From cyberciti.biz
\nThe netstat command and pipe feature can be used to dig out information about a particular IP address connection. You can find out total established connections, closing connection, SYN and FIN bits and much more. You can also display summary statistics for each protocol using netstat.<\/p>\n
This is useful to find out if your server is under attack or not. You can also list abusive IP address using this method. 2 LAST_ACK 15 CLOSE_WAIT To print list of all unique IP address connected to server, enter: 449 Find Out If Box is Under DoS Attack or Not<\/p>\n If you think your Linux box is under attack, print out a list of open connections on your box and sorts them by according to IP address, enter: 1 10.0.77.52 You can simply block all abusive IPs using iptables or just null route them.<\/p>\n Get Live View of TCP Connections<\/p>\n You can use tcptrack command to display the status of TCP connections that it sees on a given network interface. tcptrack monitors their state and displays information such as state, source\/destination addresses and bandwidth usage in a sorted, updated list very much like the top command. Simply use netstat -s: Ip: Display Interface Table<\/p>\n You can easily display dropped and total transmitted packets with netstat for eth0: Kernel Interface table From cyberciti.biz The netstat command and pipe feature can be used to dig out information about a particular IP address connection. You can find out total established connections, closing connection, SYN and FIN bits and much more. You can also display summary statistics for each protocol using netstat. This is useful to find out if… <\/p>\n
\n
\n# netstat -nat | awk '{print $6}' | sort | uniq -c | sort -n
\n<\/code>
\nOutput:
\n
\n 1 CLOSE_WAIT
\n 1 established)
\n 1 Foreign
\n 3 FIN_WAIT1
\n 3 LAST_ACK
\n 13 ESTABLISHED
\n 17 LISTEN
\n 154 FIN_WAIT2
\n 327 TIME_WAIT
\n<\/code>
\nDig out more information about a specific ip address:
\nnetstat -nat |grep {IP-address} | awk '{print $6}' | sort | uniq -c | sort -n<\/p>\n
\n 2 LISTEN
\n 4 FIN_WAIT1
\n 14 ESTABLISHED
\n 91 TIME_WAIT
\n 130 FIN_WAIT2
\n<\/code>
\nBusy server can give out more information:
\nnetstat -nat |grep 202.54.1.10 | awk '{print $6}' | sort | uniq -c | sort -n
\nOutput:<\/p>\n
\n 37 LAST_ACK
\n 64 FIN_WAIT_1
\n 65 FIN_WAIT_2
\n1251 TIME_WAIT
\n3597 SYN_SENT
\n5124 ESTABLISHED
\n<\/code>
\nGet List Of All Unique IP Address<\/p>\n
\nnetstat -nat | awk '{ print $5}' | cut -d: -f1 | sed -e '\/^$\/d' | uniq<\/code>
\nTo print total of all unique IP address, enter:
\nnetstat -nat | awk '{ print $5}' | cut -d: -f1 | sed -e '\/^$\/d' | uniq | wc -l
\nOutput:<\/p>\n
\n<\/code><\/p>\n
\n
\nnetstat -atun | awk '{print $5}' | cut -d: -f1 | sed -e '\/^$\/d' |sort | uniq -c | sort -n
\nOutput:<\/p>\n
\n 2 10.1.11.3
\n 4 12.109.42.21
\n 6 12.191.136.3
\n.....
\n...
\n....
\n 13 202.155.209.202
\n 18 208.67.222.222
\n 28 0.0.0.0
\n 233 127.0.0.1
\n<\/code><\/p>\n
\nDisplay Summary Statistics for Each Protocol<\/p>\n
\n
\nnetstat -s | less
\nnetstat -t -s | less
\nnetstat -u -s | less
\nnetstat -w -s | less
\nnetstat -s
\nOutput:<\/p>\n
\n 88354557 total packets received
\n 0 forwarded
\n 0 incoming packets discarded
\n 88104061 incoming packets delivered
\n 96037391 requests sent out
\n 13 outgoing packets dropped
\n 66 fragments dropped after timeout
\n 295 reassemblies required
\n 106 packets reassembled ok
\n 66 packet reassembles failed
\n 34 fragments failed
\nIcmp:
\n 18108 ICMP messages received
\n 58 input ICMP message failed.
\n ICMP input histogram:
\n destination unreachable: 7173
\n timeout in transit: 472
\n redirects: 353
\n echo requests: 10096
\n 28977 ICMP messages sent
\n 0 ICMP messages failed
\n ICMP output histogram:
\n destination unreachable: 18881
\n echo replies: 10096
\nTcp:
\n 1202226 active connections openings
\n 2706802 passive connection openings
\n 7394 failed connection attempts
\n 47018 connection resets received
\n 23 connections established
\n 87975383 segments received
\n 95235730 segments send out
\n 681174 segments retransmited
\n 2044 bad segments received.
\n 80805 resets sent
\nUdp:
\n 92689 packets received
\n 14611 packets to unknown port received.
\n 0 packet receive errors
\n 96755 packets sent
\nTcpExt:
\n 48452 invalid SYN cookies received
\n 7357 resets received for embryonic SYN_RECV sockets
\n 43 ICMP packets dropped because they were out-of-window
\n 5 ICMP packets dropped because socket was locked
\n 2672073 TCP sockets finished time wait in fast timer
\n 441 time wait sockets recycled by time stamp
\n 368562 delayed acks sent
\n 430 delayed acks further delayed because of locked socket
\n Quick ack mode was activated 36127 times
\n 32318597 packets directly queued to recvmsg prequeue.
\n 741479256 packets directly received from backlog
\n 1502338990 packets directly received from prequeue
\n 18343750 packets header predicted
\n 10220683 packets header predicted and directly queued to user
\n 17516622 acknowledgments not containing data received
\n 36549771 predicted acknowledgments
\n 102672 times recovered from packet loss due to fast retransmit
\n Detected reordering 1596 times using reno fast retransmit
\n Detected reordering 1 times using time stamp
\n 8 congestion windows fully recovered
\n 32 congestion windows partially recovered using Hoe heuristic
\n 19 congestion windows recovered after partial ack
\n 0 TCP data loss events
\n 39951 timeouts after reno fast retransmit
\n 29653 timeouts in loss state
\n 197005 fast retransmits
\n 186937 retransmits in slow start
\n 131433 other TCP timeouts
\n TCPRenoRecoveryFail: 20217
\n 147 times receiver scheduled too late for direct processing
\n 29010 connections reset due to unexpected data
\n 365 connections reset due to early user close
\n 6979 connections aborted due to timeout
\n<\/code><\/p>\n
\nnetstat --interfaces eth0
\nOutput:<\/p>\n
\nIface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
\neth0 1500 0 2040929 0 0 0 3850539 0 0 0 BMRU
\n<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"