# 查看所有监听端口
ss -tunlp

# 查看TCP监听端口
ss -tnlp

# 查看UDP监听端口
ss -unlp

# 查看特定端口
ss -tunlp | grep :80

# 查看已建立的连接
ss -tun

# 按状态过滤
ss -tun state ESTABLISHED
ss -tun state LISTEN
ss -tun state TIME_WAIT

# 统计连接数
ss -s

# 查看所有监听端口
netstat -tunlp

# 查看TCP监听端口
netstat -tnlp

# 查看UDP监听端口
netstat -unlp

# 查看特定服务
netstat -tunlp | grep nginx
netstat -tunlp | grep 3306

# 统计各状态连接数
netstat -tun | awk '{print $6}' | sort | uniq -c

# 查看端口占用
lsof -i :80
lsof -i :3306

# 查看进程打开的端口
lsof -p <PID>

# 查看所有网络连接
lsof -i

# 查看TCP连接
lsof -i tcp

# 查看UDP连接
lsof -i udp

# 查看端口占用进程
fuser 80/tcp
fuser 3306/tcp

# 杀死占用端口的进程
fuser -k 80/tcp

# 查看所有TCP端口
fuser -n tcp 1-65535

# 测试端口连通性
telnet localhost 80
telnet 192.168.1.100 3306

# 测试HTTPS端口
telnet example.com 443

# 测试端口连通性
nc -vz localhost 80
nc -vz 192.168.1.100 3306

# 测试UDP端口
nc -uz localhost 53

# 端口扫描
nc -z 192.168.1.1 1-1000

# 端口转发
nc -l 8080 | nc localhost 80

# 测试HTTP端口
curl -v http://localhost:80

# 测试HTTPS端口
curl -v https://localhost:443

# 测试API端口
curl -v http://localhost:8080/api/health

# 测试超时
curl --connect-timeout 5 http://localhost:8080

# 测试主机连通性
ping localhost
ping 192.168.1.100

# 测试DNS
ping example.com

# 设置包大小和数量
ping -s 100 -c 4 192.168.1.100

# SSH端口配置
vim /etc/ssh/sshd_config
Port 22

# Nginx端口配置
vim /etc/nginx/nginx.conf
listen 80;
listen [::]:80;
listen 443 ssl http2;
listen [::]:443 ssl http2;

# MySQL端口配置
vim /etc/my.cnf
port = 3306

# Redis端口配置
vim /etc/redis/redis.conf
port 6379

# PostgreSQL端口配置
vim /var/lib/pgsql/data/postgresql.conf
port = 5432

# MongoDB端口配置
vim /etc/mongod.conf
net:
  port: 27017
  bindIp: 127.0.0.1

# RabbitMQ端口配置
vim /etc/rabbitmq/rabbitmq.conf
listeners.tcp.default = 5672
management.tcp.port = 15672

# Docker容器端口
docker run -p 8080:8080 -e PORT=8080 myapp

# Kubernetes服务端口
apiVersion: v1
kind: Service
metadata:
  name: myapp
spec:
  ports:
  - port: 80
    targetPort: 8080
    nodePort: 30080
  selector:
    app: myapp
  type: NodePort

# 查看现有规则
iptables -L -n

# 允许SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# 允许HTTP/HTTPS
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# 允许MySQL（只允许特定IP）
iptables -A INPUT -p tcp --dport 3306 -s 192.168.1.0/24 -j ACCEPT

