# Network Management with NetStat
- NetStat (네트워크 통계)는 라우팅 테이블, 인터페이스 통계 등을 볼 수 있을 뿐만아니라 수신 및 발신 네트워크 연결을 모니터링하기 위한 CLI 도구이다.
- 이는 네트워크의 문제 해결과 성능 측정에서 매우 유용하다.
- NetStat은 가장 기본적인 네트워크 서비스 디버깅 도구 중 하나로, 열려있는 포트와 포트에서 수신 중인 프로그램이 있는지의 여부를 알려준다.
- NetStat은 리눅스 네트워크 관리자와 시스템 관리자가 네트워크 관련 문제를 모니터링하고 해결하고 네트워크 트래픽 성능을 결정하는 데 매우 중요하고 유용하다.
# List all LISTENING Ports of TCP and UDP connections
- Listing all ports (both TCP and UDP) using netstat -a option.
# netstat -a | more
# List TCP Port connections
- Listing only TCP (Transmission Control Protocol) port connections using netstat -at
# netstat -at
# List UDP Port connections
- Listing only UDP (User Datagram Protocol) port connections using netstat -au
# netstat -au
# List all LISTENING Connections
- Listing all active listening ports connections with netstat -l
# netstat -l
# List all TCP Listening Posts
- Listing all active listening TCP ports by using option netstat -lt
# netstat -lt
# List all UDP Listening Posts
- Listing all active listening UDP ports by using option netstat -lu
# netstat -lu
# List all UNIX Listening Ports
- Listing all active UNIX listening ports using netstat -lx
# netstat -lx
# Show Statistics by Protocol
- Displays statistics by protocol. By default, statistics are shown for the TCP, UDP, ICMP, and IP protocols. The -s parameter can be used to specify a set of protocols.
# netstat -s
# Show Statistics by TCP Protocol
- Showing statistics of only TCP protocol by using option netstat -st
# netstat -st
# Show Statistics by UDP Protocol
# netstat -su
# Display Service name with PID
- Displaying service name with their PID number, using option netstat -tp will display “PID/Program Name”.
# netstat -tp
# Display Promiscuous Mode
- Displaying Promiscuous mode with -ac switch, netstat print the selected information or refresh screen every five second. Default screen refresh in every second.
# netstat -ac 5 | grep tcp
# Display Kernel IP routing
- Display Kernel IP routing table with netstat and route command.
# netstat -r
# Show Network Interface Transactions
- Showing network interface packet transactions including both transferring and receiving packets with MTU size
# netstat -i
# Show Kernel Interface Table
- Showing Kernel interface table, similar to ifconfig command.
# netstat -ie
# Display IPv4 and IPv6 Information
- Displays multicast group membership information for both IPv4 and IPv6.
# netstat -g
# Print Netstat Information Continuously
- To get netstat information every few second, then use the following command, it will print netstat information continuously, say every few seconds.
# netstat -c
# Find non supportive Address
- Finding un-configured address families with some useful information.
# netstat --verbose
# Find Listening Programs
- Find out how many listening programs running on a port.
# netstat -ap | grep http
# Display RAW Network Statistics
# netstat --statistics --raw
# Display all ports in the LISTEN state
# netstat -an | grep LISTEN
[ Option ]
--verbose, -v
Tell the user what is going on by being verbose. Especially print
some useful information about unconfigured address families.
--wide, -W
Do not truncate IP addresses by using output as wide as needed. This
is optional for now to not break existing scripts.
--numeric, -n
Show numerical addresses instead of trying to determine symbolic
host, port or user names.
--numeric-hosts
shows numerical host addresses but does not affect the resolution of
port or user names.
--numeric-ports
shows numerical port numbers but does not affect the resolution of
host or user names.
--numeric-users
shows numerical user IDs but does not affect the resolution of host
or port names.
--protocol=family, -A
Specifies the address families (perhaps better described as low level
protocols) for which connections are to be shown. family is a comma
(',') separated list of address family keywords like inet, inet6,
unix, ipx, ax25, netrom, econet, ddp, and bluetooth. This has the
same effect as using the --inet|-4, --inet6|-6, --unix|-x, --ipx,
--ax25, --netrom, --ddp, and --bluetooth options.
The address family inet (Iv4) includes raw, udp, udplite and tcp
protocol sockets.
The address family bluetooth (Iv4) includes l2cap and rfcomm protocol
sockets.
-c, --continuous
This will cause netstat to print the selected information every
second continuously.
-e, --extend
Display additional information. Use this option twice for maximum
detail.
-o, --timers
Include information related to networking timers.
-p, --program
Show the PID and name of the program to which each socket belongs.
-l, --listening
Show only listening sockets. (These are omitted by default.)
-a, --all
Show both listening and non-listening sockets. With the --interfaces
option, show interfaces that are not up
-F
Print routing information from the FIB. (This is the default.)
-C
Print routing information from the route cache.
