Blog

Listening on 0.0.0.0 means that the program is listening on all IPv4 addresses assigned to the machine, whereas 127.0.0.1 is the loopback address, only accessible from the same machine.

sudo netstat -t4pacln <===> nejcastejsi pouziti
sudo netstat -t4pan <===> ukazuje otevřený porty a procesy, který na nich naslouchají (pouze TCP) se sudo jsou videt i procesy
netstat -talpc <===> ukazuje otevřený porty a procesy, který na nich naslouchají bez prevodu na cisla - primo vidime weby
netstat -tupln4 <===> ukazuje otevřený porty a procesy, který na nich naslouchají (pouze IPv4.)
netstat -tupanc <===> ukazuje otevřený porty a procesy, který na nich naslouchají + vypisuje kazdou vterinu novy udaje
netstat -an | less <===> vsechny spojení (muzu se i vracet v historii)
sudo netstat -tulpn | grep 6566 | grep NASLOUCHÁ <===> zjisti co posloucha na portu 6566
netstat -pln | grep 22 | awk '{print $NF}' <===>  see which process is listening on port 22
netstat -vutlnp --listening -4 <===>  list of IPv4 listening port list.
netstat -tecn | awk '!/:443/' <===> soupis spojeni TCP ale bez portu 443

netstat -s <===> ukaze statistiky netstatu / Display summary statistics for each protocol / netstat --statistics
netstat -c <===> vypisuje kazdou vterinu novy udaje / This will cause netstat to print the selected information every second continuously. / netstat --continuous listing
netstat -l <===> Show only listening sockets. (These are omitted by default.) // -listening
netstat -b <===> vypisuje i nazev programu (asi pouze pod WINDOWS)
netstat -t, -tcp <===> 
netstat -u, -udp <===> 
netstat -r, –route  <===> view kernel routing table.
netstat -i, –interfaces <===> display interface table
netstat -g, –groups <===> display multicast group memberships
netstat -s, –statistics <===> display networking statistics (like SNMP)
netstat -M, –masquerade <===> display masqueraded connections
netstat -v, –verbose <===> be verbose
netstat -W, –wide <===> don’t truncate IP addresses
netstat -N, –symbolic <===> resolve hardware names
netstat -e, –extend <===> display other/more information
netstat -p, –programs <===> show the PID and name of the program to which each socket belongs
netstat -o, –timers <===> display timers
netstat -a, –all <===> display all sockets (default: connected)
netstat -F, –fib <===> display Forwarding Information Base (default)
netstat -C, –cache <===> display routing cache instead of FIB
netstat -Z, –context <===> display SELinux security context for sockets
netstat -n, –numeric <===> don’t resolve names
netstat –numeric-hosts <===> don’t resolve host names
netstat –numeric-ports <===> don’t resolve port names
netstat –numeric-users <===> don’t resolve user names

0.0.0.0 <===> znamená vas pc posloucha na vsech ip adresach

ESTABLISHED <===> The socket has an established connection.
SYN_SENT <===> The socket is actively attempting to establish a connection.
SYN_RECV <===> A connection request has been received from the network.
FIN_WAIT1 <===> The socket is closed, and the connection is shutting down.
FIN_WAIT2 <===> Connection is closed, and the socket is waiting for a shutdown from the remote end.
TIME_WAIT <===> The socket is waiting after close to handle packets still in the network.
CLOSE <===> The socket is not being used.
CLOSE_WAIT <===> The remote end has shut down, waiting for the socket to close.
LAST_ACK <===> The remote end has shut down, and the socket is closed. Waiting for acknowledgement.
LISTEN <===> The socket is listening for incoming connections. Such sockets are not included in the output unless you specify the --listening (-l) or --all (-a) option.
CLOSING <===> Both sockets are shut down but we still don't have all our data sent.
UNKNOWN <===> The state of the socket is unknown.

TCP - Transmission Control Protocol

A connection progresses through a series of states during its lifetime. The states are: LISTEN, SYN-SENT, SYN-RECEIVED, ESTABLISHED, FIN-WAIT-1, FIN-WAIT-2, CLOSE-WAIT, CLOSING, LAST-ACK, TIME-WAIT, and the fictional state CLOSED. CLOSED is fictional
because it represents the state when there is no TCB, and therefore, no connection. Briefly the meanings of the states are:

LISTEN - represents waiting for a connection request from any remote TCP and port.
SYN-SENT - represents waiting for a matching connection request after having sent a connection request.
SYN-RECEIVED - represents waiting for a confirming connection request acknowledgment after having both received and sent a connection request.
ESTABLISHED - represents an open connection, data received can be delivered to the user. The normal state for the data transfer phase of the connection.
FIN-WAIT-1 - represents waiting for a connection termination request from the remote TCP, or an acknowledgment of the connection termination request previously sent.
FIN-WAIT-2 - represents waiting for a connection termination request from the remote TCP.
CLOSE-WAIT - represents waiting for a connection termination request from the local user.
CLOSING - represents waiting for a connection termination request acknowledgment from the remote TCP.
LAST-ACK - represents waiting for an acknowledgment of the connection termination request previously sent to the remote TCP (which includes an acknowledgment of its connection termination request).
TIME-WAIT - represents waiting for enough time to pass to be sure the remote TCP received the acknowledgment of its connection termination request.
CLOSED - represents no connection state at all.

A TCP connection progresses from one state to another in response to events. The events are the user calls, OPEN, SEND, RECEIVE, CLOSE, ABORT, and STATUS; the incoming segments, particularly those containing the SYN, ACK, RST and FIN flags; and timeouts.