# 允许Redis（只允许本地）
iptables -A INPUT -p tcp --dport 6379 -s 127.0.0.1 -j ACCEPT

# 拒绝所有其他入站连接
iptables -A INPUT -j DROP

# 保存规则
iptables-save > /etc/iptables/rules.v4

# 查看状态
systemctl status firewalld

# 启动服务
systemctl start firewalld

# 允许SSH
firewall-cmd --permanent --add-service=ssh

# 允许HTTP/HTTPS
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https

# 允许特定端口
firewall-cmd --permanent --add-port=3306/tcp
firewall-cmd --permanent --add-port=6379/tcp

# 允许特定IP访问
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="3306" protocol="tcp" accept'

# 重新加载
firewall-cmd --reload

# 查看规则
firewall-cmd --list-all

# 查看状态
ufw status

# 启用
ufw enable

# 允许SSH
ufw allow ssh

# 允许HTTP/HTTPS
ufw allow http
ufw allow https

# 允许特定端口
ufw allow 3306/tcp
ufw allow 6379/tcp

# 允许特定IP
ufw allow from 192.168.1.0/24 to any port 3306

# 拒绝所有其他
ufw default deny incoming
ufw default allow outgoing

# 禁用不必要的服务
systemctl stop telnet
systemctl disable telnet

# 更改默认端口（可选）
# SSH
vim /etc/ssh/sshd_config
Port 2222

# 重启服务
systemctl restart sshd

# 配置TCP Wrappers
echo "sshd: 192.168.1.0/24" >> /etc/hosts.allow
echo "sshd: ALL" >> /etc/hosts.deny

# 启用fail2ban防止暴力破解
apt install fail2ban
systemctl enable fail2ban
systemctl start fail2ban

# Docker端口映射（只绑定本地）
docker run -p 127.0.0.1:8080:8080 myapp

# Kubernetes网络策略
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: mysql-policy
spec:
  podSelector:
    matchLabels:
      app: mysql
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: web
    ports:
    - protocol: TCP
      port: 3306

#!/bin/bash
# port_monitor.sh - 端口监控脚本

PORTS=(22 80 443 3306 6379 8080)
HOST="localhost"
ALERT_EMAIL="admin@example.com"

log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*"
}

check_port() {
    local host=$1
    local port=$2
    local timeout=5
    
    if nc -z -w $timeout $host $port 2>/dev/null; then
        log "端口 $port 正常"
        return 0
    else
        log "端口 $port 异常"
        return 1
    fi
}

main() {
    local down_ports=()
    
    for port in "${PORTS[@]}"; do
        if ! check_port $HOST $port; then
            down_ports+=($port)
        fi
    done
    
    if [ ${#down_ports[@]} -gt 0 ]; then
        local message="以下端口不可达: ${down_ports[*]}"
        log "发送告警: $message"
        echo "$message" | mail -s "端口监控告警" $ALERT_EMAIL
    fi
}

main

#!/bin/bash
# port_manager.sh - 端口管理工具

usage() {
    cat << EOF
端口管理工具

用法: $0 [命令] [参数]

命令:
  list              列出所有监听端口
  check <port>      检查指定端口状态
  scan <host>       扫描主机开放端口
  kill <port>       杀死占用指定端口的进程
  status            查看端口状态统计
  help              显示此帮助
EOF
}

list_ports() {
    echo "=== 监听端口列表 ==="
    ss -tunlp | grep LISTEN
}

check_port() {
    local port=$1
    echo "=== 检查端口 $port ==="
    ss -tunlp | grep :$port
    if nc -z localhost $port 2>/dev/null; then
        echo "端口 $port 可达"
    else
        echo "端口 $port 不可达"
    fi
}

scan_ports() {
    local host=$1
    echo "=== 扫描主机 $host 开放端口 ==="
    for port in $(seq 1 1000); do
        if nc -z -w 1 $host $port 2>/dev/null; then
            echo "端口 $port 开放"
        fi
    done
}

kill_port() {
    local port=$1
    echo "=== 杀死占用端口 $port 的进程 ==="
    local pid=$(lsof -t -i:$port 2>/dev/null)
    if [ -n "$pid" ]; then
        echo "杀死进程 $pid"
        kill -9 $pid
    else
        echo "没有进程占用端口 $port"
    fi
}

status_ports() {
    echo "=== 端口状态统计 ==="
    ss -tun | awk '{print $6}' | sort | uniq -c
}

case $1 in
    list)
        list_ports
        ;;
    check)
        check_port $2
        ;;
    scan)
        scan_ports $2
        ;;
    kill)
        kill_port $2
        ;;
    status)
        status_ports
        ;;
    help)
        usage
        ;;
    *)
        usage
        ;;
esac

