linux - Netstat TCP 状态数据记录脚本

Question

我有一个执行 netstat -an 调用的脚本来显示两个端口(8080 和 5555)的 TCP 状态。我让它每分钟将其打印到日志文件中的一行中。这一切都很好，但由于流量的性质，状态值经常变化。我需要获取这些状态的计数，并能够将它们插入 Excel 并为每个状态绘制图表。我需要静态数据，这意味着我还需要未显示的状态(等于 0 的计数)。与排序| uniq -c 显然它只会得到积极的结果。我的问题是如何填写未显示的状态的空白，以便获得完整的数据？

这是我的脚本(它在一个 while 循环中运行到下午 2 点):

#!/bin/bash
TS=$(date '+%Y-%m-%d %H:%M:%S')
LOG=_$(hostname)_TCP.log
LOGTS=$(date '+%Y%m%d')
HR=$(date '+%H')

while [ "$HR" != "14" ]; do
TS=$(date '+%Y-%m-%d %H:%M:%S')
        echo "$(echo $TS) $(printf "Port 8080 ")( $(netstat -an | grep 8080 | awk '{print $6}' | sort -k1 | uniq -c | awk '{print $2" " $1 ","}' |  xargs)) $(printf "Port 5555 ")( $(netstat -an | grep 5555 | awk '{print $6}' | sort -k1 | uniq -c | awk '{print $2" " $1 ","}' |  xargs)) " | tee -a $LOGTS$LOG
#       sleep 3600
        sleep 60
        HR=$(date '+%H')
done

echo "Past 14:00 so script is finished"

这是我当前的结果:

2015-08-13 09:55:27 Port 8080 ( ESTABLISHED 7, FIN_WAIT2 1, LISTEN 1,) Port 5555 ( CLOSE_WAIT 1, ESTABLISHED 2,)
2015-08-13 09:56:27 Port 8080 ( ESTABLISHED 1, LISTEN 1,) Port 5555 ( CLOSE_WAIT 1, ESTABLISHED 1,)

正如你所看到的，我可以很好地得到计数。但如果我将其导入 Excel 中，数据将不统一，我将不得不填写无计数的空白，以便能够绘制图表。除非有另一种方法或方法可以用 Excel 很好地做到这一点？

我的想法可能是使用一个包含 tcp 状态的数组来保存结果命中表并计算零。这是正确的思维方式吗？

很抱歉这篇文章很长。预先感谢您。

Answer 1

我制作了一个 bash 脚本来转换您的文件输出:

2015-08-13 09:55:27 Port 8080 ( ESTABLISHED 7, FIN_WAIT2 1, LISTEN 1,) Port 5555 ( CLOSE_WAIT 1, ESTABLISHED 2,)
2015-08-13 09:56:27 Port 8080 ( ESTABLISHED 1, LISTEN 1,) Port 5555 ( CLOSE_WAIT 1, ESTABLISHED 1,)

至:

2015-08-13,09:55:27,8080,7,,,,1,,,,,1,,5555,2,,,,,,,1,,,,0
2015-08-13,09:56:27,8080,1,,,,,,,,,1,,5555,1,,,,,,,1,,,,1

定义了 Linux 系统中每个端口的所有 session 状态:

declare -a arr=("ESTABLISHED" "SYN_SENT" "SYN_RECV" "FIN_WAIT1" "FIN_WAIT2" "TIME_WAIT" "CLOSED" "CLOSE_WAIT" "LAST_ACK" "LISTEN" "CLOSING")

每行的最后一个数字是行计数变量。

用法:

netstat_format.sh your_output.txt formatted_output.txt

netstat_format.sh的完整代码:

#!/bin/bash
#title         :format_netstat.sh
#author        :Bertrand Martel
#date          :13/08/2015

#declare a list of all session state you may find in linux system
declare -a arr=("ESTABLISHED" "SYN_SENT" "SYN_RECV" "FIN_WAIT1" "FIN_WAIT2" "TIME_WAIT" "CLOSED" "CLOSE_WAIT" "LAST_ACK" "LISTEN" "CLOSING")

IFS=$'\n'     #line delimiter
set -f        #Disable file name generation (globbing)
count_line=0  #line counter

#empty your output file
cp /dev/null "$2"

for i in $(cat "$1"); do

    #test="2015-08-13 09:55:27 Port 8080 ( ESTABLISHED 7, FIN_WAIT2 1, LISTEN 1,) Port 5555 ( CLOSE_WAIT 1, ESTABLISHED 2,)"
    main_part=$i

    new_line=""

    #extract first,second and fourth column with ' ' delimiter
    date_val=`echo $main_part | cut -d' ' -f1`
    time_val=`echo $main_part | cut -d' ' -f2`
    port_val=`echo $main_part | cut -d' ' -f4`

    #append these fields to new line output var
    new_line="$date_val,$time_val,$port_val"

    for i in {0..10}
    {
        #here extract all that is between parenthesis and process it independently with replacing "," with ' ', looking for session state in arr defined in the beginning.
        #  awk '{print $2}' => will finally print the second argument eg the value of the key found in arr
        result=`echo $main_part | awk -v FS="([(]|[)])" '{print $2}'  | sed 's/,/ /g' | grep -o "${arr[i]} [^ ]*" | awk '{print $2}'`
        if [ -z "$result" ]; then
            result=""
        fi
        new_line="$new_line,$result"
    }

    #cut all before " Port"
    second_part=`echo $main_part | sed 's/.*) Port //'`

    #second port in line
    port2_val=`echo $second_part | cut -d' ' -f1`

    #add port2 value to line output
    new_line="$new_line,$port2_val"

    for i in {0..10}
    {
        result=`echo $second_part | awk -v FS="([(]|[)])" '{print $2}'  | sed 's/,/ /g' | grep -o "${arr[i]} [^ ]*" | awk '{print $2}'`
        if [ -z "$result" ]; then
            result=""
        fi
        new_line="$new_line,$result"
    }

    #############################################

    #cut all before " Port"
    third_part=`echo $second_part | sed 's/.*) Port //'`

    #second port in line
    port3_val=`echo $third_part | cut -d' ' -f1`

    #add port2 value to line output
    new_line="$new_line,$port3_val"

    for i in {0..10}
    {
        result=`echo $third_part | awk -v FS="([(]|[)])" '{print $2}'  | sed 's/,/ /g' | grep -o "${arr[i]} [^ ]*" | awk '{print $2}'`
        if [ -z "$result" ]; then
            result=""
        fi
        new_line="$new_line,$result"
    }

    ############################################

    #add line count
    new_line="$new_line,$count_line"

    #increment line count
    count_line=$((count_line+1))

    #append content of new line to output file
    echo $new_line >> "$2"
done

cat "$2"

当您可以获取文件时，我创建了一个要点:

https://gist.github.com/bertrandmartel/5f1c0c0c84db44e85ca8#file-netstat_format-sh

尽管如此，它只处理 2 系列端口 XXX (....) 字符串，如果您希望有更多，则必须稍微修改脚本