netstat 命令用于显示与IP、TCP、UDP和ICMP协议相关的统计数据，一般用于检验本机各端口的网络连接情况。netstat 是在内核中访问网络及相关信息的程序，它能提供TCP连接，TCP和UDP监听，进程内存管理的相关报告。
如果你的计算机有时候接收到的数据报导致出错数据或故障，你不必感到奇怪，TCP/IP 可以容许这些类型的错误，并能够自动重发数据报。但如果累计的出错情况数目占到所接收的IP数据报相当大的百分比，或者它的数目正迅速增加，那么你就应该使用 netstat 查一查为什么会出现这些情况了。
命令格式 -
命令功能 -
命令参数 -
命令实例 -
实例一：无参数使用
命令
xxxxxxxxxx11netstat输出
xxxxxxxxxx141[root@localhost ~]# netstat2Active Internet connections (w/o servers)3Proto Recv-Q Send-Q Local Address Foreign Address State 4tcp 0 268 192.168.120.204:ssh 10.2.0.68:62420 ESTABLISHED 5udp 0 0 192.168.120.204:4371 10.58.119.119:domain ESTABLISHED 6Active UNIX domain sockets (w/o servers)7Proto RefCnt Flags Type State I-Node Path8unix 2 [ ] DGRAM 1491 @/org/kernel/udev/udevd9unix 4 [ ] DGRAM 7337 /dev/log10unix 2 [ ] DGRAM 708823 11unix 2 [ ] DGRAM 7539 12unix 3 [ ] STREAM CONNECTED 7287 13unix 3 [ ] STREAM CONNECTED 7286 14[root@localhost ~]#说明
从整体上看，netstat 的输出结果可以分为两个部分：
一个是 Active Internet connections，称为有源TCP连接，其中"Recv-Q"和"Send-Q"指的是接收队列和发送队列。这些数字一般都应该是0。如果不是则表示软件包正在队列中堆积。这种情况只能在非常少的情况见到。
另一个是 Active UNIX domain sockets，称为有源Unix域套接口(和网络套接字一样，但是只能用于本机通信，性能可以提高一倍)。
Proto显示连接使用的协议,RefCnt表示连接到本套接口上的进程号,Types显示套接口的类型,State显示套接口当前的状态,Path表示连接到套接口的其它进程使用的路径名。
套接口类型：
-t ：TCP
-u ：UDP
-raw ：RAW类型
--unix ：UNIX域类型
--ax25 ：AX25类型
--ipx ：ipx类型
--netrom ：netrom类型
状态说明：
LISTEN：侦听来自远方的TCP端口的连接请求
SYN-SENT：再发送连接请求后等待匹配的连接请求（如果有大量这样的状态包，检查是否中招了）
SYN-RECEIVED：再收到和发送一个连接请求后等待对方对连接请求的确认（如有大量此状态，估计被flood攻击了）
ESTABLISHED：代表一个打开的连接
FIN-WAIT-1：等待远程TCP连接中断请求，或先前的连接中断请求的确认
FIN-WAIT-2：从远程TCP等待连接中断请求
CLOSE-WAIT：等待从本地用户发来的连接中断请求
CLOSING：等待远程TCP对连接中断的确认
LAST-ACK：等待原来的发向远程TCP的连接中断请求的确认（不是什么好东西，此项出现，检查是否被攻击）
TIME-WAIT：等待足够的时间以确保远程TCP接收到连接中断请求的确认
CLOSED：没有任何连接状态
实例二：列出所有端口
命令
xxxxxxxxxx11netstat- a输出
xxxxxxxxxx201[root@localhost ~]# netstat -a2Active Internet connections (servers and established)3Proto Recv-Q Send-Q Local Address Foreign Address State 4tcp 0 0 localhost:smux *:* LISTEN 5tcp 0 0 *:svn *:* LISTEN 6tcp 0 0 *:ssh *:* LISTEN 7tcp 0 284 192.168.120.204:ssh 10.2.0.68:62420 ESTABLISHED 8udp 0 0 localhost:syslog *:* 9udp 0 0 *:snmp *:* 10Active UNIX domain sockets (servers and established)11Proto RefCnt Flags Type State I-Node Path12unix 2 [ ACC ] STREAM LISTENING 708833 /tmp/ssh-yKnDB15725/agent.1572513unix 2 [ ACC ] STREAM LISTENING 7296 /var/run/audispd_events14unix 2 [ ] DGRAM 1491 @/org/kernel/udev/udevd15unix 4 [ ] DGRAM 7337 /dev/log16unix 2 [ ] DGRAM 708823 17unix 2 [ ] DGRAM 7539 18unix 3 [ ] STREAM CONNECTED 7287 19unix 3 [ ] STREAM CONNECTED 7286 20[root@localhost ~]#说明
显示一个所有的有效连接信息列表，包括已建立的连接（ESTABLISHED），也包括监听连接请（LISTENING）的那些连接。
实例三：显示当前UDP连接状态
命令
xxxxxxxxxx11netstat -nu输出
