linux网络工具应用详解之二
来源:互联网 发布:dhcp服务器软件下载 编辑:程序博客网 时间:2024/06/05 06:13
十一、 ss - 网络相关信息
ss命令用来显示网络套接字信息,它允许显示类似netstat一样的信息。关于ss和netstat使用,可参考下列资源。
相关链接:
ss: Display Linux TCP / UDP Network and Socket Information
http://www.cyberciti.biz/tips/linux-investigate-sockets-network-connections.html
The ss command is used to show socket statistics.
It can display stats for PACKET sockets, TCP sockets, UDP sockets, DCCP sockets, RAW sockets,
Unix domain sockets, and much more.
It allows showing information similar to netstat command.
It can display more TCP and state information than other tools.
It is a new, incredibly useful and faster (as compare to netstat) tool for tracking TCP connections
and sockets. SS can provide information about:
. All TCP sockets.
. All UDP sockets.
. All established ssh / ftp / http / https connections.
. All local processes connected to X server.
. Filtering by state (such as connected, synchronized, SYN-RECV, SYN-SENT,TIME-WAIT), addresses and ports.
. All the tcp sockets in state FIN-WAIT-1 and much more.
Most Linux distributions are shipped with ss and many monitoring tools.
Being familiar with this tool helps enhance your understand of what's going on in the system sockets
and helps you find the possible causes of a performance problem.
Task: Display Sockets Summary
List currently established, closed, orphaned and waiting TCP sockets, enter:
# ss -s
Sample Output:
Total: 734 (kernel 904)
TCP: 1415 (estab 112, closed 1259, orphaned 11, synrecv 0, timewait 1258/0), ports 566
Transport Total IP IPv6
* 904 - -
RAW 0 0 0
UDP 15 12 3
TCP 156 134 22
INET 171 146 25
FRAG 0 0 0
Task: Display All Open Network Ports
显示所有打开的网络端口
# ss -l
Sample Output:
ss -l
Recv-Q Send-Q Local Address:Port Peer Address:Port
0 0 127.0.0.1:smux *:*
0 0 127.0.0.1:10024 *:*
0 0 127.0.0.1:10025 *:*
0 0 *:3306 *:*
0 0 :http *:*
0 0 *:4949 *:*
0 0 *:domain *:*
0 0 *:ssh *:*
0 0 *:smtp *:*
0 0 127.0.0.1:rndc *:*
0 0 127.0.0.1:6010 *:*
0 0 *:https *:*
0 0 :::34571 :::*
0 0 :::34572 :::*
0 0 :::34573 :::*
0 0 ::1:rndc :::*
Type the following to see process named using open socket:
查看使用端口的进程
# ss -pl
Find out who is responsible for opening socket / port # 4949:
查看端口对应进程的状态信息
# ss -lp | grep 4949
Sample output:
0 0 *:4949 *:* users:(("munin-node",3772,5))
munin-node (PID # 3772) is responsible for opening port # 4949.
You can get more information about this process
(like memory used, users, current working directory and so on) visiting /proc/3772 directory:
# cd /proc/3772
# ls -l
Task: Display All TCP Sockets
# ss -t -a
Task: Display All UDP Sockets
# ss -u -a
Task: Display All Established SMTP Connections
# ss -o state established '( dport = :smtp or sport = :smtp )'
Task: Display All Established HTTP Connections
# ss -o state established '( dport = :http or sport = :http )'
Task: Find All Local Processes Connected To X Server
# ss -x src /tmp/.X11-unix/*
Task: List All The Tcp Sockets in State FIN-WAIT-1
List all the TCP sockets in state -FIN-WAIT-1 for our httpd to network 202.54.1/24
and look at their timers:
# ss -o state fin-wait-1 '( sport = :http or sport = :https )' dst 202.54.1/24
How Do I Filter Sockets Using TCP States?
