Commands matching netstat (162)
-
Check the connection of the maximum number of IP Show Sample Output
0netstat -na | grep ESTABLISHED | awk '{print$5}' | awk -F : '{print$1}' | sort | uniq -c | sort -r -
0netstat -tn 2>/dev/null | grep :80 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head
-
netstat doesn't always function similarly across the board. Also the use of three commands in the original (netstat followed by grep followed by grep) is a waste of pipes
0lsof -i :80 | tee /dev/stderr | wc -l -
This is very handy for troubleshooting apps connection to internet. Shows an app's outgoing ip/port before and after connection established. Run this command and init the app you're investigating. I used that when trying to understand what is the destination's ip/port needed to open in firewall, for a specific VPN app. Similar for windows cmd: netstat -nafo | find /v "LISTENING" | find /v "0.0.0.0" | find /v "127.0.0.1"
0watch -n0.5 -d "netstat -nafo | grep -v -E 'LISTENING|0.0.0.0|127.0.0.1|\[::\]:|\[::1\]:'" -
When bootstrapping or repairing a node this is a simple way to keep tabs on what a node is actively doing. Show Sample Output
0watch -d 'echo -e "Remaining: `(nodetool netstats | grep " 0%" | wc -l)` \nCurrent: `(nodetool netstats | grep "%" | grep -v " 0%")`"' -
From 'man netstat' "netstat -i | -I interface [-abdnt] [-f address_family] [-M core] [-N system] Show the state of all network interfaces or a single interface which have been auto-configured (interfaces statically configured into a system, but not located at boot time are not shown). An asterisk (``*'') after an interface name indicates that the interface is ``down''. If -a is also present, multicast addresses currently in use are shown for each Ethernet interface and for each IP interface address. Multicast addresses are shown on separate lines following the interface address with which they are associated. If -b is also present, show the number of bytes in and out. If -d is also present, show the number of dropped packets. If -t is also present, show the contents of watchdog timers."
-1netstat -an | grep -i listen -
-1netstat -4tnape
-
Can be used to discover what programms create internet traffic. Skip the part after awk to get more details. Has anyone an idea why the uniq doesn't work propperly here (see sample output)? Show Sample Output
-1netstat -lantp | grep -i establ | awk -F/ '{print $2}' | uniq | sort -
Tested on CentOS, Ubuntu, and MacOS.
-1netstat -rn | awk '/UG/{print $2}' -
This command allows you to find the effective uid and gid of the Apache process regardless of process name (which can be apache2 or httpd depending on distro).
-1ps -o euid,egid --ppid `netstat --inet --inet6 -pln|awk '/:80 / { split($7,tmp, "/"); print tmp[1]; }'`|sort |uniq|grep -v EUID -
find all computer connected to my host through TCP connection Show Sample Output
-1netstat -nut | awk '$NF=="ESTABLISHED" {print $5}' | cut -d: -f1 | sort -u -
Monitoring TCP connections number showing each state. It uses ss instead of netstat because it's much faster with high trafic. You can fgrep specific ports by piping right before awk: watch "ss -nat | fgrep :80 | awk '"'{print $1}'"' | sort | uniq -c" Show Sample Output
-1watch "ss -nat | awk '"'{print $1}'"' | sort | uniq -c" -
Open Port Check
-1netstat -an | grep --color -i -E 'listen|listening' -
Output contains also garbage (text parts from netstat's output) but it's good enough for quick check who's overloading your server.
-1netstat -antu | awk '{print $5}' | awk -F: '{print $1}' | sort | uniq -c | sort -n -
-1sudo netstat -tulpn | grep :8080
-
Useful to check DDoS attacks on servers. Show Sample Output
-2netstat -alpn | grep :80 | awk '{print $4}' |awk -F: '{print $(NF-1)}' |sort | uniq -c | sort -n -
Sometimes I need a quick visual way to determine if there is a particular server who is opening too many connections to the database machine.
-2netstat | grep EST | awk '{print $5}' | sort -
Shows you all listening tcp/udp ports, and what program has them open(depending on rights)
-2netstat -tunlp -
shell loop to scan netstat output avoiding loolback aliases (local/remote swap for local connections) Show Sample Output
-2while true ; do sleep 1 ; clear ; (netstat -tn | grep -P ':36089\s+\d') ; done -
-2netstat -atn | grep :22 | grep ESTABLISHED | awk '{print $4}' | sed 's/:22//'
-
This obtains a list of open connections that a user is connected to if he/she is using a SSH tunnel
-2netstat -t -p --extend | grep USERNAME -
-2netstat -lntp
-
This counts all established sessions on port 80. You can change :80 to any port number you want to check. Show Sample Output
-2netstat -anp | grep :80 | grep ESTABLISHED | wc -l -
-2netstat -nap|grep 80|grep LISTEN
-
-3netstat -l -p --tcp | egrep -e 'www.*[0-9]{3,4}\/(apache2|httpd)' | awk '{print$7}'
- ‹ First < 4 5 6 7 >
What's this?
commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.
Check These Out
Stay in the loop…
- Follow the Tweets.
-
Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.
» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10 - Subscribe to the feeds.
-
Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):
Subscribe to the feed for:
- » all commands
- » commands with 3 up-votes (commandlinefu3)
- » commands with 10 up-votes (commandlinefu10)
- » commands matching netstat