       some useful information about unconfigured address families.

   --wide, -W
       Do not truncate IP addresses by using output as wide as needed. This
       is optional for now to not break existing scripts.

   --numeric, -n
       Show numerical addresses instead of trying to determine symbolic
       host, port or user names.

   --numeric-hosts
       shows numerical host addresses but does not affect the resolution of
       port or user names.

   --numeric-ports
       shows numerical port numbers but does not affect the resolution of
       host or user names.

   --numeric-users
       shows numerical user IDs but does not affect the resolution of host
       or port names.

   --protocol=family, -A
       Specifies the address families (perhaps better described as low level
       protocols) for which connections are to be shown.  family is a comma
       (',') separated list of address family keywords like inet, inet6,
       unix, ipx, ax25, netrom, econet, ddp, and bluetooth.  This has the
       same effect as using the --inet|-4, --inet6|-6, --unix|-x, --ipx,
       --ax25, --netrom, --ddp, and --bluetooth options.

       The address family inet (Iv4) includes raw, udp, udplite and tcp
       protocol sockets.

       The address family bluetooth (Iv4) includes l2cap and rfcomm protocol
       sockets.

   -c, --continuous
       This will cause netstat to print the selected information every
       second continuously.

   -e, --extend
       Display additional information.  Use this option twice for maximum
       detail.

   -o, --timers
       Include information related to networking timers.

   -p, --program
       Show the PID and name of the program to which each socket belongs.

   -l, --listening
       Show only listening sockets.  (These are omitted by default.)

   -a, --all
       Show both listening and non-listening sockets.  With the --interfaces
       option, show interfaces that are not up

   -F
       Print routing information from the FIB.  (This is the default.)

   -C
       Print routing information from the route cache.