El comando netstat junto con algunos pipe pueden ser utilizados para obtener información sobre las conexiones IP de nuestro equipo. Mostrando las ESTABLECIDAS, CERRADAS, SYN, FIN... También se pueden mostrar datos sobre cada protocolo usando netstat.
A través de este método veremos una lista de los distintos estados de la conexiones
# netstat -nat | awk '{print $6}' | sort | uniq -c | sort -n
1 CLOSE_WAIT
1 established)
1 Foreign
3 FIN_WAIT1
3 LAST_ACK
13 ESTABLISHED
17 LISTEN
154 FIN_WAIT2
327 TIME_WAIT
Obteniendo mas información sobre una Dirección IP especifica
# netstat -nat |grep {Dirección-IP} | awk '{print $6}' | sort | uniq -c | sort -n
2 LAST_ACK
2 LISTEN
4 FIN_WAIT1
14 ESTABLISHED
91 TIME_WAIT
130 FIN_WAIT2
Obtener un listado único de las direcciones IP
# netstat -nat | awk '{ print $5}' | cut -d: -f1 | sed -e '/^$/d' | uniq
Para conocer el número de direcciones Ip que estan conectadas a nuestro equipo
# netstat -nat | awk '{ print $5}' | cut -d: -f1 | sed -e '/^$/d' | uniq | wc -l
449
¿Estamos bajo un ataque de denegación de servicio?
# netstat -atun | awk '{print $5}' | cut -d: -f1 | sed -e '/^$/d' |sort | uniq -c | sort -n
1 10.0.77.52
2 10.1.11.3
4 12.109.42.21
6 12.191.136.3
13 202.155.209.202
18 208.67.222.222
28 0.0.0.0
233 127.0.0.1
Así podremos bloquear aquellas IP's desde las que recibimos los ataques utilizando iptables o anular esas rutas.
Mostrar un listado de las Conexiones TCP
También podemos usar el comando tcptrack para mostrar el estado de las conexiones TCP de una interfaz de red determinada. Tcptrack monitorea su estado y muestra la información del origen/destino, ancho de banda utilizado, actualizandose de forma parecida al comando top.
Podemos mostrar un resumen de las estadisticas de cada protocolo usando las siguientes opciones
# netstat -s | less
# netstat -t -s | less
# netstat -u -s | less
# netstat -w -s | less
# netstat -s
Ip:
88354557 total packets received
0 forwarded
0 incoming packets discarded
88104061 incoming packets delivered
96037391 requests sent out
13 outgoing packets dropped
66 fragments dropped after timeout
295 reassemblies required
106 packets reassembled ok
66 packet reassembles failed
34 fragments failed
Icmp:
18108 ICMP messages received
58 input ICMP message failed.
ICMP input histogram:
destination unreachable: 7173
timeout in transit: 472
redirects: 353
echo requests: 10096
28977 ICMP messages sent
0 ICMP messages failed
ICMP output histogram:
destination unreachable: 18881
echo replies: 10096
Tcp:
1202226 active connections openings
2706802 passive connection openings
7394 failed connection attempts
47018 connection resets received
23 connections established
87975383 segments received
95235730 segments send out
681174 segments retransmited
2044 bad segments received.
80805 resets sent
Udp:
92689 packets received
14611 packets to unknown port received.
0 packet receive errors
96755 packets sent
TcpExt:
48452 invalid SYN cookies received
7357 resets received for embryonic SYN_RECV sockets
43 ICMP packets dropped because they were out-of-window
5 ICMP packets dropped because socket was locked
2672073 TCP sockets finished time wait in fast timer
441 time wait sockets recycled by time stamp
368562 delayed acks sent
430 delayed acks further delayed because of locked socket
Quick ack mode was activated 36127 times
32318597 packets directly queued to recvmsg prequeue.
741479256 packets directly received from backlog
1502338990 packets directly received from prequeue
18343750 packets header predicted
10220683 packets header predicted and directly queued to user
17516622 acknowledgments not containing data received
36549771 predicted acknowledgments
102672 times recovered from packet loss due to fast retransmit
Detected reordering 1596 times using reno fast retransmit
Detected reordering 1 times using time stamp
8 congestion windows fully recovered
32 congestion windows partially recovered using Hoe heuristic
19 congestion windows recovered after partial ack
0 TCP data loss events
39951 timeouts after reno fast retransmit
29653 timeouts in loss state
197005 fast retransmits
186937 retransmits in slow start
131433 other TCP timeouts
TCPRenoRecoveryFail: 20217
147 times receiver scheduled too late for direct processing
29010 connections reset due to unexpected data
365 connections reset due to early user close
6979 connections aborted due to timeout
Podemos mostrar los paquetes desacartados y transmitidos por eth0 con netstat
# netstat --interfaces eth0
Kernel Interface table
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0 1500 0 2040929 0 0 0 3850539 0 0 0 BMRU
Netstat nos facilita una gran cantidad de datos obre nuestras conexiones ayudándonos a controlarlas, restringirlas y conocer a quien estamos conectándonos.