xxxxxxxxxx131[root@andy ~]# netstat -nu2Active Internet connections (w/o servers)3Proto Recv-Q Send-Q Local Address Foreign Address State 4udp 0 0 ::ffff:192.168.12:53392 ::ffff:192.168.9.120:10000 ESTABLISHED 5udp 0 0 ::ffff:192.168.12:56723 ::ffff:192.168.9.120:10000 ESTABLISHED 6udp 0 0 ::ffff:192.168.12:56480 ::ffff:192.168.9.120:10000 ESTABLISHED 7udp 0 0 ::ffff:192.168.12:58154 ::ffff:192.168.9.120:10000 ESTABLISHED 8udp 0 0 ::ffff:192.168.12:44227 ::ffff:192.168.9.120:10000 ESTABLISHED 9udp 0 0 ::ffff:192.168.12:36954 ::ffff:192.168.9.120:10000 ESTABLISHED 10udp 0 0 ::ffff:192.168.12:53984 ::ffff:192.168.9.120:10000 ESTABLISHED 11udp 0 0 ::ffff:192.168.12:57703 ::ffff:192.168.9.120:10000 ESTABLISHED 12udp 0 0 ::ffff:192.168.12:53613 ::ffff:192.168.9.120:10000 ESTABLISHED 13[root@andy ~]#实例四：显示UDP端口号的使用情况
命令
xxxxxxxxxx11netstat -apu输出
xxxxxxxxxx301[root@andy ~]# netstat -apu2Active Internet connections (servers and established)3Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name 4udp 0 0 *:57604 *:* 28094/java 5udp 0 0 *:40583 *:* 21220/java 6udp 0 0 *:45451 *:* 14583/java 7udp 0 0 ::ffff:192.168.12:53392 ::ffff:192.168.9.120:ndmp ESTABLISHED 19327/java 8udp 0 0 *:52370 *:* 15841/java 9udp 0 0 ::ffff:192.168.12:56723 ::ffff:192.168.9.120:ndmp ESTABLISHED 15841/java 10udp 0 0 *:44182 *:* 31757/java 11udp 0 0 *:48155 *:* 5476/java 12udp 0 0 *:59808 *:* 17333/java 13udp 0 0 ::ffff:192.168.12:56480 ::ffff:192.168.9.120:ndmp ESTABLISHED 28094/java 14udp 0 0 ::ffff:192.168.12:58154 ::ffff:192.168.9.120:ndmp ESTABLISHED 15429/java 15udp 0 0 *:36780 *:* 10091/java 16udp 0 0 *:36795 *:* 24594/java 17udp 0 0 *:41922 *:* 20506/java 18udp 0 0 ::ffff:192.168.12:44227 ::ffff:192.168.9.120:ndmp ESTABLISHED 17333/java 19udp 0 0 *:34258 *:* 8866/java 20udp 0 0 *:55508 *:* 11667/java 21udp 0 0 *:36055 *:* 12425/java 22udp 0 0 ::ffff:192.168.12:36954 ::ffff:192.168.9.120:ndmp ESTABLISHED 16532/java 23udp 0 0 ::ffff:192.168.12:53984 ::ffff:192.168.9.120:ndmp ESTABLISHED 20506/java 24udp 0 0 ::ffff:192.168.12:57703 ::ffff:192.168.9.120:ndmp ESTABLISHED 31757/java 25udp 0 0 ::ffff:192.168.12:53613 ::ffff:192.168.9.120:ndmp ESTABLISHED 3199/java 26udp 0 0 *:56309 *:* 15429/java 27udp 0 0 *:54007 *:* 16532/java 28udp 0 0 *:39544 *:* 3199/java 29udp 0 0 *:43900 *:* 19327/java 30[root@andy ~]#实例五：显示网卡列表
命令
xxxxxxxxxx11netstat -i输出
xxxxxxxxxx61[root@andy ~]# netstat -i2Kernel Interface table3Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg4eth0 1500 0 151818887 0 0 0 198928403 0 0 0 BMRU5lo 16436 0 107235 0 0 0 107235 0 0 0 LRU6[root@andy ~]#实例六：显示组播组的关系
命令
xxxxxxxxxx11netstat -g输出
