kevin9999

恩....
還不錯的教學!
推~~~~

jack1984yw

一.netstat 指令簡介
netstat 這個指令後面可以加上以下參數
1.-a :顯示所有連線狀況
2.-e :顯示Ethernet 卡的統計表,可以和參數-s一起使用
3.-n :顯示位址與port號碼
4.-s :顯示每一個通訊協定的統計表
5.-p protocol :顯示指定的通訊協定的連接統計圖

**通訊協定**
通訊協定用-p protocol來表示可以是 tcp 或 udp
用-s 來表示則可以是 tcp.udp.icmp.ip

二.netstat 顯示圖表各欄代表意義
1.Foreign Address :已經有stock(端口)連接的遠端電腦,他的IP位址與PORT號碼
2.Local Address :目前正在連接使用的本地電腦,他的IP位址與PORT號碼
3.Proto :目前連接所使用的通訊協定

三.實作練習(以下所稱畫面的內容均以簡化修改過)
----------------------------------------------
**使用 netstat 各項語法前必須注意以下幾點
(1)請先切換至 ms-dos 模式
(2)所有參數必須和 netstat 之間空一格
(3)請使用小寫英文字
----------------------------------------------

1.輸入netstat -a 會出現以下畫面
Active Connections

Proto Local Address Foreign Address State
TCP Chen:2605 Chen:0 LISTENING
TCP Chen:2613 Chen:0 LISTENING
TCP Chen:2614 Chen:0 LISTENING
TCP Chen:2213 Chen:0 LISTENING
TCP Chen:1026 Chen:0 LISTENING
TCP Chen:2595 chat.pchome.com.tw:80 TIME_WAIT
TCP Chen:2605 chat.pchome.com.tw:80 ESTABLISHED
TCP Chen:2613 chat.pchome.com.tw:80 ESTABLISHED
TCP Chen:2614 chat.pchome.com.tw:80 ESTABLISHED
TCP Chen:137 Chen:0 LISTENING
TCP Chen:138 Chen:0 LISTENING
TCP Chen:nbsession Chen:0 LISTENING
TCP Chen:2213 ip105.c177.blk1.bel.nwlink.com:80 CLOSE_WAIT
UDP Chen:1026 *:*
UDP Chen:nbname *:*
UDP Chen:nbdatagram *:*


參考第二點就應該知道各欄是代表什麼意思
Chen:2213-->Chen 你的電腦所使用的名稱
2213 你的電腦目前所開的port
chat.pchome.com.tw:80-->chat.pchome.com.tw 你所連結到的主機位址
80 你所連結到主機的port

2.輸入netstat -e 會出現以下畫面
Interface Statistics
Received Sent

Bytes 7243998 3193181
Unicast packets 19279 22069
Non-unicast packets 37 37
Discards 0 0
Errors 0 0
Unknown protocols 186

大家查查英文字就應該知道是什麼意思了吧

3.輸入netstat -n 會出現以下畫面
Active Connections

Proto Local Address Foreign Address State
TCP 211.75.8.176:2595 139.175.68.47:80 TIME_WAIT
TCP 211.75.8.176:2598 210.244.29.52:80 TIME_WAIT
TCP 211.75.8.176:2633 139.175.68.47:80 ESTABLISHED
TCP 211.75.8.176:2637 139.175.68.47:80 ESTABLISHED
TCP 211.75.8.176:2645 139.175.68.47:80 ESTABLISHED
TCP 211.75.8.176:2646 139.175.68.47:80 ESTABLISHED
TCP 211.75.8.176:2647 139.175.68.47:80 ESTABLISHED
TCP 211.75.8.176:2648 139.175.68.47:80 ESTABLISHED
TCP 211.75.8.176:2649 139.175.68.47:80 ESTABLISHED
TCP 211.75.8.176:2213 209.20.177.105:80 CLOSE_WAIT


參考第二點就應該知道各欄是代表什麼意思
211.75.8.176:2633-->211.75.8.176 你的電腦目前使用的IP 位址
2633 你的電腦所開的port
139.175.68.47:80-->139.175.68.47 你所連結到的主機的IP位址
80 你所連結到主機的port
4.輸入netstat -s 會出現以下畫面

IP Statistics

Packets Received = 19842
Received Header Errors = 0
Received Address Errors = 3
Datagrams Forwarded = 0
Unknown Protocols Received = 0
Received Packets Discarded = 0
Received Packets Delivered = 19842
Output Requests = 22772
Routing Discards = 0
Discarded Output Packets = 0
Output Packet No Route = 0
Reassembly Required = 0
Reassembly Successful = 0
Reassembly Failures = 0
Datagrams Successfully Fragmented = 0
Datagrams Failing Fragmentation = 0
Fragments Created = 0

ICMP Statistics

Received Sent
Messages 3 3
Errors 0 0
Destination Unreachable 0 0
Time Exceeded 0 0
Parameter Problems 0 0
Source Quenchs 0 0
Redirects 0 0
Echos 0 0
Echo Replies 0 0
Timestamps 0 0
Timestamp Replies 0 0
Address Masks 0 0
Address Mask Replies 0 0

TCP Statistics

Active Opens = 1503
Passive Opens = 0
Failed Connection Attempts = 3
Reset Connections = 642
Current Connections = 6
Segments Received = 13609
Segments Sent = 16392
Segments Retransmitted = 73

UDP Statistics

Datagrams Received = 6030
No Ports = 3
Receive Errors = 0
Datagrams Sent = 6037

這裡不多做解釋,
大家只要把英文字查出來就知道意思了

5.輸入netstat -p 會出現以下畫面

C:\WINDOWS>netstat -p tcp ---->這裡必須注意,我在-p之後加上tcp
是要求他列出使用tcp這項通訊協定的狀態
也可將tcp改成udp
Active Connections

Proto Local Address Foreign Address State
TCP Chen:2213 ip105.c177.blk1.bel.nwlink.com:80 CLOSE_WAIT
TCP Chen:2784 chat.pchome.com.tw:80 ESTABLISHED
TCP Chen:2792 chat.pchome.com.tw:80 ESTABLISHED
TCP Chen:2797 chat.pchome.com.tw:80 ESTABLISHED
TCP Chen:2798 chat.pchome.com.tw:80 ESTABLISHED
TCP Chen:2799 chat.pchome.com.tw:80 ESTABLISHED