如何过滤TCP socket的状态
The syntax is as follows:
## tcp ipv4 ##
ss -4 state FILTER-NAME-HERE
## tcp ipv6 ##
ss -6 state FILTER-NAME-HERE
Where FILTER-NAME-HERE can be any one of the following:
established
syn-sent
syn-recv
fin-wait-1
fin-wait-2
time-wait
closed
close-wait
last-ack
listen
closing
all : All of the above states
connected : All the states except for listen and closed
synchronized : All the connected states except for syn-sent
bucket : Show states, which are maintained as minisockets, i.e. time-wait and syn-recv.
big : Opposite to bucket state.
Examples
Type the following command to see closing sockets:
$ ss -4 state closing
Recv-Q Send-Q Local Address:Port Peer Address:Port
1 11094 75.126.153.214:http 175.44.24.85:4669
How Do I Matches Remote Address And Port Numbers?
查看访问远程地址的本机端口
Use the following syntax:
ss dst ADDRESS_PATTERN
## Show all ports connected from remote 192.168.1.5##
ss dst 192.168.1.5
## show all ports connected from remote 192.168.1.5:http port##
ss dst 192.168.1.5:http
ss dst 192.168.1.5:smtp
ss dst 192.168.1.5:443
Find out connection made by remote 123.1.2.100:http to our local virtual servers:
# ss dst 123.1.2.100:http
Sample outputs:
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 0 75.126.153.206:http 123.1.2.100:35710
ESTAB 0 0 75.126.153.206:http 123.1.2.100:35758
How Do I Matches Local Address And Port Numbers?
查看本机使用某个地址的匹配的端口
ss src ADDRESS_PATTERN
### find out all ips connected to nixcraft.com ip address 75.126.153.214 ###
## Show all ports connected to local 75.126.153.214##
ss src 75.126.153.214
## http (80) port only ##
ss src 75.126.153.214:http
ss src 75.126.153.214:80
## smtp (25) port only ##
ss src 75.126.153.214:smtp
ss src 75.126.153.214:25
How Do I Compare Local and/or Remote Port To A Number?
端口的数字化比较查询:
Use the following syntax:
## Compares remote port to a number ##
ss dport OP PORT
## Compares local port to a number ##
sport OP PORT
Where OP can be one of the following:
<= or le : Less than or equal to port
>= or ge : Greater than or equal to port
== or eq : Equal to port
!= or ne : Not equal to port
< or gt : Less than to port
> or lt : Greater than to port
Note: le, gt, eq, ne etc. are use in unix shell and are accepted as well.
Examples
###################################################################################
### Do not forget to escape special characters when typing them in command line ###
###################################################################################
ss sport = :http
ss dport = :http
ss dport \> :1024
ss sport \> :1024
ss sport \< :32000
ss sport eq :22
ss dport != :22
ss state connected sport = :http
ss \( sport = :http or sport = :https \)
ss -o state fin-wait-1 \( sport = :http or sport = :https \) dst 192.168.1/24
ss vs netstat Speed
Use the time command to run both programs and summarize system resource usage.
Type the netstat command as follows:
# time netstat -at
Sample outputs:
real 2m52.254s
user 0m0.178s
sys 0m0.170s
Now, try the ss command:
# time
Sample outputs:
real 2m11.102s
user 0m0.124s
sys 0m0.068s
Note: Both outputs are taken from reverse proxy acceleration server running on RHEL 6.x amd64.
Recommended readings:
See ss command help page.
十二、netstat - 网络相关信息
netstat可以显示网络链接、路由表信息、接口统计信息、伪装链接和多播成员(multicast memberships),
• Get Detailed Information About Particular IP address Connections Using netstat Command
http://www.cyberciti.biz/tips/netstat-command-tutorial-examples.html
netstat command and shell pipe feature can be used to dig out more information about particular
IP address connection. You can find out total established connections, closing connection,
SYN and FIN bits and much more. You can also display summary statistics for each protocol using netstat.