xxxxxxxxxx101[root@andy ~]# netstat -g2IPv6/IPv4 Group Memberships3Interface RefCnt Group4--------------- ------ ---------------------5lo 1 all-systems.mcast.net6eth0 1 all-systems.mcast.net7lo 1 ff02::18eth0 1 ff02::1:ffff:9b0c9eth0 1 ff02::110[root@andy ~]#实例七：显示网络统计信息
命令
xxxxxxxxxx11netstat -s输出
xxxxxxxxxx631[root@localhost ~]# netstat -s2Ip:3total packets received4forwarded5incoming packets discarded6incoming packets delivered7requests sent out8dropped because of missing route9Icmp:10ICMP messages received11input ICMP message failed.12 ICMP input histogram:13 destination unreachable: 1714 echo requests: 115 echo replies: 7216ICMP messages sent17ICMP messages failed18 ICMP output histogram:19 destination unreachable: 820 echo request: 9721 echo replies: 122IcmpMsg:23 InType0: 7224 InType3: 1725 InType8: 126 OutType0: 127 OutType3: 828 OutType8: 9729Tcp:30active connections openings31passive connection openings32failed connection attempts33connection resets received34connections established35segments received36segments send out37segments retransmited38bad segments received.39resets sent40Udp:41packets received42packets to unknown port received.43packet receive errors44packets sent45TcpExt:46invalid SYN cookies received47TCP sockets finished time wait in fast timer48delayed acks sent49 Quick ack mode was activated 50 times50packets directly queued to recvmsg prequeue.51packets directly received from backlog52packets directly received from prequeue53packets header predicted54packets header predicted and directly queued to user55acknowledgments not containing data received56predicted acknowledgments57TCP data loss events58timeouts after reno fast retransmit59retransmits in slow start60other TCP timeouts61connections aborted due to timeout62IpExt:63 InBcastPkts: 527777说明
按照各个协议分别显示其统计数据。如果我们的应用程序（如Web浏览器）运行速度比较慢，或者不能显示Web页之类的数据，那么我们就可以用本选项来查看一下所显示的信息。我们需要仔细查看统计数据的各行，找到出错的关键字，进而确定问题所在。
实例八：显示监听的套接口
命令
xxxxxxxxxx11netstat -l输出
xxxxxxxxxx131[root@localhost ~]# netstat -l2Active Internet connections (only servers)3Proto Recv-Q Send-Q Local Address Foreign Address State 4tcp 0 0 localhost:smux *:* LISTEN 5tcp 0 0 *:svn *:* LISTEN 6tcp 0 0 *:ssh *:* LISTEN 7udp 0 0 localhost:syslog *:* 8udp 0 0 *:snmp *:* 9Active UNIX domain sockets (only servers)10Proto RefCnt Flags Type State I-Node Path11unix 2 [ ACC ] STREAM LISTENING 708833 /tmp/ssh-yKnDB15725/agent.1572512unix 2 [ ACC ] STREAM LISTENING 7296 /var/run/audispd_events13[root@localhost ~]#实例九：显示所有已建立的有效连接
命令
xxxxxxxxxx11netstat -n输出
