Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>I'm looking at the output of my <code>netstat</code> command, and see this:</p> <pre><code>tcp4 0 0 10.0.1.10.56941 64.34.119.101.80 ESTABLISHED tcp4 0 0 10.0.1.10.56936 64.34.119.101.80 ESTABLISHED tcp4 0 0 10.0.1.10.56932 64.34.119.101.80 ESTABLISHED tcp4 0 0 10.0.1.10.56929 64.34.119.101.80 ESTABLISHED tcp4 0 0 10.0.1.10.56922 64.34.119.101.80 ESTABLISHED tcp4 0 0 10.0.1.10.56914 64.34.119.101.80 ESTABLISHED tcp4 0 0 *.* *.* CLOSED tcp46 0 0 *.80 *.* LISTEN tcp4 0 0 127.0.0.1.49153 *.* LISTEN tcp4 0 0 127.0.0.1.49152 *.* LISTEN tcp4 0 0 *.631 *.* LISTEN tcp6 0 0 *.631 *.* LISTEN </code></pre> <p>I take it that the port is the last number in the five part dotted output. That means that</p> <pre><code>grep "\.80 " </code></pre> <p>will pick up only port 80. The <code>\.</code> says to pick up the period. (Normally the period means <em>any character</em> in regular expressions). And, by putting a space after the <code>80</code>, you'll guarantee that you're not going to pick up port 8080. In fact, you're guaranteed that you're not going to pick up IP addresses that have <code>.80</code> in them.</p> <p>In fact, I'd recommend to use <code>awk</code> instead of <code>grep</code>. With <code>awk</code>, you can specify fields and do a bit more processing:</p> <pre><code>$ netstat -ant | awk '$6 == "LISTEN" &amp;&amp; $4 ~ /\.80$/' | wc -l </code></pre> <p>With <code>awk</code> each column automatically becomes a separate field. Field #6 ($6 in awk) is the one that says <code>ESTABLISHED</code>, <code>CLOSED</code>, <code>LISTEN</code> in it. Field <code>$4</code> is the first column IP address one.</p> <p>In the above, I'm looking for lines that have the word <em>LISTEN</em> in the sixth field, and where field #4 matches the regular expression <code>\.80$</code>. The <code>$</code> is an anchor to the end of the string, and the <code>\.</code> is picking up a decimal point and not representing any character. The <code>awk</code> command automatically prints out each line that matches, so I don't have to specify that.</p> <p>Awk is really a programming language. It assumes a read loop for each line in the file. You can have a <code>BEGIN</code> clause that gets executed before the file is read and an <code>END</code> clause that executes after the file has been read. The various fields are numbered and represented with a dollar sign. The special <code>$0</code> variable represents the whole line. Special variables like like NF gives you the number of fields in a line and NR gives you the number of lines read in. You also have a whole slew of functions to help parse text, etc. Here's a full blown version of the <code>awk</code> script that basically lays out everything for you, and does its own line counting, so you don't have to pipe to <code>wc -l</code>.:</p> <pre><code>$ netstat -ant | awk ' BEGIN {total = 0} END {print "There are " total " lines I found"} { if ($6 == "LISTEN" &amp;&amp; $4 ~ /\.80$/) { total = total + 1 } }' </code></pre> <hr> <h1>Appendage</h1> <p>OP gets the following output:</p> <pre><code>tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN </code></pre> <p>In this case, try either:</p> <pre><code>$ netstat -ant | awk '$6 == "LISTEN" &amp;&amp; $4 ~ /:80$/' | wc -l </code></pre> <p>Where the <code>\.</code> is replaced by a <code>:</code> or...</p> <pre><code>$ netstat -ant | awk '$6 == "LISTEN" &amp;&amp; $4 ~ /[\.:]80$/' | wc -l </code></pre> <p>Which uses <code>[\.:]</code> which will get it whether it's a colon or a period. Heck, might as well go all the way...</p> <pre><code>$ netstat -ant | awk '$6 == "LISTEN" &amp;&amp; $4 ~ /[^0-9]80$/' | wc -l </code></pre> <p>The <code>[^0-9]</code> means not a numeric character. You can't go wrong with that. This way, whether it's a period, a colon, a semi-colon, a comma, or whatever separator your version of <code>netstat</code> uses, it will work.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload