- [ ~]# netstat -n|head -3
- Active Internet connections (w/o servers)
- Proto Recv-Q Send-Q Local Address Foreign Address State
- tcp 0 52 192.168.1.165:22 192.168.1.10:59337 ESTABLISHED
- 一共六列:
- 第一列为socket使用的协议。
- [ ~]$ netstat -n |awk '/^tcp/ {++S[$NF]} END {for(a in S) print a, S[a]}'
- TIME_WAIT 9137
- CLOSE_WAIT 207
- FIN_WAIT1 547
- ESTABLISHED 597
- FIN_WAIT2 74
- SYN_RECV 70
- CLOSING 55
- LAST_ACK 8
- [ ~]# man netstat
- OUTPUT
- Active Internet connections (TCP, UDP, raw)
- Proto
- The protocol (tcp, udp, raw) used by the socket.
- 第一列为socket使用的协议。
- Recv-Q
- The count of bytes not copied by the user program connected to this socket.
- 第二列为接到的但是还没处理的字节数。
- Send-Q
- The count of bytes not acknowledged by the remote host.
- 第三列为已经发送的但是没有被远程主机确认收到的字节数。
- Local Address
- Address and port number of the local end of the socket.Unless the --numeric(-n)
- optionisspecified,thesocketaddress is resolved to its canonical host name
- (FQDN), and the port number is translated into the corresponding service name.
- 第四列为 本地的地址及端口。
- Foreign Address
- Address and port number of the remote endofthesocket.Analogousto"Local Address."
- 第五列为外部的地址及端口。
- State
- Thestateofthesocket.Sincethere are no states in raw mode and usually no
- states used in UDP, this column may be left blank. Normally this can be one of sev-
- eral values:
- 第六列为socket的状态,通常仅仅有tcp的状态,状态值可能有ESTABLISHED,SYN_SENT,SYN_RECV FIN_WAIT1,FIN_WAIT2,TIME_WAIT等,详见下文。其中,最重要的是第六列。
- ESTABLISHED established
- The socket has an established connection.
- socket已经建立连接,表示处于连接的状态,一般认为有一个ESTABLISHED认为是一个服务的并发连接。这个连接状态在生产场景很重要,要重点关注。
- SYN_SENT
- The socket is actively attempting to establish a connection.
- socket正在积极尝试建立一个连接,即处于发送后连接前的一个等待但未匹配进入连接的状态。
- SYN_RECV
- A connection request has been received from the network.
- 已经从网络上收到一个连接请求。
- FIN_WAIT1
- The socket is closed, and the connection is shutting down.
- socket已关闭,连接正在或正要关闭。
- FIN_WAIT2
- Connectionisclosed,andthesocket is waiting for a shutdown from the remote end.
- 连接已关闭,并且socket正在等待远端结束。
- TIME_WAIT
- The socket is waiting after close to handle packets still in the network.
- socket正在等待关闭处理仍在网络上的数据包,这个连接状态在生产场景很重要,要重点关注。
- CLOSED The socket is not being used.| socket不在被占用了。
- CLOSE_WAIT
- The remote end has shutdown, waiting for the socket to close.
- 远端已经结束,等待socket关闭。
- LAST_ACK
- The remote end has shut down, and the socket is closed. Waiting for acknowl-edgement.|
- 远端已经结束,并且socket也已关闭,等待acknowl-edgement。
- LISTEN Thesocketislisteningforincoming connections.Such sockets are not
- included in the output unless you specify the --listening (-l) or --all (-a)
- option.
- socket正在监听连接请求。
- CLOSING
- Both sockets are shut down but we still don't have all our data sent.
- sockets关闭,但是我们仍旧没有发送数据。
- UNKNOWN
- The state of the socket is unknown
- 未知的状态。
来源: http://www.bubuko.com/infodetail-1991047.html