This is useful to find out if your server is under attack or not.
You can also list abusive IP address using this method.
查看服务器是否受到攻击,并找出攻击的IP
# netstat -nat | awk '{print $6}' | sort | uniq -c | sort -n
Output:
1 CLOSE_WAIT
1 established)
1 Foreign
3 FIN_WAIT1
3 LAST_ACK
13 ESTABLISHED
17 LISTEN
154 FIN_WAIT2
327 TIME_WAIT
Dig out more information about a specific ip address:
找出更多的信息:
# netstat -nat |grep {IP-address} | awk '{print $6}' | sort | uniq -c | sort -n
2 LAST_ACK
2 LISTEN
4 FIN_WAIT1
14 ESTABLISHED
91 TIME_WAIT
130 FIN_WAIT2
Busy server can give out more information:
# netstat -nat |grep 202.54.1.10 | awk '{print $6}' | sort | uniq -c | sort -n
Output:
15 CLOSE_WAIT
37 LAST_ACK
64 FIN_WAIT_1
65 FIN_WAIT_2
1251 TIME_WAIT
3597 SYN_SENT
5124 ESTABLISHED
Get List Of All Unique IP Address
To print list of all unique IP address connected to server, enter:
# netstat -nat | awk '{ print $5}' | cut -d: -f1 | sed -e '/^$/d' | uniq
To print total of all unique IP address, enter:
# netstat -nat | awk '{ print $5}' | cut -d: -f1 | sed -e '/^$/d' | uniq | wc -l
Output:
449
Find Out If Box is Under DoS Attack or Not
If you think your Linux box is under attack,
print out a list of open connections on your box and sorts them by according to IP address, enter:
# netstat -atun | awk '{print $5}' | cut -d: -f1 | sed -e '/^$/d' |sort | uniq -c | sort -n
Output:
1 10.0.77.52
2 10.1.11.3
4 12.109.42.21
6 12.191.136.3
.....
...
....
13 202.155.209.202
18 208.67.222.222
28 0.0.0.0
233 127.0.0.1
You can simply block all abusive IPs using iptables or just null route them.
使用iptables来做限制
Get Live View of TCP Connections
You can use tcptrack command to display the status of TCP connections that
it sees on a given network interface. tcptrack monitors their state and displays information
such as state, source/destination addresses and bandwidth usage in a sorted,
updated list very much like the top command.
Display Summary Statistics for Each Protocol
Simply use netstat -s:
# netstat -s | less
# netstat -t -s | less
# netstat -u -s | less
# netstat -w -s | less
# netstat -s
Output:
Ip:
88354557 total packets received
0 forwarded
0 incoming packets discarded
88104061 incoming packets delivered
96037391 requests sent out
13 outgoing packets dropped
66 fragments dropped after timeout
295 reassemblies required
106 packets reassembled ok
66 packet reassembles failed
34 fragments failed
Icmp:
18108 ICMP messages received
58 input ICMP message failed.
ICMP input histogram:
destination unreachable: 7173
timeout in transit: 472
redirects: 353
echo requests: 10096
28977 ICMP messages sent
0 ICMP messages failed
ICMP output histogram:
destination unreachable: 18881
echo replies: 10096
Tcp:
1202226 active connections openings
2706802 passive connection openings
7394 failed connection attempts
47018 connection resets received
23 connections established
87975383 segments received
95235730 segments send out
681174 segments retransmited
2044 bad segments received.
80805 resets sent
Udp:
92689 packets received
14611 packets to unknown port received.
0 packet receive errors
96755 packets sent
TcpExt:
48452 invalid SYN cookies received
7357 resets received for embryonic SYN_RECV sockets
43 ICMP packets dropped because they were out-of-window
5 ICMP packets dropped because socket was locked
2672073 TCP sockets finished time wait in fast timer
441 time wait sockets recycled by time stamp
368562 delayed acks sent
430 delayed acks further delayed because of locked socket
Quick ack mode was activated 36127 times
32318597 packets directly queued to recvmsg prequeue.
