Netstat is used to display active TCP connections and related listening ports in the computer or system. Actually, there are more features provided by netstat like display statistics about network stack protocols, IPv4, IPv6, TCP, UDP, etc.
The syntax of the netstat command is like below. Simply we can use the following options.
netstat命令的语法如下。 只需我们可以使用以下选项。
netstat OPTIONS
OPTIONS will set different options and arguments about the netstat command behavior.选项将设置有关netstat命令行为的不同选项和参数。
显示带有侦听端口的所有TCP和UDP连接 (Display All TCP and UDP Connections with Listening Ports)
TCP is the most used protocol for the transmission of packets between different hosts. In a regular usage for a host, there will be a lot of TCP connections in different phases. We can display all these connections with -a option like below.
We can see that while listing listening ports following information about these ports is provided.
我们可以看到，在列出侦听端口时，提供了有关这些端口的信息。
Proto is the protocol the listening port is running. Generally, TCP and UDP are used.
Proto是侦听端口正在运行的协议。 通常，使用TCP和UDP。
Local Address is the local or current system IP address and ports number. The IP address and the port number are delimited with the :. 0.0.0.0 means all local IP addresses or network interfaces where 127.0.0.1 means only localhost or current system.
Local Address是本地或当前系统的IP地址和端口号。 IP地址和端口号以:分隔。 0.0.0.0表示所有本地IP地址或网络接口，其中127.0.0.1表示仅本地主机或当前系统。
Foreign Address is the remote IP address which is initiated a connection. Like Local address, IP address and the port number are delimited with the :.
State will provide the current status of the given port. A port can be listening which means accepting connections or CLOSED recently closed etc. More details about the port or TCP states can be found below.
As we know TCP protocol provides reliable data transfer between hosts. TCP implements sessions to provide this reliability. From start to end there are different states in a TCP session. Here the sequence and meaning of TCP states.
Ethernet or MAC generally used for the same meaning. Ethernet is a Layer 2 protocol used to communicate in our LAN with other hosts and mostly with a gateway that is used to access other networks or the internet. We can list detailed information about the ethernet protocol. We will use -e option to list ethernet statistics.
Following information about Ethernet Statistics will be provided.
将提供有关以太网统计信息的以下信息。
Received column is used to specify the received sizes.
Received列用于指定接收大小。
Sent column is used to specify the sent sizes.
Sent列用于指定发送的大小。
Bytes is used successfully completed transfers.
Bytes用于成功完成传输。
Unicast packets generally related to the UDP protocol where there is no connection and session management.
Unicast packets通常与没有连接和会话管理的UDP协议有关。
Non-unicast
Non-unicast
Discards is the packets that are discarded because of the problems.
Discards是由于问题而丢弃的数据包。
Errors show the sizes of the packets where errors occurred.
Errors显示发生错误的数据包的大小。
Unknown protocols show the protocols currently unknown by the TCP/IP stack.
Unknown protocols显示TCP / IP堆栈当前未知的协议。
显示端口和主机名的数字表示 (Display Numeric Presentation of Ports and Hostname)
Host and ports generally have numeric and text presentations. netstat command by default try to resolve the hostname and port name into text format. If we need to get the host and port numeric information like IP address and the port number we can use -n option.
Display Numeric Presentation of Ports and Hostname
显示端口和主机名的数字表示
显示连接或端口进程ID(Display Connection or Ports Process ID)
All ports and connections are opened and managed by processes in the operating system. For example, Apache is a web server and uses TCP 80 for listening to HTTP requests. We can list processes id of given connection or port with -o option.
Display Connection or Ports Process ID
显示连接或端口进程ID
We can see that also PID or Process ID is provided which is the current application process ID which listens given port and interface.
我们可以看到还提供了PID或Process ID ，这是侦听给定端口和接口的当前应用程序进程ID。
显示连接或端口进程名称 (Display Connection or Ports Process Name)
Like the previous example, we can list established connection or listening port process name with -b option. But this option requires Administrator privileges.
Normally netstat will list hostnames in a simple manner and in a fast way. It can skip some domain names too. We can for netstat to print fully qualified domain names with -f option.
We can see that only resolved DNS names or fully qualified domain names are shown like oracle.com.
我们可以看到，仅显示解析的DNS名称或完全合格的域名，例如oracle.com 。
仅显示TCP协议 (Display Only TCP Protocol)
netstat command provides extensive filtering options according to protocols. We can provide a filter option with -p and protocol name. In this example, we will filter and show only TCP protocol.
As we can see there is no UDP protocol related port and connection information.
如我们所见，没有与UDP协议相关的端口和连接信息。
仅显示UDP协议 (Display Only UDP Protocol)
We can also filter and show only UDP protocol ports with -p udp option. Here we provided -a to list UDP too.
我们还可以使用-p udp选项过滤并仅显示UDP协议端口。 在这里，我们也提供了-a来列出UDP。
> netstat -p udp -a
Display Only UDP Protocol
仅显示UDP协议
As we can see there is no TCP related port or connection information in this example and all UDP ports are currently listening mode without a connection state. This is because the UDP protocol is a connectionless protocol that does not create a session for data transmission.
仅显示IPv4端口和套接字 (Display Only IPv4 Ports and Sockets)
We can use -p ip option to filter and show only IPv4 connections. This can be useful generally because the IPv6 protocol is not common.
我们可以使用-p ip选项来过滤和仅显示IPv4连接。 通常这会很有用，因为IPv6协议并不常见。
> netstat -p ip
仅显示IPv6端口和套接字 (Display Only IPv6 Ports and Sockets)
We can use -p ipv6 option to filter and show only IPv6 connections about the netstat command.
我们可以使用-p ipv6选项来过滤和显示有关netstat命令的IPv6连接。
> netstat -p ipv6
显示IPv4 ve IPv6统计信息 (Display IPv4 ve IPv6 Statistics )
netstat command provides a lot of statistical information about the network stack. These statistics provide detailed metrics about protocols. We can list this statistical information with -s option.
Echo Replies: ICMP Echo replies which are generally used for ping or ping command.
Echo Replies ：ICMP回音回复，通常用于ping或ping命令。
显示路由表 (Display Routing Table)
Routing is used to set IP packets first-hop according to their destination. Our system route information can be listed with -r option.
路由用于根据IP数据包的目的地设置第一跳。 我们的系统路由信息可以使用-r选项列出。
> netstat -r
Display Routing Table
显示路由表
As we can see the default route is printed in the first line which IP address is 192.168.122.1 .
如我们所见，默认路由打印在第一行，其IP地址为192.168.122.1 。
交互式显示信息 (Display Information Interactively)
If we need to list given options output interactively to monitor the metrics we can use interactive mode. Interactive mode is enabled by providing interval value to print output. This feature does not needs any option we will only provide interval value which is 2 in this case.
