手机版
你好,游客 登录 注册
背景:
阅读新闻

Linux netstat 命令入门知识

[日期:2015-02-26] 来源:Linux社区  作者:kaifly [字体: ]

OUTPUT(输出)

Linux netstat 命令入门知识

  Active Internet connections (TCP, UDP, raw)
  Proto
      The protocol (tcp, udp, raw) used by the socket
  Recv-Q
      The count of bytes not copied by the user program connected to this socket.
    不是由连接到这个套接字的用户程序复制的字节数
  Send-Q
      The count of bytes not acknowledged by the remote host.
    还未被远程主机确认的字节数
    上面两个输出,我理解应该是接收和发送的网络队列情况

  Local Address
      Address  and port number of the local end of the socket.  Unless the --numeric (-n) option is specified, the socket address is resolved to its canonical host name (FQDN),
and the port number is translated into the corresponding service name.

  Foreign Address
      Address and port number of the remote end of the socket.  Analogous to "Local Address."

  State(连接状态,共12中状态,重点。这里需要和TCP三次握手各状态相对应)
      The state of the socket. Since there are no states in raw mode and usually no states used in UDP, this column may be left blank. Normally this can be one of several  val-ues:

      ESTABLISHED
          The socket has an established connection.
      代表一个打开的连接,双方可以进行或已经在数据交互了。代表一个打开的连接,数据可以传送给用户
      SYN_SENT
          The socket is actively attempting to establish a connection.

      客户端通过应用程序调用connect进行active open.于是客户端tcp发送一个SYN以请求建立一个连接.之后状态置为SYN_SENT.在发送连接请求后等待匹配的连接请求

      SYN_RECV
              A connection request has been received from the network.

      服务端应发出ACK确认客户端的SYN,同时自己向客户端发送一个SYN. 之后状态置为SYN_RECV.在收到和发送一个连接请求后等待对连接请求的确认
      FIN_WAIT1
          The socket is closed, and the connection is shutting down.

      主动关闭(active close)端应用程序调用close,于是其TCP发出FIN请求主动关闭连接,之后进入FIN_WAIT1状态.等待远程TCP的连接中断请求,或先前的连接中断请求的确认

      FIN_WAIT2
          Connection is closed, and the socket is waiting for a shutdown from the remote end.

      主动关闭端接到ACK后,就进入了 FIN-WAIT2 . 从远程TCP等待连接中断请求

      TIME_WAIT
          The socket is waiting after close to handle packets still in the network.
      在主动关闭端接收到FIN后,TCP 就发送ACK包,并进入TIME-WAIT状态。等待足够的时间以确保远程TCP接收到连接中断请求的确认
      CLOSED The socket is not being used.
    被动关闭端在接受到ACK包后,就进入了closed的状态。连接结束.没有任何连接状态
      CLOSE_WAIT
          The remote end has shut down, waiting for the socket to close.
    被动关闭(passive close)端TCP接到FIN后,就发出ACK以回应FIN请求(它的接收也作为文件结束符传递给上层应用程序),并进入CLOSE_WAIT.等待从本地用户发来的连接中断请求
      LAST_ACK
          The remote end has shut down, and the socket is closed. Waiting for acknowledgement.
    被动关闭端一段时间后,接收到文件结束符的应用程序将调用CLOSE关闭连接。这导致它的TCP也发送一个 FIN,等待对方的ACK.就进入了LAST-ACK .等待原来发向远程TCP的连接中断请求的确认
      LISTEN The socket is listening for incoming connections.  Such sockets are not included in the output unless you specify the --listening (-l) or --all (-a) option.
    首先服务端需要打开一个socket进行监听,状态为LISTEN.侦听来自远方TCP端口的连接请求
      CLOSING
          Both sockets are shut down but we still don’t have all our data sent.
    双方主机的套接字都已关闭,但是还没有完全发送完所有数据
      UNKNOWN(未知状态)
          The state of the socket is unknown.
  User
      The username or the user id (UID) of the owner of the socket.
    socket所属的用户名或者用户UID
  PID/Program name
      Slash-separated pair of the process id (PID) and process name of the process that owns the socket. --program causes this column to be included. You will also need superuser privileges to see this information on sockets you don't own.This identification information is not yet available for IPX sockets.

以上就是netstat的基本用法以及输出信息解释,日常要多实践才能深刻的理解其中含义,才能学以致用。共勉!

本文永久更新链接地址http://www.linuxidc.com/Linux/2015-02/114108.htm

linux
本文评论   查看全部评论 (0)
表情: 表情 姓名: 字数

       

评论声明
  • 尊重网上道德,遵守中华人民共和国的各项有关法律法规
  • 承担一切因您的行为而直接或间接导致的民事或刑事法律责任
  • 本���管理人员有权保留或删除其管辖留言中的任意内容
  • 本站有权在网站内转载或引用您的评论
  • 参与本评论即表明您已经阅读并接受上述条款