741479256 packets directly received from backlog
1502338990 packets directly received from prequeue
18343750 packets header predicted
10220683 packets header predicted and directly queued to user
17516622 acknowledgments not containing data received
36549771 predicted acknowledgments
102672 times recovered from packet loss due to fast retransmit
Detected reordering 1596 times using reno fast retransmit
Detected reordering 1 times using time stamp
8 congestion windows fully recovered
32 congestion windows partially recovered using Hoe heuristic
19 congestion windows recovered after partial ack
0 TCP data loss events
39951 timeouts after reno fast retransmit
29653 timeouts in loss state
197005 fast retransmits
186937 retransmits in slow start
131433 other TCP timeouts
TCPRenoRecoveryFail: 20217
147 times receiver scheduled too late for direct processing
29010 connections reset due to unexpected data
365 connections reset due to early user close
6979 connections aborted due to timeout
Display Interface Table
You can easily display dropped and total transmitted packets with netstat for eth0:
# netstat --interfaces eth0
Output:
Kernel Interface table
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0 1500 0 2040929 0 0 0 3850539 0 0 0 BMRU
十三、 iptraf - 网络实时信息
iptraf是一个可交互式的IP网络监控工具。它可以生成多种网络统计信息包括:
TCP信息、UDP数量、ICMP和OSPF信息、以太网负载信息、节点状态、IP校验错误等。
有下面几种信息格式:
• 不同网络TCP链接传输量
• 不同网络接口IP传输量
• 不同协议网络传输量
• 不同TCP/UDP端口和不同包大小网络传输量
• 不同第二层地址网络传输量
图02:一般接口信息:不同网络接口IP传输量
图03:不同网络TCP链接传输量
十三、tcpdump:详细的网络流量分析
tcpdump是一个简单网络流量转储工具,然而要使用好需要对TCP/IP协议非常熟悉。
例如要显示关于DNS的网络流量,输入:
# tcpdump -i eth1 'udp port 53'
显示所有进出80端口IPv4 HTTP包,也就是只打印包含数据的包。例如:SYN、FIN包和ACK-only包输入:
# tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
显示所有到的FTP会话,输入:
# tcpdump -i eth1 'dst 202.54.1.5 and (port 21 or 20'
显示所有到192.168.1.5的HTTP会话
# tcpdump -ni eth0 'dst 192.168.1.5 and tcp and port http'
用wireshark浏览转储文件中的详细信息,输入:
# tcpdump -n -i eth1 -s 0 -w output.txt src or dst port 80
十四、strace - 系统调用
追踪系统调用和型号,这对于调试Web服务器和其他服务器非常有用。了解怎样追踪进程和他功能。
十五、/proc文件系统 - 各种内核信息
/proc目录下文件提供了很多不同硬件设备和内核的详细信息。更多详情参见Linux kernel /proc。一般/proc例如:
# cat /proc/cpuinfo
# cat /proc/meminfo
# cat /proc/zoneinfo
# cat /proc/mounts
十六、Nagios - 服务器及网络监控
Nagios 是一款非常流行的系统及网络监控软件。
你可以轻松监控所有的主机、网络设备及服务。它能在发生故障和重新恢复后发送警讯。
FAN是"Fully Automated Nagios"的缩写。
FAN的目标就是由Nagios社群提供Nagios的安装。
为了使安装Nagios服务器更加容易,FAN提供一个标准ISO格 式的光盘镜像。
此发行版中还会包含一组增强用户使用体验的工具。
十七、Cacti - 基于Web的监控工具
Cacti是一套完成的网络图形化解决方案,基于RRDTool的资料存储和图形化功能。
Cacti提供一个快速的轮询器、进阶的图形化模板、多种 数据采集方法和用户管理功能。
All of this is wrapped in an intuitive, easy to use interface that makes sense for
LAN-sized installations up to complex networks with hundreds of devices.
