每天一個linux命令（56）：netstat命令 · 每天一個linux命令

netstat命令用于顯示與IP、TCP、UDP和ICMP協議相關的統計數據，一般用于檢驗本機各端口的網絡連接情況。netstat是在內核中訪問網絡及相關信息的程序，它能提供TCP連接，TCP和UDP監聽，進程內存管理的相關報告。如果你的計算機有時候接收到的數據報導致出錯數據或故障，你不必感到奇怪，TCP/IP可以容許這些類型的錯誤，并能夠自動重發數據報。但如果累計的出錯情況數目占到所接收的IP數據報相當大的百分比，或者它的數目正迅速增加，那么你就應該使用netstat查一查為什么會出現這些情況了。 1．命令格式： netstat?[-acCeFghilMnNoprstuvVwx][-A][--ip] 2．命令功能： netstat用于顯示與IP、TCP、UDP和ICMP協議相關的統計數據，一般用于檢驗本機各端口的網絡連接情況。 3．命令參數： -a或–all?顯示所有連線中的Socket。 -A或–?列出該網絡類型連線中的相關地址。 -c或–continuous?持續列出網絡狀態。 -C或–cache?顯示路由器配置的快取信息。 -e或–extend?顯示網絡其他相關信息。 -F或–fib?顯示FIB。 -g或–groups?顯示多重廣播功能群組組員名單。 -h或–help?在線幫助。 -i或–interfaces?顯示網絡界面信息表單。 -l或–listening?顯示監控中的服務器的Socket。 -M或–masquerade?顯示偽裝的網絡連線。 -n或–numeric?直接使用IP地址，而不通過域名服務器。 -N或–netlink或–symbolic?顯示網絡硬件外圍設備的符號連接名稱。 -o或–timers?顯示計時器。 -p或–programs?顯示正在使用Socket的程序識別碼和程序名稱。 -r或–route?顯示Routing?Table。 -s或–statistice?顯示網絡工作信息統計表。 -t或–tcp?顯示TCP傳輸協議的連線狀況。 -u或–udp?顯示UDP傳輸協議的連線狀況。 -v或–verbose?顯示指令執行過程。 -V或–version?顯示版本信息。 -w或–raw?顯示RAW傳輸協議的連線狀況。 -x或–unix?此參數的效果和指定”-A?unix”參數相同。 –ip或–inet?此參數的效果和指定”-A?inet”參數相同。 4．使用實例：實例1：無參數使用命令： netstat 輸出： [root@localhost?~]#?netstat Active?Internet?connections?(w/o?servers) Proto?Recv-Q?Send-Q?Local?Address???????????????Foreign?Address?????????????State?????? tcp????????0????268?192.168.120.204:ssh?????????10.2.0.68:62420?????????????ESTABLISHED? udp????????0??????0?192.168.120.204:4371????????10.58.119.119:domain????????ESTABLISHED? Active?UNIX?domain?sockets?(w/o?servers) Proto?RefCnt?Flags???????Type???????State?????????I-Node?Path unix??2??????[?]?????????DGRAM????????????????????1491???@/org/kernel/udev/udevd unix??4??????[?]?????????DGRAM????????????????????7337???/dev/log unix??2??????[?]?????????DGRAM????????????????????708823? unix??2??????[?]?????????DGRAM????????????????????7539??? unix??3??????[?]?????????STREAM?????CONNECTED?????7287??? unix??3??????[?]?????????STREAM?????CONNECTED?????7286??? [root@localhost?~]# 說明：從整體上看，netstat的輸出結果可以分為兩個部分：一個是Active?Internet?connections，稱為有源TCP連接，其中"Recv-Q"和"Send-Q"指的是接收隊列和發送隊列。這些數字一般都應該是0。如果不是則表示軟件包正在隊列中堆積。這種情況只能在非常少的情況見到。另一個是Active?UNIX?domain?sockets，稱為有源Unix域套接口(和網絡套接字一樣，但是只能用于本機通信，性能可以提高一倍)。 Proto顯示連接使用的協議,RefCnt表示連接到本套接口上的進程號,Types顯示套接口的類型,State顯示套接口當前的狀態,Path表示連接到套接口的其它進程使用的路徑名。套接口類型： -t?：TCP -u?：UDP -raw?：RAW類型 --unix?：UNIX域類型 --ax25?：AX25類型 --ipx?：ipx類型 --netrom?：netrom類型狀態說明： LISTEN：偵聽來自遠方的TCP端口的連接請求 SYN-SENT：再發送連接請求后等待匹配的連接請求（如果有大量這樣的狀態包，檢查是否中招了） SYN-RECEIVED：再收到和發送一個連接請求后等待對方對連接請求的確認（如有大量此狀態，估計被flood攻擊了） ESTABLISHED：代表一個打開的連接 FIN-WAIT-1：等待遠程TCP連接中斷請求，或先前的連接中斷請求的確認 FIN-WAIT-2：從遠程TCP等待連接中斷請求 CLOSE-WAIT：等待從本地用戶發來的連接中斷請求 CLOSING：等待遠程TCP對連接中斷的確認 LAST-ACK：等待原來的發向遠程TCP的連接中斷請求的確認（不是什么好東西，此項出現，檢查是否被攻擊） TIME-WAIT：等待足夠的時間以確保遠程TCP接收到連接中斷請求的確認 CLOSED：沒有任何連接狀態 ? ? 實例2：列出所有端口命令： netstat?-a 輸出： [root@localhost?~]#?netstat?-a Active?Internet?connections?(servers?and?established) Proto?Recv-Q?Send-Q?Local?Address???????????????Foreign?Address?????????????State?????? tcp????????0??????0?localhost:smux??????????????*:*?????????????????????????LISTEN?????? tcp????????0??????0?*:svn???????????????????????*:*?????????????????????????LISTEN?????? tcp????????0??????0?*:ssh???????????????????????