netstat -anp
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 173.24.81.121:22        120.243.184.66:54442    ESTABLISHED 25296/sshd: root@pt
tcp        0      0 173.24.81.121:35008     120.130.30.25:80        ESTABLISHED 29834/AliYunDun
1
2
3
4

可以使用 watch命令实时监控网络状态

watch -n 1 'netstat -anp'			每隔一秒执行netstat命令
1

Recv-Q 网络接收队列

• Established: The count of bytes not copied by the user program connected to this socket. Established 状态在tcp协议下Recv-Q表示当前tcp缓冲区中接收到的数据还没有被应用层取走。
• Listening: Since Kernel 2.6.18 this column contains the current syn backlog.

Send-Q 网络发送队列

• Established: The count of bytes not acknowledged by the remote host. Established 状态在tcp协议下Send-Q表示当前应用层发送到tcp缓冲区中且还没有被对端ack确认收到的数据大小，这些数据暂时还不能删除，因为可能需要重发。如果发送队列Send-Q不能很快的清零，可能是有应用向外发送数据包过快，或者是对方接收数据包不够快。如果接收端断网，发送端不知道且一直在发数据给已经断开的接收端的话，Send-Q 会被塞满，导致发送端阻塞。
• Listening: Since Kernel 2.6.18 this column contains the maximum size of the syn backlog.

State

The state of the socket. Since there are no states in raw mode and usually no states used in UDP and UDPLite, this column may be left blank. Normally this can be one of several val‐
ues:

   ESTABLISHED
          The socket has an established connection.

   SYN_SENT
          The socket is actively attempting to establish a connection.

   SYN_RECV
          A connection request has been received from the network.
   FIN_WAIT1
          The socket is closed, and the connection is shutting down.

   FIN_WAIT2
          Connection is closed, and the socket is waiting for a shutdown from the remote end.

   TIME_WAIT
          The socket is waiting after close to handle packets still in the network.

   CLOSE  The socket is not being used.

   CLOSE_WAIT
          The remote end has shut down, waiting for the socket to close.

   LAST_ACK
          The remote end has shut down, and the socket is closed. Waiting for acknowledgement.
          LISTEN The socket is listening for incoming connections.  Such sockets are not included  in
          the output unless you specify the --listening (-l) or --all (-a) option.

   CLOSING
          Both sockets are shut down but we still don't have all our data sent.

   UNKNOWN
          The state of the socket is unknown.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32