查询套接字信息

# -l 只显示监听套接字# -n 显示地址和端口# -p 显示进程信息$ netstat -nlpActive Internet connections (only servers)Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:8028 0.0.0.0:* LISTEN 343570/java tcp 0 0 0.0.0.0:8030 0.0.0.0:* LISTEN 443862/java tcp 0 0 0.0.0.0:8031 0.0.0.0:* LISTEN 443864/java tcp 0 0 0.0.0.0:8032 0.0.0.0:* LISTEN 443868/java tcp 0 0 0.0.0.0:10050 0.0.0.0:* LISTEN 1440/zabbix_agentd tcp 0 0 127.0.0.1:8005 0.0.0.0:* LISTEN 910064/java# -l 显示监听套接字# -t 显示TCP套接字# -n 显示地址和端口# -p 显示进程信息$ ss -ltnpState Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 100 *:8028 *:* users:(("java",pid=343570,fd=97))LISTEN 0 100 *:8030 *:* users:(("java",pid=443862,fd=202))LISTEN 0 100 *:8031 *:* users:(("java",pid=443864,fd=203))LISTEN 0 100 *:8032 *:* users:(("java",pid=443868,fd=35))

这些指标中，主要关注：

• State，套接字的状态；
• Recv-Q，接收队列；
• Send-Q，发送队列；
• Local Addredd:Port，本地地址端口；
• Peer Address:Port，远程地址端口；
• pid，进程pid；

查看网络统计信息

# 每隔5秒输出一组数据$ sar -n DEV 502:35:40 PM IFACE rxpck/s txpck/s rxkB/s txkB/s rxcmp/s txcmp/s rxmcst/s02:35:50 PM eth0 635.90 753.80 131.98 272.04 0.00 0.00 0.0002:35:50 PM lo 28.80 28.80 9.09 9.09 0.00 0.00 0.0002:35:50 PM docker0 0.00 0.00 0.00 0.00 0.00 0.00 0.00

这些指标中，主要关注：

• rxpck/s 与 txpck/s 表示接收和发送的数据包数量；
• rxkB/s 与 txkB/s 表示接收和发送的数据大小；

查询远程主机的联通性

# -c5表示发送5次包后停止$ ping -c5 127.0.0.1PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.053 ms64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.037 ms64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.068 ms64 bytes from 127.0.0.1: icmp_seq=4 ttl=64 time=0.027 ms64 bytes from 127.0.0.1: icmp_seq=5 ttl=64 time=0.022 ms--- 127.0.0.1 ping statistics ---5 packets transmitted, 5 received, 0% packet loss, time 4000msrtt min/avg/max/mdev = 0.022/0.041/0.068/0.017 m

这些指标中，主要关注：

• packets transmitted，发送了多少个网络数据包；
• received，接收到了多少个网络数据包的响应；
• rtt，往返时延统计；

使用tcpdump抓包

# -nn 表示不解析抓包中的域名、协议以及端口# port 表示只显示指定端口（源端口号和目标端口号）的包# host 表示只显示指定ip地址（源地址和目标地址）的包# -w file.pcap 将抓包数据保存到文件中，导入wireshark分析$ tcpdump -nn port 80 or host 127.0.0.1tcpdump: verbose output suppressed, use -v or -vv for full protocol decodelistening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes15:22:07.447545 IP 45.195.243.75.49791 > 11.104.162.234.80: Flags [S], seq 2927125310, win 8192, options [mss 1424,nop,nop,sackOK], length 015:22:07.447578 IP 11.104.162.234.80 > 45.195.243.75.49791: Flags [S.], seq 2514974421, ack 2927125311, win 29200, options [mss 1460,nop,nop,sackOK], length 015:22:07.463852 IP 106.53.16.202.58801 > 11.104.162.234.80: Flags [S], seq 3214221967, win 14600, options [mss 1424,nop,nop,sackOK,nop,wscale 7], length 015:22:07.463888 IP 11.104.162.234.80 > 106.53.16.202.58801: Flags [S.], seq 2489797702, ack 3214221968, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 015:22:07.464344 IP 106.53.16.202.58801 > 11.104.162.234.80: Flags [.], ack 1, win 115, length 015:22:07.464384 IP 106.53.16.202.58801 > 11.104.162.234.80: Flags [P.], seq 1:91, ack 1, win 115, length 90: HTTP: GET / HTTP/1.115:22:07.464396 IP 11.104.162.234.80 > 106.53.16.202.58801: Flags [.], ack 91, win 229, length 015:22:07.464507 IP 11.104.162.234.80 > 106.53.16.202.58801: Flags [.], seq 1:5697, ack 91, win 229, length 5696: HTTP: HTTP/1.1 200 OK15:22:07.464556 IP 11.104.162.234.80 > 106.53.16.202.58801: Flags [FP.], seq 5697:5841, ack 91, win 229, length 144: HTTP15:22:07.464967 IP 106.53.16.202.58801 > 11.104.162.234.80: Flags [.], ack 1425, win 137, length 015:22:07.464977 IP 106.53.16.202.58801 > 11.104.162.234.80: Flags [R.], seq 91, ack 1425, win 137, length 015:22:07.465016 IP 169.254.212.207.58801 > 11.104.162.234.80: Flags [R], seq 3214222058, win 0, length 015:22:07.465029 IP 169.254.212.207.58801 > 11.104.162.234.80: Flags [R], seq 3214222058, win 0, length 015:22:07.465032 IP 169.254.212.207.58801 > 11.104.162.234.80: Flags [R], seq 3214222058, win 0, length 015:22:07.465035 IP 169.254.212.207.58801 > 11.104.162.234.80: Flags [R], seq 3214222058, win 0, length 0

这些数据包的格式为：时间戳 协议 源地址.源端口号 > 目标地址.目标端口号 网络包信息

总结

以上便是查询Linux网络使用情况常用的命令，在此记录一下方便以后查看。

喜欢 (0)