*:*?????????????????????????LISTEN?????? tcp????????0????284?192.168.120.204:ssh?????????10.2.0.68:62420?????????????ESTABLISHED? udp????????0??????0?localhost:syslog????????????*:*????????????????????????????????????? udp????????0??????0?*:snmp??????????????????????*:*????????????????????????????????????? Active?UNIX?domain?sockets?(servers?and?established) Proto?RefCnt?Flags???????Type???????State?????????I-Node?Path unix??2??????[?ACC?]?????STREAM?????LISTENING?????708833?/tmp/ssh-yKnDB15725/agent.15725 unix??2??????[?ACC?]?????STREAM?????LISTENING?????7296???/var/run/audispd_events unix??2??????[?]?????????DGRAM????????????????????1491???@/org/kernel/udev/udevd unix??4??????[?]?????????DGRAM????????????????????7337???/dev/log unix??2??????[?]?????????DGRAM????????????????????708823? unix??2??????[?]?????????DGRAM????????????????????7539??? unix??3??????[?]?????????STREAM?????CONNECTED?????7287??? unix??3??????[?]?????????STREAM?????CONNECTED?????7286??? [root@localhost?~]#? 說明：顯示一個所有的有效連接信息列表，包括已建立的連接（ESTABLISHED），也包括監聽連接請（LISTENING）的那些連接。實例3：顯示當前UDP連接狀況命令： netstat?-nu 輸出： [root@andy?~]#?netstat?-nu Active?Internet?connections?(w/o?servers) Proto?Recv-Q?Send-Q?Local?Address???????????????Foreign?Address?????????????State?????? udp????????0??????0?::ffff:192.168.12:53392?????::ffff:192.168.9.120:10000??ESTABLISHED? udp????????0??????0?::ffff:192.168.12:56723?????::ffff:192.168.9.120:10000??ESTABLISHED? udp????????0??????0?::ffff:192.168.12:56480?????::ffff:192.168.9.120:10000??ESTABLISHED? udp????????0??????0?::ffff:192.168.12:58154?????::ffff:192.168.9.120:10000??ESTABLISHED? udp????????0??????0?::ffff:192.168.12:44227?????::ffff:192.168.9.120:10000??ESTABLISHED? udp????????0??????0?::ffff:192.168.12:36954?????::ffff:192.168.9.120:10000??ESTABLISHED? udp????????0??????0?::ffff:192.168.12:53984?????::ffff:192.168.9.120:10000??ESTABLISHED? udp????????0??????0?::ffff:192.168.12:57703?????::ffff:192.168.9.120:10000??ESTABLISHED? udp????????0??????0?::ffff:192.168.12:53613?????::ffff:192.168.9.120:10000??ESTABLISHED? [root@andy?~]#? 說明：實例4：顯示UDP端口號的使用情況命令： netstat?-apu 輸出： [root@andy?~]#?netstat?-apu Active?Internet?connections?(servers?and?established) Proto?Recv-Q?Send-Q?Local?Address???????????????Foreign?Address?????????????State???????PID/Program?name??? udp????????0??????0?*:57604?????????????????????*:*?????????????????????????????????????28094/java?????????? udp????????0??????0?*:40583?????????????????????*:*?????????????????????????????????????21220/java?????????? udp????????0??????0?*:45451?????????????????????*:*?????????????????????????????????????14583/java?????????? udp????????0??????0?::ffff:192.168.12:53392?????::ffff:192.168.9.120:ndmp???ESTABLISHED?19327/java?????????? udp????????0??????0?*:52370?????????????????????*:*?????????????????????????????????????15841/java?????????? udp????????0??????0?::ffff:192.168.12:56723?????::ffff:192.168.9.120:ndmp???ESTABLISHED?15841/java?????????? udp????????0??????0?*:44182?????????????????????*:*?????????????????????????????????????31757/java?????????? udp????????0??????0?*:48155?????????????????????*:*?????????????????????????????????????5476/java??????????? udp????????0??????0?*:59808?????????????????????