xxxxxxxxxx131[root@localhost ~]# netstat -n2Active Internet connections (w/o servers)3Proto Recv-Q Send-Q Local Address Foreign Address State 4tcp 0 268 192.168.120.204:22 10.2.0.68:62420 ESTABLISHED 5Active UNIX domain sockets (w/o servers)6Proto RefCnt Flags Type State I-Node Path7unix 2 [ ] DGRAM 1491 @/org/kernel/udev/udevd8unix 4 [ ] DGRAM 7337 /dev/log9unix 2 [ ] DGRAM 708823 10unix 2 [ ] DGRAM 7539 11unix 3 [ ] STREAM CONNECTED 7287 12unix 3 [ ] STREAM CONNECTED 7286 13[root@localhost ~]#实例十：显示关于以太网的统计数据
命令
xxxxxxxxxx11netstat -e输出
xxxxxxxxxx131[root@localhost ~]# netstat -e2Active Internet connections (w/o servers)3Proto Recv-Q Send-Q Local Address Foreign Address State User Inode 4tcp 0 248 192.168.120.204:ssh 10.2.0.68:62420 ESTABLISHED root 708795 5Active UNIX domain sockets (w/o servers)6Proto RefCnt Flags Type State I-Node Path7unix 2 [ ] DGRAM 1491 @/org/kernel/udev/udevd8unix 4 [ ] DGRAM 7337 /dev/log9unix 2 [ ] DGRAM 708823 10unix 2 [ ] DGRAM 7539 11unix 3 [ ] STREAM CONNECTED 7287 12unix 3 [ ] STREAM CONNECTED 7286 13[root@localhost ~]#说明
用于显示关于以太网的统计数据。它列出的项目包括传送的数据报的总字节数、错误数、删除数、数据报的数量和广播的数量。这些统计数据既有发送的数据报数量，也有接收的数据报数量。这个选项可以用来统计一些基本的网络流量）
实例十一：显示关于路由表的信息
命令
xxxxxxxxxx11netstat -r输出
xxxxxxxxxx81[root@localhost ~]# netstat -r2Kernel IP routing table3Destination Gateway Genmask Flags MSS Window irtt Iface4192.168.120.0 * 255.255.255.0 U 0 0 0 eth05192.168.0.0 192.168.120.1 255.255.0.0 UG 0 0 0 eth0610.0.0.0 192.168.120.1 255.0.0.0 UG 0 0 0 eth07default 192.168.120.240 0.0.0.0 UG 0 0 0 eth08[root@localhost ~]#实例十二：列出所有tcp端口
命令
xxxxxxxxxx11netstat -at输出
xxxxxxxxxx81[root@localhost ~]# netstat -at2Active Internet connections (servers and established)3Proto Recv-Q Send-Q Local Address Foreign Address State 4tcp 0 0 localhost:smux *:* LISTEN 5tcp 0 0 *:svn *:* LISTEN 6tcp 0 0 *:ssh *:* LISTEN 7tcp 0 284 192.168.120.204:ssh 10.2.0.68:62420 ESTABLISHED 8[root@localhost ~]#实例十三：统计机器中网络连接各个状态个数
命令
xxxxxxxxxx11netstat -a | awk '/^tcp/ {++S[$NF]} END {for(a in S) print a, S[a]}'输出
xxxxxxxxxx41[root@localhost ~]# netstat -a | awk '/^tcp/ {++S[$NF]} END {for(a in S) print a, S[a]}'2ESTABLISHED 13LISTEN 34[root@localhost ~]# 实例十四：把状态全部读取出来后使用 uniq -c 统计后再进行排序
命令
xxxxxxxxxx11netstat -nat |awk '{print $6}'|sort|uniq -c输出
xxxxxxxxxx151[root@andy ~]# netstat -nat |awk '{print $6}'|sort|uniq -c2CLOSE_WAIT3established)4ESTABLISHED5Foreign6LISTEN7TIME_WAIT8[root@andy ~]# netstat -nat |awk '{print $6}'|sort|uniq -c|sort -rn9ESTABLISHED10LISTEN11CLOSE_WAIT12TIME_WAIT13Foreign14established)15[root@andy ~]#实例十五：查看连接某服务端口最多的IP地址
命令
xxxxxxxxxx11netstat -nat | grep "192.168.120.20:16067" |awk '{print $5}'|awk -F: '{print $4}'|sort|uniq -c|sort -nr|head -20输出
