Address Type Vnode Conn Local Addr Remote Addr
30000e57b08 stream-ord 300000731a8 00000000 /tmp/.X11-unix/X0
30000e57cb8 stream-ord 00000000 00000000
在如下使用时,列出IPV4和IPV6地址、输入和输出数据包、错误数以及所有网络接口的冲突次数。
bash-2.03# netstat -i
Name Mtu Net/Dest Address Ipkts Ierrs Opkts Oerrs Collis Queue
lo0 8232 loopback localhost 14681 0 14681 0 0 0
hme0 1500 u10 u10 83538 0 85852 0 0 0
3 snoop
用来捕获和显示网络流量。它可能是数据包级解决网络问题最有用的命令。
bash-2.03# snoop
Using device /dev/hme (promiscuous mode)
u10 -> 192.168.0.12 XWIN C port=32899
192.168.0.12 -> u10 XWIN R port=32899
u10 -> 192.168.0.12 XWIN C port=32899
192.168.0.12 -> u10 XWIN R port=32899
u10 -> 192.168.0.12 XWIN C port=32899
192.168.0.12 -> u10 XWIN R port=32899
192.168.0.12 -> u10 XWIN R port=32899
u10 -> 192.168.0.12 XWIN C port=32899
该命令持续显示捕获的数据包,直到按下Ctrl+C中断该进程。该命令的输出显示了源和目的主机的主机名或IP地址,还显示了数据包的类型、应用该数据包的服务和端口号。为了得到每个数据包的详细信息,应如下使用snoop -v
bash-2.03# snoop -v
Using device /dev/hme (promiscuous mode)
ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 6 arrived at 15:35:1.27
ETHER: Packet size = 60 bytes
ETHER: Destination = 8:0:20:a7:91:ce, Sun
ETHER: Source = 0:10:5c:ea:ef:6d,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: Total length = 40 bytes
IP: Identification = 36152
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 128 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = eb7e
IP: Source address = 192.168.0.12, 192.168.0.12