*:*?????????????????????????????????????17333/java?????????? udp????????0??????0?::ffff:192.168.12:56480?????::ffff:192.168.9.120:ndmp???ESTABLISHED?28094/java?????????? udp????????0??????0?::ffff:192.168.12:58154?????::ffff:192.168.9.120:ndmp???ESTABLISHED?15429/java?????????? udp????????0??????0?*:36780?????????????????????*:*?????????????????????????????????????10091/java?????????? udp????????0??????0?*:36795?????????????????????*:*?????????????????????????????????????24594/java?????????? udp????????0??????0?*:41922?????????????????????*:*?????????????????????????????????????20506/java?????????? udp????????0??????0?::ffff:192.168.12:44227?????::ffff:192.168.9.120:ndmp???ESTABLISHED?17333/java?????????? udp????????0??????0?*:34258?????????????????????*:*?????????????????????????????????????8866/java??????????? udp????????0??????0?*:55508?????????????????????*:*?????????????????????????????????????11667/java?????????? udp????????0??????0?*:36055?????????????????????*:*?????????????????????????????????????12425/java?????????? udp????????0??????0?::ffff:192.168.12:36954?????::ffff:192.168.9.120:ndmp???ESTABLISHED?16532/java?????????? udp????????0??????0?::ffff:192.168.12:53984?????::ffff:192.168.9.120:ndmp???ESTABLISHED?20506/java?????????? udp????????0??????0?::ffff:192.168.12:57703?????::ffff:192.168.9.120:ndmp???ESTABLISHED?31757/java?????????? udp????????0??????0?::ffff:192.168.12:53613?????::ffff:192.168.9.120:ndmp???ESTABLISHED?3199/java??????????? udp????????0??????0?*:56309?????????????????????*:*?????????????????????????????????????15429/java?????????? udp????????0??????0?*:54007?????????????????????*:*?????????????????????????????????????16532/java?????????? udp????????0??????0?*:39544?????????????????????*:*?????????????????????????????????????3199/java??????????? udp????????0??????0?*:43900?????????????????????*:*?????????????????????????????????????19327/java?????????? [root@andy?~]#? 說明：實例5：顯示網卡列表命令： netstat?-i 輸出： [root@andy?~]#?netstat?-i Kernel?Interface?table Iface???????MTU?Met????RX-OK?RX-ERR?RX-DRP?RX-OVR????TX-OK?TX-ERR?TX-DRP?TX-OVR?Flg eth0???????1500???0?151818887??????0??????0??????0?198928403??????0??????0??????0?BMRU lo????????16436???0???107235??????0??????0??????0???107235??????0??????0??????0?LRU [root@andy?~]#? 說明：實例6：顯示組播組的關系命令： netstat?-g 輸出： [root@andy?~]#?netstat?-g IPv6/IPv4?Group?Memberships Interface???????RefCnt?Group ---------------?------?--------------------- lo??????????????1??????all-systems.mcast.net eth0????????????1??????all-systems.mcast.net lo??????????????1??????ff02::1 eth0????????????1??????ff02::1:ffff:9b0c eth0????????????1??????ff02::1 [root@andy?~]#? 說明：實例7：顯示網絡統計信息命令： netstat?-s 輸出： [root@localhost?~]#?netstat?-s Ip: ????530999?total?packets?received ????0?forwarded ????0?incoming?packets?discarded ????530999?incoming?packets?delivered ????8258?requests?sent?out ????1?dropped?because?of?missing?route Icmp: ????90?ICMP?messages?received ????0?input?ICMP?message?failed. ????ICMP?input?histogram: ????????destination?unreachable:?17 ????????echo?requests:?1 ????????echo?replies:?72 ????106?ICMP?messages?sent ????0?ICMP?messages?failed ????ICMP?output?histogram: ????????destination?unreachable:?8 ????????echo?request:?97 ????????echo?replies:?1 IcmpMsg: ????????InType0:?72 ????????InType3:?17 ????????InType8:?1 ????????OutType0:?1 ????????OutType3:?8 ????????OutType8:?97 Tcp: ????8?active?connections?openings ????15?passive?connection?openings ????8?failed?connection?attempts ????3?connection?resets?received ????1?connections?established ????3132?segments?received ????2617?segments?send?out ????53?segments?retransmited ????0?bad?segments?received. ????252?resets?sent Udp: ????0?packets?received ????0?packets?to?unknown?port?received. ????0?packet?receive?errors ????5482?packets?sent TcpExt: ????1?invalid?SYN?cookies?received ????1?TCP?sockets?finished?time?wait?in?fast?timer ????57?delayed?acks?sent ????Quick?ack?mode?was?activated?50?times ????60?packets?directly?queued?to?recvmsg?prequeue. ????68?packets?directly?received?from?backlog ????4399?packets?directly?received?from?prequeue ????520?packets?header?predicted ????51?packets?header?predicted?and?directly?queued?to?user ????1194?acknowledgments?not?containing?data?received ????21?predicted?acknowledgments ????0?TCP?data?loss?events ????1?timeouts?after?reno?fast?retransmit ????9?retransmits?in?slow?start ????42?other?TCP?timeouts ????3?connections?aborted?due?to?timeout IpExt: ????InBcastPkts:?527777 說明：按照各個協議分別顯示其統計數據。如果我們的應用程序（如Web瀏覽器）運行速度比較慢，或者不能顯示Web頁之類的數據，那么我們就可以用本選項來查看一下所顯示的信息。我們需要仔細查看統計數據的各行，找到出錯的關鍵字，進而確定問題所在。實例8：顯示監聽的套接口命令： netstat?-l 輸出： [root@localhost?~]#?netstat?-l Active?Internet?connections?(only?servers) Proto?Recv-Q?Send-Q?Local?Address???????????????Foreign?Address?????????????State?????? tcp????????0??????0?localhost:smux??????????????*:*?????????????????????????LISTEN?????? tcp????????0??????0?*:svn???????????????????????*:*?????????????????????????LISTEN?????? tcp????????0??????0?*:ssh???????????????????????*:*?????????????????????????LISTEN?????? udp????????0??????0?localhost:syslog????????????*:*????????????????????????????????????? udp????????0??????0?*:snmp??????????????????????*:*????????????????????????????????????? Active?UNIX?domain?sockets?(only?servers) Proto?RefCnt?Flags???????Type???????State?????????I-Node?Path unix??2??????[?ACC?]?????STREAM?????LISTENING?????708833?/tmp/ssh-yKnDB15725/agent.15725 unix??2??????[?ACC?]?????STREAM?????LISTENING?????7296???/var/run/audispd_events [root@localhost?~]#? 說明：實例9：顯示所有已建立的有效連接命令： netstat?-n 輸出： [root@localhost?~]#?netstat?-n Active?Internet?connections?(w/o?servers) Proto?Recv-Q?Send-Q?Local?Address???????????????Foreign?Address?????????????State?????? tcp????????0????268?192.168.120.204:22??????????10.2.0.68:62420?????????????ESTABLISHED? Active?UNIX?domain?sockets?(w/o?servers) Proto?RefCnt?Flags???????Type???????State?????????I-Node?Path unix??2??????[?]?????????DGRAM????????????????????1491???@/org/kernel/udev/udevd unix??4??????[?]?????????DGRAM????????????????????7337???/dev/log unix??2??????[?]?????????DGRAM????????????????????708823? unix??2??????[?]?????????DGRAM????????????????????7539??? unix??3??????[?]?????????STREAM?????CONNECTED?????7287??? unix??3??????[?]?????????STREAM?????CONNECTED?????7286??? [root@localhost?~]#? 說明： ? ?實例10：顯示關于以太網的統計數據命令： netstat?-e 輸出： [root@localhost?~]#?netstat?-e Active?Internet?connections?