xxxxxxxxxx221[root@andy ~]# netstat -nat | grep "192.168.120.20:16067" |awk '{print $5}'|awk -F: '{print $4}'|sort|uniq -c|sort -nr|head -20210.2.1.683192.168.119.134192.168.119.2015192.168.119.206192.168.119.10710.2.1.199810.2.1.2079192.168.120.2010192.168.120.1511192.168.119.19712192.168.119.111310.2.1.2061410.2.1.2031510.2.1.1891610.2.1.17317192.168.120.1818192.168.119.191910.2.2.2272010.2.2.1382110.2.1.20822[root@andy ~]#实例十六：找出程序运行的端口
命令
xxxxxxxxxx11netstat -ap | grep ssh输出
xxxxxxxxxx91[root@andy ~]# netstat -ap | grep ssh2tcp 0 0 *:ssh *:* LISTEN 2570/sshd 3tcp 0 0 ::ffff:192.168.120.206:ssh ::ffff:10.2.1.205:54508 ESTABLISHED 13883/14 4tcp 0 0 ::ffff:192.168.120.206:ssh ::ffff:10.2.0.68:62886 ESTABLISHED 20900/6 5tcp 0 0 ::ffff:192.168.120.206:ssh ::ffff:10.2.2.131:52730 ESTABLISHED 20285/sshd: root@no 6unix 2 [ ACC ] STREAM LISTENING 194494461 20900/6 /tmp/ssh-cXIJj20900/agent.209007unix 3 [ ] STREAM CONNECTED 194307443 20285/sshd: root@no 8unix 3 [ ] STREAM CONNECTED 194307441 20285/sshd: root@no 9[root@andy ~]#实例十七：在 netstat 输出中显示 PID 和进程名称
命令
xxxxxxxxxx11netstat -pt输出
xxxxxxxxxx51[root@localhost ~]# netstat -pt2Active Internet connections (w/o servers)3Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name 4tcp 0 248 192.168.120.204:ssh 10.2.0.68:62420 ESTABLISHED 15725/0 5[root@localhost ~]# 说明
netstat -p 可以与其它开关一起使用，就可以添加 “PID/进程名称” 到 netstat 输出中，这样 debugging 的时候可以很方便的发现特定端口运行的程序。
实例十八：找出运行在指定端口的进程
命令
xxxxxxxxxx11netstat -anpt | grep ':16064'输出
xxxxxxxxxx171[root@andy ~]# netstat -anpt | grep ':16064'2tcp 0 0 :::16064 :::* LISTEN 24594/java 3tcp 0 0 ::ffff:192.168.120.20:16064 ::ffff:192.168.119.201:6462 ESTABLISHED 24594/java 4tcp 0 0 ::ffff:192.168.120.20:16064 ::ffff:192.168.119.20:26341 ESTABLISHED 24594/java 5tcp 0 0 ::ffff:192.168.120.20:16064 ::ffff:192.168.119.20:32208 ESTABLISHED 24594/java 6tcp 0 0 ::ffff:192.168.120.20:16064 ::ffff:192.168.119.20:32207 ESTABLISHED 24594/java 7tcp 0 0 ::ffff:192.168.120.20:16064 ::ffff:10.2.1.68:51303 ESTABLISHED 24594/java 8tcp 0 0 ::ffff:192.168.120.20:16064 ::ffff:10.2.1.68:51302 ESTABLISHED 24594/java 9tcp 0 0 ::ffff:192.168.120.20:16064 ::ffff:10.2.1.68:50020 ESTABLISHED 24594/java 10tcp 0 0 ::ffff:192.168.120.20:16064 ::ffff:10.2.1.68:50019 ESTABLISHED 24594/java 11tcp 0 0 ::ffff:192.168.120.20:16064 ::ffff:10.2.1.68:56155 ESTABLISHED 24594/java 12tcp 0 0 ::ffff:192.168.120.20:16064 ::ffff:10.2.1.68:50681 ESTABLISHED 24594/java 13tcp 0 0 ::ffff:192.168.120.20:16064 ::ffff:10.2.1.68:50680 ESTABLISHED 24594/java 14tcp 0 0 ::ffff:192.168.120.20:16064 ::ffff:10.2.1.68:52136 ESTABLISHED 24594/java 15tcp 0 0 ::ffff:192.168.120.20:16064 ::ffff:10.2.1.68:56989 ESTABLISHED 24594/java 16tcp 0 0 ::ffff:192.168.120.20:16064 ::ffff:10.2.1.68:56988 ESTABLISHED 24594/java 17[root@andy ~]#说明
运行在端口16064的进程id为24596，再通过ps命令就可以找到具体的应用程序了。