Home / server / Questions / 1017474
Accepted
Kalib Zen
Asked: 2020-05-18 00:12:44 +0800 CST

netstat how to exclude localhost from the result when using grep

  • 772

When I run this command in my terminal:

netstat -an | egrep ":80|:443" | sort

I got this following output:

tcp        0      0 172.104.10.125:48310    172.104.10.125:8081     TIME_WAIT  
tcp        0      0 172.104.10.125:48316    172.104.10.125:8081     TIME_WAIT    
tcp        0      0 172.104.10.125:48428    172.104.10.125:8081     ESTABLISHED
tcp        0      0 172.104.10.125:80       0.0.0.0               LISTEN     
tcp        0      0 172.104.10.125:80       5.111.110.185:23784     SYN_RECV   
tcp        0      0 172.104.10.125:80       89.109.64.166:42690     TIME_WAIT  
tcp6       0      0 ::1:443                 ::                    LISTEN     
tcp        0      0 172.104.10.125:443      60.51.33.253:65270      ESTABLISHED
tcp        0      0 172.104.10.125:443      66.249.79.94:49202      ESTABLISHED
tcp6       0      0 172.104.10.125:8080     172.104.10.125:39668    TIME_WAIT

The 172.104.10.125 is my IP address, how do I exclude the above result that have '172.104.10.125', '0.0.0.0' and '::' on the 5th column ? Because those are trusted localhost IP and protocol.

If I use this: 

egrep -v "172.104.10.125|::|0.0.0.0"

it will exclude everything not on the 5th column

centos grep netstat

1 Answers

  1. Best Answer

    You could use awk

    awk '$5 !~ "^(172\.104\.10\.125:[0-9]+|0\.0\.0\.0|::)$"'

    but grep can do it

    grep -Ev '^([^ ]+ +){4}(172\.104\.10\.125:[0-9]+|0\.0\.0\.0|::)'
    • 0