# 查找占用端口的进程
ss -tunlp | grep :8080
lsof -i :8080
fuser 8080/tcp

# 查看进程详情
ps aux | grep <PID>

# 杀死进程
kill -9 <PID>

# 检查服务状态
systemctl status nginx
systemctl status mysql

# 检查监听地址
ss -tunlp | grep :80

# 测试本地连接
curl http://localhost:80

# 测试远程连接
curl http://192.168.1.100:80

# 检查防火墙
iptables -L -n | grep 80
firewall-cmd --list-ports

# 抓包分析
tcpdump -i eth0 port 80 -c 100

# 查看TIME_WAIT数量
ss -s | grep TIME-WAIT

# 调整TCP参数
vim /etc/sysctl.conf

# 减少TIME_WAIT超时
net.ipv4.tcp_fin_timeout = 30

# 启用TIME_WAIT快速回收
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1

# 应用配置
sysctl -p

# 查找占用端口的进程
ss -tunlp | grep :8080
# 结果显示java进程占用

# 查看进程详情
ps aux | grep java
# 发现是另一个应用在运行

# 解决方案
# 1. 停止占用端口的进程
kill -9 <PID>
# 2. 或修改应用端口

# 检查服务状态
systemctl status myapp

# 检查监听端口
ss -tunlp | grep :8080

# 测试本地访问
curl http://localhost:8080

# 测试远程访问
curl http://192.168.1.100:8080

# 检查防火墙
firewall-cmd --list-ports

# 解决方案
firewall-cmd --permanent --add-port=8080/tcp
firewall-cmd --reload

# 查看连接状态
ss -s
# TIME-WAIT: 10000+

# 调整TCP参数
vim /etc/sysctl.conf
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_max_tw_buckets = 5000
sysctl -p

#!/bin/bash
# port_automation.sh - 端口管理自动化

# 配置文件
CONFIG_FILE="/etc/port_management.yml"

# 加载配置
if [ -f "$CONFIG_FILE" ]; then
    source <(yq -o=shell "$CONFIG_FILE")
else
    echo "配置文件不存在: $CONFIG_FILE"
    exit 1
fi

# 检查所有端口
check_all_ports() {
    echo "=== 检查所有配置端口 ==="
    for service in "${!server_ports[@]}"; do
        port=${server_ports[$service]}
        if nc -z localhost $port 2>/dev/null; then
            echo "✓ $service ($port): 正常"
        else
            echo "✗ $service ($port): 异常"
        fi
    done
}

# 生成防火墙规则
generate_firewall_rules() {
    echo "=== 生成防火墙规则 ==="
    for rule in "${firewall_rules[@]}"; do
        local port=$(echo "$rule" | jq -r '.port')
        local protocol=$(echo "$rule" | jq -r '.protocol')
        local source=$(echo "$rule" | jq -r '.source')
        local description=$(echo "$rule" | jq -r '.description')
        
        echo "# $description"
        echo "firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"$source\" port port=\"$port\" protocol=\"$protocol\" accept'"
    done
}

# 导出端口文档
export_port_document() {
    echo "=== 导出端口文档 ==="
    yq "$CONFIG_FILE" > port_documentation.md
    echo "端口文档已导出到: port_documentation.md"
}

case $1 in
    check)
        check_all_ports
        ;;
    firewall)
        generate_firewall_rules
        ;;
    export)
        export_port_document
        ;;
    *)
        echo "用法: $0 {check|firewall|export}"
        ;;
esac