Commands using netstat (131)
-
The command could show you all conecctions if you skip "grep ESTABLISHED" Show Sample Output
3netstat -ant | grep :80 | grep ESTABLISHED | awk '{print $5}' | awk -F: '{print $1}' | sort | uniq -c | sort -n -
worked on ubuntu 9.04 and cygwin with MS netstat Show Sample Output
3netstat -an | awk '$1 ~ /[Tt][Cc][Pp]/ && $NF ~ /ESTABLISHED/{i++}END{print "Connected:\t", i}' -
If you want prepend/append text just wrap in echo:
echo Connected: `netstat -an|grep -ci "tcp.*established"`Show Sample Output3netstat -an|grep -ci "tcp.*established" -
Sample command to obtain a list of geographic localization for established connections, extracted from netstat. Need geoiplookup command ( part of geoip package under CentOS) Show Sample Output
3for i in $(netstat --inet -n|grep ESTA|awk '{print $5}'|cut -d: -f1);do geoiplookup $i;done -
no need grep. its redundant when awk is present.
3netstat | awk '/EST/{print $5}' | sort -
Alternative of OJM snippet : This one show the IP too, where ports bind. It's very important, because if there's only 127.0.0.1 instead of 0.0.0.0, connections from internet are rejected.
3netstat -nptl -
perl-less way
3(netstat -atn | awk '{printf "%s\n%s\n", $4, $4}' | grep -oE '[0-9]*$'; seq 32768 61000) | sort -n | uniq -u | head -n 1 -
Summarize established connections after netstat output. Using tee and /dev/stderr you can send one command output to terminal before executing wc so you can summarize at the bottom of the output. Show Sample Output
3netstat -n | grep ESTAB |grep :80 | tee /dev/stderr | wc -l -
Run netstat as root (via sudo) to get the ID of the process listening on the desired socket. Use awk to 1) match the entry that is the listening socket, 2) matching the exact port (bounded by leading colon and end of column), 3) remove the trailing slash and process name from the last column, and finally 4) use the system(…) command to call kill to terminate the process. Two direct commands, netstat & awk, and one forked call to kill. This does kill the specific port instead of any port that starts with 50. I consider this to be safer.
3sudo netstat -plnt | awk '($4 ~ /:50$/){sub(/\/.*/, "", $7); system("sudo kill " $7)}' -
This command does a tally of concurrent active connections from single IPs and prints out those IPs that have the most active concurrent connections. VERY useful in determining the source of a DoS or DDoS attack. Show Sample Output
2netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n | tail -
Ever logged into a *nix box and needed to know which webserver is running and where all the current access_log files are? Run this one liner to find out. Works for Apache or Lighttpd as long as CustomLog name is somewhat standard. HINT: works great as input into for loop, like this:
for i in `lsof -p $(netstat -ltpn|awk '$4 ~ /:80$/ {print substr($7,1,index($7,"/")-1)}')| awk '$9 ~ /access.log$/ {print $9| "sort -u"}'` ; do echo $i; doneVery useful for triage on unfamiliar servers! Show Sample Output2lsof -p $(netstat -ltpn|awk '$4 ~ /:80$/ {print substr($7,1,index($7,"/")-1)}')| awk '$9 ~ /access.log$/ {print $9| "sort -u"}' -
2netstat -alnp | grep ::80
-
2netstat -ntlp | grep -w 80 | awk '{print $7}' | cut -d/ -f1
-
IP addresses and number of connections connected to port 80. Show Sample Output
2netstat -tn 2>/dev/null | grep ':80 ' | awk '{print $5}' |sed -e 's/::ffff://' | cut -f1 -d: | sort | uniq -c | sort -rn | head -
This takes all of the tab spaces, and uses column to put them into the appropriately sized table. Show Sample Output
2netstat -pnut -W | column -t -s $'\t' -
1sudo netstat -punta
-
1netstat -an | grep -Ec '^tcp.+ESTABLISHED$'
-
This is to fetch the Gateway Ip Address of a machine. Use the below format to put the value in a variable if you wish to find the gateway ip in a script
GATEWAY=$(netstat -nr | awk 'BEGIN {while ($3!="0.0.0.0") getline; print $2}')1netstat -nr | awk 'BEGIN {while ($3!="0.0.0.0") getline; print $2}' -
Counts TCP states from Netstat and displays in an ordered list. Show Sample Output
1netstat -an | awk '/tcp/ {print $6}' | sort | uniq -c -
1netstat -rn | grep UG | tr -s " " | cut -d" " -f2
-
This command is primarily going to work on linux boxes. and needs to be changed, for example IP=10\.194\.194\.2 PORT=389
1netstat -n | grep '^tcp.*<IP>:<PORT>' | tr " " | awk 'BEGIN{FS="( |:)"}{print $6}' | sort | uniq -c | sort -n -k1 | awk '{if ($1 >= 10){print $2}}' -
Gets the application's name that's listening from the port 8080 through IPv6 Show Sample Output
1netstat -lnp6 | grep :8080 | sed 's#^[^\/]*/\([a-z0-9]*\)#\1#' -
Not really better - just different ;) There's probably a really simple solution out there somewhere... Show Sample Output
1netstat -atn | perl -0777 -ne '@ports = /tcp.*?\:(\d+)\s+/imsg ; for $port (32768..61000) {if(!grep(/^$port$/, @ports)) { print $port; last } }' -
1netstat -n -f inet|awk '/\.389/{print $2}'|cut -f1-4 -d.|sort -u
-
Useful for checking the number and state of TCP connections. Show Sample Output
1netstat -nt | awk '{print $6}' | sort | uniq -c | sort -n -k 1 -r - < 1 2 3 4 > Last ›
What's this?
commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.
Check These Out
Stay in the loop…
- Follow the Tweets.
-
Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.
» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10 - Subscribe to the feeds.
-
Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):
Subscribe to the feed for:
- » all commands
- » commands with 3 up-votes (commandlinefu3)
- » commands with 10 up-votes (commandlinefu10)
- » commands using netstat