(w/o?servers) Proto?Recv-Q?Send-Q?Local?Address???????????????Foreign?Address?????????????State???????User???????Inode????? tcp????????0????248?192.168.120.204:ssh?????????10.2.0.68:62420?????????????ESTABLISHED?root???????708795????? Active?UNIX?domain?sockets?(w/o?servers) Proto?RefCnt?Flags???????Type???????State?????????I-Node?Path unix??2??????[?]?????????DGRAM????????????????????1491???@/org/kernel/udev/udevd unix??4??????[?]?????????DGRAM????????????????????7337???/dev/log unix??2??????[?]?????????DGRAM????????????????????708823? unix??2??????[?]?????????DGRAM????????????????????7539??? unix??3??????[?]?????????STREAM?????CONNECTED?????7287??? unix??3??????[?]?????????STREAM?????CONNECTED?????7286??? [root@localhost?~]# 說明：用于顯示關于以太網的統計數據。它列出的項目包括傳送的數據報的總字節數、錯誤數、刪除數、數據報的數量和廣播的數量。這些統計數據既有發送的數據報數量，也有接收的數據報數量。這個選項可以用來統計一些基本的網絡流量）實例11：顯示關于路由表的信息命令： netstat?-r 輸出： [root@localhost?~]#?netstat?-r Kernel?IP?routing?table Destination?????Gateway?????????Genmask?????????Flags???MSS?Window??irtt?Iface 192.168.120.0???*???????????????255.255.255.0???U?????????0?0??????????0?eth0 192.168.0.0?????192.168.120.1???255.255.0.0?????UG????????0?0??????????0?eth0 10.0.0.0????????192.168.120.1???255.0.0.0???????UG????????0?0??????????0?eth0 default?????????192.168.120.240?0.0.0.0?????????UG????????0?0??????????0?eth0 [root@localhost?~]#? 說明：實例12：列出所有?tcp?端口命令： netstat?-at 輸出： [root@localhost?~]#?netstat?-at Active?Internet?connections?(servers?and?established) Proto?Recv-Q?Send-Q?Local?Address???????????????Foreign?Address?????????????State?????? tcp????????0??????0?localhost:smux??????????????*:*?????????????????????????LISTEN?????? tcp????????0??????0?*:svn???????????????????????*:*?????????????????????????LISTEN?????? tcp????????0??????0?*:ssh???????????????????????*:*?????????????????????????LISTEN?????? tcp????????0????284?192.168.120.204:ssh?????????10.2.0.68:62420?????????????ESTABLISHED? [root@localhost?~]# 說明：實例13：統計機器中網絡連接各個狀態個數命令： netstat?-a?|?awk?'/^tcp/?{++S[$NF]}?END?{for(a?in?S)?print?a,?S[a]}' 輸出： [root@localhost?~]#?netstat?-a?|?awk?'/^tcp/?{++S[$NF]}?END?{for(a?in?S)?print?a,?S[a]}' ESTABLISHED?1 LISTEN?3 [root@localhost?~]#? 說明：實例14：把狀態全都取出來后使用uniq?-c統計后再進行排序命令： netstat?-nat?|awk?'{print?$6}'|sort|uniq?-c 輸出： [root@andy?~]#?netstat?-nat?|awk?'{print?$6}'|sort|uniq?-c ?????14?CLOSE_WAIT ??????1?established) ????578?ESTABLISHED ??????1?Foreign ?????43?LISTEN ??????5?TIME_WAIT [root@andy?~]#?netstat?-nat?|awk?'{print?$6}'|sort|uniq?-c|sort?-rn ????576?ESTABLISHED ?????43?LISTEN ?????14?CLOSE_WAIT ??????5?TIME_WAIT ??????1?Foreign ??????1?established) [root@andy?~]# 說明：實例15：查看連接某服務端口最多的的IP地址命令： netstat?-nat?|?grep?"192.168.120.20:16067"?|awk?'{print?$5}'|awk?-F:?'{print?$4}'|sort|uniq?-c|sort?-nr|head?-20 輸出： [root@andy?~]#?netstat?-nat?|?grep?"192.168.120.20:16067"?|awk?'{print?$5}'|awk?-F:?'{print?$4}'|sort|uniq?-c|sort?-nr|head?-20 ??????8?10.2.1.68 ??????7?192.168.119.13 ??????6?192.168.119.201 ??????6?192.168.119.20 ??????6?192.168.119.10 ??????4?10.2.1.199 ??????3?10.2.1.207 ??????2?192.168.120.20 ??????2?192.168.120.15 ??????2?192.168.119.197 ??????2?192.168.119.11 ??????2?10.2.1.206 ??????2?10.2.1.203 ??????2?10.2.1.189 ??????2?10.2.1.173 ??????1?192.168.120.18 ??????1?192.168.119.19 ??????1?10.2.2.227 ??????1?10.2.2.138 ??????1?10.2.1.208 [root@andy?