Saturday, July 2, 2011

Top Ten Cisco IOS Commands - 6) "netstat"

These are your Cisco "netstat" commands. Basic protocol, IP, and port info can be seen with this IOS command on your switch...

Switch1# sh ip sockets
Proto    Remote      Port      Local            Port     In    Out    Stat    TTY    OutputIF
 17   --listen--                10.65.128.14    10000     0        0       11         0
 17   --listen--                10.65.128.14      1975     0        0       11         0
 17 0.0.0.0                  0 10.65.128.14      2228     0        0     211         0
 17 0.0.0.0                  0 10.65.128.14          67     0        0   2211         0
 17 10.60.18.66    2603 10.65.128.14        161     0        0   1001         0
 17   --listen--                10.65.128.14        162     0        0   1011         0
 17   --listen--                10.65.128.14    60839     0        0   1011         0
 17   --listen--          --any--                        161     0        0 20001         0
 17   --listen--          --any--                        162     0        0 20011         0
 17   --listen--          --any--                    65150     0        0 20001         0
 17   --listen--                10.65.128.14        123     0        0         1         0
 17 10.40.9.64        162 10.65.128.14    49391     0        0         0         0

Here is the Cisco router equivalent...

R1# sh tcp brief
TCB                   Local Address                       Foreign Address                     (state)
48C0AD3C     80.64.160.1.20969                   sql.domain.local.445              TIMEWAIT
48BF3818       80.64.160.1.31238                   domain.web.local.1433          TIMEWAIT
4AD39ED8     60.136.65.230.42744               60.136.65.19.179                   ESTAB
4AB25F74      25-149-211-185-TX.39937      82.22.144.71.443                 TIMEWAIT
4908FBA0      80.64.169.1.2000                     80.11.169.86.444                    ESTAB
4896967C       25-149-211-185-TX.58906      79.202.72.7.443                     TIMEWAIT
4A7B74F4      25-149-211-185-TX.32817       www.hosting.domain.443     TIMEWAIT
4A4298F0      80.64.169.1.2000                      80.64.169.137.32726             ESTAB
48C0C658      60.136.65.230.33956                43.220.116.71.443                 TIMEWAIT
4AC486D0     80.64.169.1.2000                      80.64.169.132.20257             ESTAB
4A7CA068     80.64.169.1.2000                      80.64.169.16.16777               ESTAB
4A29B594      60.136.65.29.32424                  domain.web.local.1120         TIMEWAIT
497F0088       80.64.160.1.23                          80.60.18.66.2552                   ESTAB

And lastly, the firewall equivalent...

ASA1#sh conn all
683 in use, 5678 most used
TCP OUTSIDE 82.66.52.251:1334 DMZ 93.39.11.88:443, idle 0:00:02, bytes 5797, flags UIOB
TCP OUTSIDE 40.62.183.137:7686 DMZ 93.39.11.88:443, idle 0:00:04, bytes 6596, flags UIOB
TCP OUTSIDE 64.58.31.86:65248 DMZ 93.39.11.88:443, idle 0:00:06, bytes 6951, flags UIOB
TCP OUTSIDE 70.248.216.190:60370 DMZ 93.39.11.88:443, idle 0:00:08, bytes 4121, flags UIOB
TCP OUTSIDE 62.25.17.1:2220 DMZ 93.39.11.66:443, idle 0:00:08, bytes 22512, flags UIOB
TCP OUTSIDE 64.126.13.254:27426 DMZ 93.39.11.88:443, idle 0:00:14, bytes 36091, flags UIOB
TCP OUTSIDE 66.124.99.125:1318 DMZ 93.39.11.88:443, idle 0:00:24, bytes 3944, flagsUIOB
TCP OUTSIDE 70.157.5.177:50653 DMZ 93.39.11.88:443, idle 0:00:34, bytes 10785, flags UIOB
TCP OUTSIDE 99.189.255.7:60222 DMZ 93.39.11.88:443, idle 0:00:03, bytes 26135, flags UIOB
TCP OUTSIDE 99.189.255.7:60221 DMZ 93.39.11.88:443, idle 0:00:29, bytes 103690, flags UIOB
TCP OUTSIDE 99.189.255.7:60219 DMZ 93.39.11.88:443, idle 0:00:05, bytes 86075, flags UIOB
TCP OUTSIDE 173.22.186.97:51866 DMZ 93.39.11.88:443, idle 0:00:04, bytes 6565, flags UIOB
TCP OUTSIDE 173.22.186.97:51865 DMZ 93.39.11.88:443, idle 0:00:03, bytes 72144, flags UIOB

If you are looking for a specific IP address within any of the above commands, filter the results by adding 'pipe' and 'include' to the end of the command...

sh conn | i <ip address>
sh tcp brief | i <ip address>
sh ip sockets | i <ip address>

No comments:

Post a Comment