netstat는 시스템의 네트워크 연결 상태(tcp, udp, 소켓연결)을 보여주는 유틸리티입니다.

사용 방법은 netstat [options] 으로 사용하면 됩니다. 

* 옵션

* netstat 상태값

TCP 플래그

기본 사용법

netstat -t 현재 접속중의 포트들의 상태 내용 확인

netstat -nap (열려 있는 모든 포트)

netstat -l 또는 netstat -nap | grep LISTEN (LISTEN 되는 모든 포트)

netstat -nap | grep ESTABLISHED | wc -l ( 모든 서비스 동시 접속자 수)

netstat -nap | grep :80 | grep ESTABLISHED | wc -l ( 웹 동시 접속자 수)

netstat -natc (열려있는 모든 TCP 포트를 일정시간마다 반복 출력한다) 

* 예제.

1. 인터넷 연결 상태 보기.

[root@navi-linux ~]# netstat -A inet

Active Internet connections (w/o servers)

Proto Recv-Q Send-Q Local Address               Foreign Address             State

tcp        0      0 navi-linux:35212            123.123.123.123:http           ESTABLISHED

tcp        0      0 navi-linux:56976            61-111-58-50.kidc.net:http  ESTABLISHED

tcp        0    314 navi-linux:telnet           231.231.231.231:netcheque     ESTABLISHED

2. 통계값 보기 (프로토콜별).

[root@navi-linux ~]# netstat -s

Ip:

    1141245 total packets received

    355 with invalid addresses

    0 forwarded

    0 incoming packets discarded

    1007688 incoming packets delivered

    1050768 requests sent out

    24 dropped because of missing route

Icmp:

    24 ICMP messages received

    0 input ICMP message failed.

    ICMP input histogram:

        destination unreachable: 22

        echo requests: 1

        echo replies: 1

    141 ICMP messages sent

    0 ICMP messages failed

    ICMP output histogram:

        destination unreachable: 135

        echo request: 5

        echo replies: 1

IcmpMsg:

        InType0: 1

        InType3: 22

        InType8: 1

        OutType0: 1

        OutType3: 135

        OutType8: 5

Tcp:

    64013 active connections openings

    16 passive connection openings

    10 failed connection attempts

    12 connection resets received

    6 connections established

    901778 segments received

    941524 segments send out

    2915 segments retransmited

    0 bad segments received.

    163 resets sent

Udp:

    105794 packets received

    4 packets to unknown port received.

    0 packet receive errors

    106216 packets sent

UdpLite:

TcpExt:

    1 ICMP packets dropped because socket was locked

    4112 TCP sockets finished time wait in fast timer

    2 packets rejects in established connections because of timestamp

    111607 delayed acks sent

    12 delayed acks further delayed because of locked socket

    Quick ack mode was activated 901 times

    112 packets directly queued to recvmsg prequeue.

    832 packets directly received from prequeue

    464924 packets header predicted

    48 packets header predicted and directly queued to user

    125499 acknowledgments not containing data received

    1063 predicted acknowledgments

    6 congestion windows recovered after partial ack

    0 TCP data loss events

    2 timeouts after SACK recovery

    393 other TCP timeouts

    901 DSACKs sent for old packets

    78 DSACKs received

    6 connections reset due to unexpected data

    10 connections reset due to early user close

    356 connections aborted due to timeout

    TCPDSACKIgnoredOld: 4

    TCPDSACKIgnoredNoUndo: 6

    TCPSackShiftFallback: 2

IpExt:

    InMcastPkts: 7643

    OutMcastPkts: 42

    InBcastPkts: 124586

    InOctets: 752411380

    OutOctets: 172659736

    InMcastOctets: 2477680

    OutMcastOctets: 11674

    InBcastOctets: 13876218

3. 통계값 보기 (인터페이스별).

[root@navi-linux ~]# netstat -i

Kernel Interface table

Iface       MTU Met    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR

Flg

eth0       1500   0  2168579      0      0      0  1053363      0      0      0

BMRU

eth1       1500   0        0      0      0      0        0      0      0      0

BMU

eth2       1500   0        0      0      0      0        0      0      0      0

BMU

lo        16436   0       20      0      0      0       20      0      0      0

LRU

4. 열려 있는 TCP 포트 보기.

[root@navi-linux ~]# netstat -lnt -A inet

Active Internet connections (only servers)

Proto Recv-Q Send-Q Local Address               Foreign Address             State

tcp        0      0 0.0.0.0:111                 0.0.0.0:*                   LISTEN

tcp        0      0 0.0.0.0:34580               0.0.0.0:*                   LISTEN

tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN

5. 연결된 TCP 포트 보기.

