linux下查看tcp连接的几种方式

[root@localhost /]# netstat -anpt

Active Internet connections (servers and established)

Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name

tcp 0 0 0.0.0.0:44136 0.0.0.0:* LISTEN 2044/rpc.statd

tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1999/rpcbind

tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 2217/sshd

tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 2105/cupsd

tcp 0 0 127.0.0.1:28888 0.0.0.0:* LISTEN 4607/./test

tcp 0 0 172.16.40.101:28888 0.0.0.0:* LISTEN 4589/./test2

tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 2387/master

tcp 0 0 :::111 :::* LISTEN 1999/rpcbind

tcp 0 0 :::41107 :::* LISTEN 2044/rpc.statd

tcp 0 0 :::22 :::* LISTEN 2217/sshd

tcp 0 0 ::1:631 :::* LISTEN 2105/cupsd

tcp 0 0 ::1:25 :::* LISTEN 2387/master

-a 所有连接

-n 直接使用IP地址，而不通过域名服务器，速度快一点

-p 列出所属进程id和name

-t 仅列出tcp协议（包含了ipv4/ipv6（:::111之类））

其他参数：http://www.cnblogs.com/peida/archive/2013/03/08/2949194.html

[root@localhost /]# lsof -n -P -i tcp

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME

rpcbind 1994 rpc 8u IPv4 13249 0t0 TCP *:111 (LISTEN)

rpcbind 1994 rpc 11u IPv6 13254 0t0 TCP *:111 (LISTEN)

rpc.statd 2039 rpcuser 9u IPv4 13501 0t0 TCP *:60858 (LISTEN)

rpc.statd 2039 rpcuser 11u IPv6 13509 0t0 TCP *:43595 (LISTEN)

cupsd 2101 root 6u IPv6 13754 0t0 TCP [::1]:631 (LISTEN)

cupsd 2101 root 7u IPv4 13755 0t0 TCP 127.0.0.1:631 (LISTEN)

sshd 2212 root 3u IPv4 14277 0t0 TCP *:22 (LISTEN)

sshd 2212 root 4u IPv6 14280 0t0 TCP *:22 (LISTEN)

master 2382 root 12u IPv4 14636 0t0 TCP 127.0.0.1:25 (LISTEN)

master 2382 root 13u IPv6 14638 0t0 TCP [::1]:25 (LISTEN)

test 4328 root 3u IPv4 44337 0t0 TCP *:28888 (LISTEN)

test 4328 root 4u IPv4 44338 0t0 TCP 172.16.40.101:28888->172.16.40.100:64290 (ESTABLISHED)

test2 4388 root 3u IPv4 45961 0t0 TCP *:28888 (LISTEN)

test3 4389 root 3u IPv4 45965 0t0 TCP *:28888 (LISTEN)

-n Do not resolve hostnames (no DNS).

-P Do not resolve port names (list port number instead of its name).
这个加入了type列更好区分ipv4/ipv6了

[root@localhost /]# cat /proc/net/tcp

sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode

0: 00000000:006F 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 13249 1 f1624ac0 99 0 0 10 -1

1: 00000000:0016 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 14277 1 f16240c0 99 0 0 10 -1

2: 0100007F:0277 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 13755 1 c14b3a80 99 0 0 10 -1

3: 00000000:70D8 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 45965 1 f0fb6540 99 0 0 10 -1

4: 00000000:70D8 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 45961 1 f0fb6040 99 0 0 10 -1

5: 00000000:70D8 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 44337 1 c14b3080 99 0 0 10 -1

6: 0100007F:0019 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 14636 1 f16245c0 99 0 0 10 -1

7: 00000000:EDBA 00000000:0000 0A 00000000:00000000 00:00000000 00000000 29 0 13501 1 c14b3580 99 0 0 10 -1

8: 652810AC:70D8 642810AC:FB22 01 00000000:00000000 00:00000000 00000000 0 0 44338 1 f0fb6a40 20 3 20 10 -1

这个网络地址和端口需要自己转换，状态也要自己转换，还没有进程信息。不过特点是快。

其中st的值如下：

00 "ERROR_STATUS",

01 "TCP_ESTABLISHED",

02 "TCP_SYN_SENT",

03 "TCP_SYN_RECV",

04 "TCP_FIN_WAIT1",

05 "TCP_FIN_WAIT2",

06 "TCP_TIME_WAIT",

07 "TCP_CLOSE",

08 "TCP_CLOSE_WAIT",

09 "TCP_LAST_ACK",

0A "TCP_LISTEN",

0B "TCP_CLOSING",