它提供关于网络、CPU、内存、已登录用户、Apache、DNS等信息。
关于怎样在CentOS / RHEL安装配置Cacti,
详见:http://www.cyberciti.biz/faq/fedora-rhel-install-cacti- monitoring-rrd-software/
ss命令用来显示网络套接字信息,它允许显示类似netstat一样的信息。关于ss和netstat使用,可参考下列资源。
相关链接:
ss: Display Linux TCP / UDP Network and Socket Information
http://www.cyberciti.biz/tips/linux-investigate-sockets-network-connections.html
The ss command is used to show socket statistics.
It can display stats for PACKET sockets, TCP sockets, UDP sockets, DCCP sockets, RAW sockets,
Unix domain sockets, and much more.
It allows showing information similar to netstat command.
It can display more TCP and state information than other tools.
It is a new, incredibly useful and faster (as compare to netstat) tool for tracking TCP connections
and sockets. SS can provide information about:
. All TCP sockets.
. All UDP sockets.
. All established ssh / ftp / http / https connections.
. All local processes connected to X server.
. Filtering by state (such as connected, synchronized, SYN-RECV, SYN-SENT,TIME-WAIT), addresses and ports.
. All the tcp sockets in state FIN-WAIT-1 and much more.
Most Linux distributions are shipped with ss and many monitoring tools.
Being familiar with this tool helps enhance your understand of what's going on in the system sockets
and helps you find the possible causes of a performance problem.
Task: Display Sockets Summary
List currently established, closed, orphaned and waiting TCP sockets, enter:
# ss -s
Sample Output:
Total: 734 (kernel 904)
TCP: 1415 (estab 112, closed 1259, orphaned 11, synrecv 0, timewait 1258/0), ports 566
Transport Total IP IPv6
* 904 - -
RAW 0 0 0
UDP 15 12 3
TCP 156 134 22
INET 171 146 25
FRAG 0 0 0
Task: Display All Open Network Ports
显示所有打开的网络端口
# ss -l
Sample Output:
ss -l
Recv-Q Send-Q Local Address:Port Peer Address:Port
0 0 127.0.0.1:smux *:*
0 0 127.0.0.1:10024 *:*
0 0 127.0.0.1:10025 *:*
0 0 *:3306 *:*
0 0 :http *:*
0 0 *:4949 *:*
0 0 *:domain *:*
0 0 *:ssh *:*
0 0 *:smtp *:*
0 0 127.0.0.1:rndc *:*
0 0 127.0.0.1:6010 *:*
0 0 *:https *:*
0 0 :::34571 :::*
0 0 :::34572 :::*
0 0 :::34573 :::*
0 0 ::1:rndc :::*
Type the following to see process named using open socket:
查看使用端口的进程
# ss -pl
Find out who is responsible for opening socket / port # 4949:
查看端口对应进程的状态信息
# ss -lp | grep 4949
Sample output:
0 0 *:4949 *:* users:(("munin-node",3772,5))
munin-node (PID # 3772) is responsible for opening port # 4949.
You can get more information about this process
(like memory used, users, current working directory and so on) visiting /proc/3772 directory:
# cd /proc/3772
# ls -l
Task: Display All TCP Sockets
# ss -t -a
Task: Display All UDP Sockets
# ss -u -a
Task: Display All Established SMTP Connections
# ss -o state established '( dport = :smtp or sport = :smtp )'
Task: Display All Established HTTP Connections
# ss -o state established '( dport = :http or sport = :http )'
Task: Find All Local Processes Connected To X Server
# ss -x src /tmp/.X11-unix/*
Task: List All The Tcp Sockets in State FIN-WAIT-1
List all the TCP sockets in state -FIN-WAIT-1 for our httpd to network 202.54.1/24
and look at their timers:
# ss -o state fin-wait-1 '( sport = :http or sport = :https )' dst 202.54.1/24
How Do I Filter Sockets Using TCP States?