~]#? 說明：實例16：找出程序運行的端口命令： netstat?-ap?|?grep?ssh 輸出： [root@andy?~]#?netstat?-ap?|?grep?ssh tcp????????0??????0?*:ssh???????????????????????*:*?????????????????????????LISTEN??????2570/sshd??????????? tcp????????0??????0?::ffff:192.168.120.206:ssh??::ffff:10.2.1.205:54508?????ESTABLISHED?13883/14???????????? tcp????????0??????0?::ffff:192.168.120.206:ssh??::ffff:10.2.0.68:62886??????ESTABLISHED?20900/6????????????? tcp????????0??????0?::ffff:192.168.120.206:ssh??::ffff:10.2.2.131:52730?????ESTABLISHED?20285/sshd:?root@no? unix??2??????[?ACC?]?????STREAM?????LISTENING?????194494461?20900/6?????????????/tmp/ssh-cXIJj20900/agent.20900 unix??3??????[?]?????????STREAM?????CONNECTED?????194307443?20285/sshd:?root@no? unix??3??????[?]?????????STREAM?????CONNECTED?????194307441?20285/sshd:?root@no? [root@andy?~]#? 說明：實例17：在?netstat?輸出中顯示?PID?和進程名稱命令： netstat?-pt 輸出： [root@localhost?~]#?netstat?-pt Active?Internet?connections?(w/o?servers) Proto?Recv-Q?Send-Q?Local?Address???????????????Foreign?Address?????????????State???????PID/Program?name??? tcp????????0????248?192.168.120.204:ssh?????????10.2.0.68:62420?????????????ESTABLISHED?15725/0????????????? [root@localhost?~]#? 說明： netstat?-p?可以與其它開關一起使用，就可以添加?“PID/進程名稱”?到?netstat?輸出中，這樣?debugging?的時候可以很方便的發現特定端口運行的程序。實例18：找出運行在指定端口的進程命令： netstat?-anpt?|?grep?':16064' 輸出： [root@andy?~]#?netstat?-anpt?|?grep?':16064' tcp????????0??????0?:::16064????????????????????:::*????????????????????????LISTEN??????24594/java?????????? tcp????????0??????0?::ffff:192.168.120.20:16064?::ffff:192.168.119.201:6462?ESTABLISHED?24594/java?????????? tcp????????0??????0?::ffff:192.168.120.20:16064?::ffff:192.168.119.20:26341?ESTABLISHED?24594/java?????????? tcp????????0??????0?::ffff:192.168.120.20:16064?::ffff:192.168.119.20:32208?ESTABLISHED?24594/java?????????? tcp????????0??????0?::ffff:192.168.120.20:16064?::ffff:192.168.119.20:32207?ESTABLISHED?24594/java?????????? tcp????????0??????0?::ffff:192.168.120.20:16064?::ffff:10.2.1.68:51303??????ESTABLISHED?24594/java?????????? tcp????????0??????0?::ffff:192.168.120.20:16064?::ffff:10.2.1.68:51302??????ESTABLISHED?24594/java?????????? tcp????????0??????0?::ffff:192.168.120.20:16064?::ffff:10.2.1.68:50020??????ESTABLISHED?24594/java?????????? tcp????????0??????0?::ffff:192.168.120.20:16064?::ffff:10.2.1.68:50019??????ESTABLISHED?24594/java?????????? tcp????????0??????0?::ffff:192.168.120.20:16064?::ffff:10.2.1.68:56155??????ESTABLISHED?24594/java?????????? tcp????????0??????0?::ffff:192.168.120.20:16064?::ffff:10.2.1.68:50681??????ESTABLISHED?24594/java?????????? tcp????????0??????0?::ffff:192.168.120.20:16064?::ffff:10.2.1.68:50680??????ESTABLISHED?24594/java?????????? tcp????????0??????0?::ffff:192.168.120.20:16064?::ffff:10.2.1.68:52136??????ESTABLISHED?24594/java?????????? tcp????????0??????0?::ffff:192.168.120.20:16064?::ffff:10.2.1.68:56989??????ESTABLISHED?24594/java?????????? tcp????????0??????0?::ffff:192.168.120.20:16064?::ffff:10.2.1.68:56988??????ESTABLISHED?24594/java?????????? [root@andy?~]#? 說明：運行在端口16064的進程id為24596，再通過ps命令就可以找到具體的應用程序了。