使用 netstat 命令获取特定 IP 地址连接的详细信息

发表 admin at 2024年8月26日

类别

未分类

标签

netstat 命令和 shell 管道功能可用于挖掘有关特定 IP 地址连接的更多信息。您可以找到已建立的连接总数、正在关闭的连接、SYN 和 FIN 位等等。您还可以使用 netstat 显示每个协议的汇总统计信息。

这对于查明您的服务器是否受到攻击很有用。您还可以使用此方法列出滥用的 IP 地址
# netstat -nat | awk '{print $6}' | sort | uniq -c | sort -n
。输出：

      1 CLOSE_WAIT
      1 established)
      1 Foreign
      3 FIN_WAIT1
      3 LAST_ACK
     13 ESTABLISHED
     17 LISTEN
    154 FIN_WAIT2
    327 TIME_WAIT

挖掘有关特定 IP 地址的更多信息：
# netstat -nat |grep {IP-address} | awk '{print $6}' | sort | uniq -c | sort -n

      2 LAST_ACK
      2 LISTEN
      4 FIN_WAIT1
     14 ESTABLISHED
     91 TIME_WAIT
    130 FIN_WAIT2

繁忙的服务器可以提供更多信息：
# netstat -nat |grep 202.54.1.10 | awk '{print $6}' | sort | uniq -c | sort -n
输出：

  15 CLOSE_WAIT
  37 LAST_ACK
  64 FIN_WAIT_1
  65 FIN_WAIT_2
1251 TIME_WAIT
3597 SYN_SENT
5124 ESTABLISHED

获取所有唯一 IP 地址列表

要打印连接到服务器的所有唯一 IP 地址的列表，请输入：
# netstat -nat | awk '{ print $5}' | cut -d: -f1 | sed -e '/^$/d' | uniq
要打印所有唯一 IP 地址的总数，请输入：
# netstat -nat | awk '{ print $5}' | cut -d: -f1 | sed -e '/^$/d' | uniq | wc -l
输出：

查明 Box 是否受到 DoS 攻击

如果你认为你的 Linux 机器受到了攻击，请打印出机器上打开的连接列表，并根据 IP 地址对它们进行排序，输入：
# netstat -atun | awk '{print $5}' | cut -d: -f1 | sed -e '/^$/d' |sort | uniq -c | sort -n
输出：

    1 10.0.77.52
      2 10.1.11.3
      4 12.109.42.21
      6 12.191.136.3
.....
...
....
    13 202.155.209.202
     18 208.67.222.222
     28 0.0.0.0
    233 127.0.0.1

您可以简单地使用 iptables 来阻止所有滥用的 IP，或者只是对它们进行空路由。

获取 TCP 连接的实时视图

您可以使用tcptrack 命令显示在给定网络接口上看到的 TCP 连接的状态。tcptrack 监视它们的状态并以排序的更新列表的形式显示状态、源/目标地址和带宽使用情况等信息，非常类似于 top 命令。

显示每个协议的摘要统计信息

只需使用 netstat -s: 输出：
# netstat -s | less # netstat -t -s | less # netstat -u -s | less # netstat -w -s | less # netstat -s

Ip:
    88354557 total packets received
    0 forwarded
    0 incoming packets discarded
    88104061 incoming packets delivered
    96037391 requests sent out
    13 outgoing packets dropped
    66 fragments dropped after timeout
    295 reassemblies required
    106 packets reassembled ok
    66 packet reassembles failed
    34 fragments failed
Icmp:
    18108 ICMP messages received
    58 input ICMP message failed.
    ICMP input histogram:
        destination unreachable: 7173
        timeout in transit: 472
        redirects: 353
        echo requests: 10096
    28977 ICMP messages sent
    0 ICMP messages failed
    ICMP output histogram:
        destination unreachable: 18881
        echo replies: 10096
Tcp:
    1202226 active connections openings
    2706802 passive connection openings
    7394 failed connection attempts
    47018 connection resets received
    23 connections established
    87975383 segments received
    95235730 segments send out
    681174 segments retransmited
    2044 bad segments received.
    80805 resets sent
Udp:
    92689 packets received
    14611 packets to unknown port received.
    0 packet receive errors
    96755 packets sent
TcpExt:
    48452 invalid SYN cookies received
    7357 resets received for embryonic SYN_RECV sockets
    43 ICMP packets dropped because they were out-of-window
    5 ICMP packets dropped because socket was locked
    2672073 TCP sockets finished time wait in fast timer
    441 time wait sockets recycled by time stamp
    368562 delayed acks sent
    430 delayed acks further delayed because of locked socket
    Quick ack mode was activated 36127 times
    32318597 packets directly queued to recvmsg prequeue.
    741479256 packets directly received from backlog
    1502338990 packets directly received from prequeue
    18343750 packets header predicted
    10220683 packets header predicted and directly queued to user
    17516622 acknowledgments not containing data received
    36549771 predicted acknowledgments
    102672 times recovered from packet loss due to fast retransmit
    Detected reordering 1596 times using reno fast retransmit
    Detected reordering 1 times using time stamp
    8 congestion windows fully recovered
    32 congestion windows partially recovered using Hoe heuristic
    19 congestion windows recovered after partial ack
    0 TCP data loss events
    39951 timeouts after reno fast retransmit
    29653 timeouts in loss state
    197005 fast retransmits
    186937 retransmits in slow start
    131433 other TCP timeouts
    TCPRenoRecoveryFail: 20217
    147 times receiver scheduled too late for direct processing
    29010 connections reset due to unexpected data
    365 connections reset due to early user close
    6979 connections aborted due to timeout

显示接口表

您可以使用 netstat 轻松显示 eth0 的丢弃数据包和总传输数据包：
# netstat --interfaces eth0
输出：

Kernel Interface table
Iface       MTU Met    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0       1500   0  2040929      0      0      0  3850539      0      0      0 BMRU

其他与 netstat 相关的文章/提示：

有关详细信息，请阅读以下手册页：
$ man netstat $ man cut $ man awk $ man sed $ man grep

已更新以提高准确性。