#!/usr/bin/env bash
# ============================================================================
# MAX NetStat — 网络连接分析
# 原创脚本，灵感源于 tcp-connection-state-counter (oldratlee/useful-scripts)
# 但大幅扩展：TCP 状态统计 + 监听端口 + 进程绑定 + 流量排行
#
# 风险等级: 🟢 只读 — 不修改任何系统设置
# 用法: bash <(curl -fsSL https://dl.unvmax.com/linux/scripts/max-tools/max-netstat.sh)
# ============================================================================

set -e

R='\033[1;31m' G='\033[1;32m' Y='\033[1;33m' B='\033[1;34m'
C='\033[1;36m' M='\033[1;35m' W='\033[1;37m' N='\033[0m'
GR='\033[90m'

echo -e "${B}┌─────────────────────────────────────────────┐${N}"
echo -e "${B}│${N}  ${G}MAX 网络连接分析${N}  ${GR}(只读诊断)${N}"
echo -e "${B}└─────────────────────────────────────────────┘${N}"
echo

# 1. TCP 连接状态统计
echo -e "  ${M}1. TCP 连接状态分布${N}"
echo -e "  ${GR}───${N}"
if command -v ss &>/dev/null; then
    ss -tan 2>/dev/null | awk 'NR>1 {print $1}' | sort | uniq -c | sort -rn | while read -r cnt state; do
        case "$state" in
            ESTAB) c=$G ;;
            TIME-WAIT) c=$Y ;;
            CLOSE-WAIT) c=$R ;;
            SYN-SENT) c=$R ;;
            *) c=$C ;;
        esac
        echo -e "  ${c}$cnt${N}  ${GR}$state${N}"
    done
else
    netstat -tan 2>/dev/null | awk 'NR>2 {print $6}' | sort | uniq -c | sort -rn
fi

# 2. 监听端口及进程
echo -e "\n  ${M}2. 服务监听端口${N}"
echo -e "  ${GR}───${N}"
ss -tlnp 2>/dev/null | awk 'NR>1 {
    split($4, a, ":")
    port=a[length(a)]
    proc=""
    if (match($7, /pid=([0-9]+)/, b)) proc=b[1]
    if (match($7, /"([^"]+)"/, c)) proc=proc"/"c[1]
    printf "  %s %s [%s]\n", $1, port, proc
}' | sort -t: -k2 -n | uniq | while read -r line; do
    echo -e "  ${G}LISTEN${N}  ${W}$(echo $line | awk '{print $2}')${N}  ${GR}$(echo $line | awk '{$1=$2=""; print $0}')${N}"
done

# 3. 连接数最多的远程 IP
echo -e "\n  ${M}3. 连接数 TOP10 (远程 IP)${N}"
echo -e "  ${GR}───${N}"
ss -tn 2>/dev/null | awk 'NR>1 {
    split($5, a, ":")
    ip=a[1]
    gsub(/\[|\]/, "", ip)
    if (ip != "127.0.0.1" && ip != "::1") print ip
}' | sort | uniq -c | sort -rn | head -10 | while read -r cnt ip; do
    echo -e "  ${Y}$cnt${N}  ${GR}$ip${N}"
done

# 4. 总连接量
total=$(ss -tan 2>/dev/null | wc -l)
estab=$(ss -tan 2>/dev/null | grep -c ESTAB)
echo -e "\n  ${M}4. 概要统计${N}"
echo -e "  ${GR}───${N}"
echo -e "  总连接: ${W}$total${N}  |  已建立: ${G}$estab${N}  |  监听端口: $(ss -tln 2>/dev/null | wc -l)"

echo
echo -e "${GR}👉 HTTP 诊断: max-httpdiag.sh | 实时 ping: max-pingmon.sh${N}"