例如服務器上的TCP網絡連接狀態顯示如下：
[root@huzhenwei ~]# netstat -nat
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:10050 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:554 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:1935 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:3001 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:1947 0.0.0.0:* LISTEN
tcp 0 0 172.16.6.93:80 172.16.6.93:51201 ESTABLISHED
tcp 0 0 172.16.6.93:80 172.16.6.93:51202 ESTABLISHED
tcp 0 0 172.16.6.93:10050 172.16.3.112:32769 TIME_WAIT
tcp 0 0 172.16.6.93:51201 172.16.6.93:80 ESTABLISHED
tcp 0 0 172.16.6.93:51202 172.16.6.93:80 ESTABLISHED
tcp 0 1 172.16.6.93:53276 172.16.3.162:8080 SYN_SENT
tcp 0 0 :::22 :::* LISTEN
tcp 0 844 ::ffff:172.16.6.93:22 ::ffff:172.16.1.36:56495 ESTABLISHED
統計命令和計算結果如下：
[root@huzhenwei ~]# netstat -nat | awk 'FNR>2{print $NF}' | sort | uniq -c
5 ESTABLISHED
9 LISTEN
1 TIME_WAIT
參數說明：
netstat -nat 參數t表示只列出tcp連接
awk 'FNR>2{print $NF}'
FNR表示這條記錄的行號，NF表示這一條記錄中的字段總數
TCP連接狀態的定義：
ESTABLISHED
The socket has an established connection.
SYN_SENT
The socket is actively attempting to establish a connection.
SYN_RECV
A connection request has been received from the network.
FIN_WAIT1
The socket is closed, and the connection is shutting down.
FIN_WAIT2
Connection is closed, and the socket is waiting for a shutdown from the remote end.
TIME_WAIT
The socket is waiting after close to handle packets still in the network.
CLOSED The socket is not being used.
CLOSE_WAIT
The remote end has shut down, waiting for the socket to close.
LAST_ACK
The remote end has shut down, and the socket is closed. Waiting for acknowledgement.
LISTEN The socket is listening for incoming connections. Such sockets are not included in the output
unless you specify the --listening (-l) or --all (-a) option.
CLOSING
Both sockets are shut down but we still don’t have all our data sent.
UNKNOWN
The state of the socket is unknown.