[root@navi-linux ~]# netstat -nt -A inet

Active Internet connections (w/o servers)

Proto Recv-Q Send-Q Local Address               Foreign Address             State

tcp        0      0 111.111.111.111:33659         123.123.123.123:80             ESTABLISHED

tcp        0      0 111.111.111.111:56976         61.111.58.50:80             ESTABLISHED

tcp        0    134 112.112.112.112:23            121.121.121.121:4008          ESTABLISHED

6. 모든 열려있는 포트 보기.

[root@navi-linux ~]# netstat -ant -A inet

Active Internet connections (w/o servers)

Proto Recv-Q Send-Q Local Address               Foreign Address             State

tcp        0      0 0.0.0.0:111                 0.0.0.0:*                   LISTEN

tcp        0      0 0.0.0.0:34580               0.0.0.0:*                   LISTEN

tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN

tcp        0      0 111.111.111.111:33659         123.123.123.123:80             ESTABLISHED

tcp        0      0 111.111.111.111:56976         61.111.58.50:80             ESTABLISHED

tcp        0    134 112.112.112.112:23            121.121.121.121:4008          ESTABLISHED

7. 특정 포트나 호스트 모니터링 하기. (1초마다 80포트(인터넷)를 보기. ':80' 라는 텍스트가 들어간 라인을 보여준다. netstat -A inet -n | grep :80 을 1초마다 실행하는 결과이다.)

[root@navi-linux ~]# netstat -A inet -n -c | grep :80

tcp        0      0 111.111.111.111:56214         123.123.123.123:80             ESTABLISHED

tcp        0      0 111.111.111.111:56976         61.111.58.50:80             ESTABLISHED

8. 네트워크 자원을 사용중인 프로그램 종료 하기.

[root@navi-linux ~]# netstat -A inet -atp

Active Internet connections (servers and established)

Proto Recv-Q Send-Q Local Address               Foreign Address             Stat

e       PID/Program name

tcp        0      0 *:sunrpc                    *:*                         LIST

EN      856/rpcbind

tcp        0      0 *:34580                     *:*                         LIST

EN      935/rpc.statd

tcp        0      0 *:ssh                       *:*                         LIST

EN      3681/sshd

tcp        0      0 navi-linux:47270            111.111.111.111:http           ESTA

BLISHED 2263/firefox

tcp        0      0 navi-linux:41638            111.111.111.111:http           ESTA

BLISHED 2263/firefox

tcp        0      0 navi-linux:telnet           222.222.222.222:netplan       ESTA

BLISHED 943/in.telnetd: 172

tcp        0      0 navi-linux:46763            111.111.111.111:http           ESTA

BLISHED 2263/firefox

tcp        0      0 navi-linux:47264            111.111.111.111:http           TIME

_WAIT   -

tcp        0      0 navi-linux:52984            123.123.123.123:ftp          ESTA

BLISHED 886/filezilla

tcp        0      0 navi-linux:56581            61-111-58-50.kidc.net:http  ESTA

BLISHED 1857/clock-applet

tcp        0      0 navi-linux:47273            111.111.111.111:http           ESTA

BLISHED 2263/firefox

파일질라가 네트워크를 이용중이다. 프로그램을 종료시키자. -p 옵션이 들어가 있어야 한다. 맨 우측 886/filezilla 가 보인다. 왼쪽이 프로세서 ID(PID)이고 오른쪽이 실행이름이다.

[root@navi-linux ~]# kill 886

kill 명령어로 파일질라의 PID를 입력하여 프로그램을 종료시킨다.

[root@navi-linux ~]# netstat -A inet -atp

Active Internet connections (servers and established)

Proto Recv-Q Send-Q Local Address               Foreign Address             Stat

e       PID/Program name

tcp        0      0 *:sunrpc                    *:*                         LIST

EN      856/rpcbind

tcp        0      0 *:34580                     *:*                         LIST

EN      935/rpc.statd

tcp        0      0 *:ssh                       *:*                         LIST

EN      3681/sshd

tcp        0      0 navi-linux:57621            111.111.111.111:http           ESTA

BLISHED 2263/firefox

tcp        0      2 navi-linux:telnet           222.222.222.222:netplan       ESTA

BLISHED 943/in.telnetd: 172

tcp        0      0 navi-linux:42278            111.111.111.111:http           ESTA

BLISHED 2263/firefox

tcp        0      0 navi-linux:52984            123.123.123.123:ftp          TIME

_WAIT   -

tcp        0      0 navi-linux:56581            61-111-58-50.kidc.net:http  ESTA

BLISHED 1857/clock-applet

재확인결과 없어져있다. TIME_WAIT 은 연결 종료 후 1분간 보인다.

현재 얼마나 많은 네트워크 접속이 있는지 확인하기

while [ true ]

do

net_status=`netstat -t | wc -l`

dt=`date "%Y-%m-%d %H:%M:%S"

echo "${dt} : ${net_status}"

done