如何过滤TCP socket的状态
The syntax is as follows:
## tcp ipv4 ##
ss -4 state FILTER-NAME-HERE
## tcp ipv6 ##
ss -6 state FILTER-NAME-HERE
Where FILTER-NAME-HERE can be any one of the following:
established
syn-sent
syn-recv
fin-wait-1
fin-wait-2
time-wait
closed
close-wait
last-ack
listen
closing
all : All of the above states
connected : All the states except for listen and closed
synchronized : All the connected states except for syn-sent
bucket : Show states, which are maintained as minisockets, i.e. time-wait and syn-recv.
big : Opposite to bucket state.
Examples
Type the following command to see closing sockets:
$ ss -4 state closing
Recv-Q Send-Q Local Address:Port Peer Address:Port
1 11094 75.126.153.214:http 175.44.24.85:4669
How Do I Matches Remote Address And Port Numbers?
查看访问远程地址的本机端口
Use the following syntax:
ss dst ADDRESS_PATTERN
## Show all ports connected from remote 192.168.1.5##
ss dst 192.168.1.5
## show all ports connected from remote 192.168.1.5:http port##
ss dst 192.168.1.5:http
ss dst 192.168.1.5:smtp
ss dst 192.168.1.5:443
Find out connection made by remote 123.1.2.100:http to our local virtual servers:
# ss dst 123.1.2.100:http
Sample outputs:
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 0 75.126.153.206:http 123.1.2.100:35710
ESTAB 0 0 75.126.153.206:http 123.1.2.100:35758
How Do I Matches Local Address And Port Numbers?
查看本机使用某个地址的匹配的端口
ss src ADDRESS_PATTERN
### find out all ips connected to nixcraft.com ip address 75.126.153.214 ###
## Show all ports connected to local 75.126.153.214##
ss src 75.126.153.214
## http (80) port only ##
ss src 75.126.153.214:http
ss src 75.126.153.214:80
## smtp (25) port only ##
ss src 75.126.153.214:smtp
ss src 75.126.153.214:25
How Do I Compare Local and/or Remote Port To A Number?
端口的数字化比较查询:
Use the following syntax:
## Compares remote port to a number ##
ss dport OP PORT
## Compares local port to a number ##
sport OP PORT
Where OP can be one of the following:
<= or le : Less than or equal to port
>= or ge : Greater than or equal to port
== or eq : Equal to port
!= or ne : Not equal to port
< or gt : Less than to port
> or lt : Greater than to port
Note: le, gt, eq, ne etc. are use in unix shell and are accepted as well.
Examples
###################################################################################
### Do not forget to escape special characters when typing them in command line ###
###################################################################################
ss sport = :http
ss dport = :http
ss dport \> :1024
ss sport \> :1024
ss sport \< :32000
ss sport eq :22
ss dport != :22
ss state connected sport = :http
ss \( sport = :http or sport = :https \)
ss -o state fin-wait-1 \( sport = :http or sport = :https \) dst 192.168.1/24
ss vs netstat Speed
Use the time command to run both programs and summarize system resource usage.
Type the netstat command as follows:
# time netstat -at
Sample outputs:
real 2m52.254s
user 0m0.178s
sys 0m0.170s
Now, try the ss command:
# time
Sample outputs:
real 2m11.102s
user 0m0.124s
sys 0m0.068s
Note: Both outputs are taken from reverse proxy acceleration server running on RHEL 6.x amd64.
Recommended readings:
See ss command help page.
十二、netstat - 网络相关信息
netstat可以显示网络链接、路由表信息、接口统计信息、伪装链接和多播成员(multicast memberships),
• Get Detailed Information About Particular IP address Connections Using netstat Command
http://www.cyberciti.biz/tips/netstat-command-tutorial-examples.html
netstat command and shell pipe feature can be used to dig out more information about particular
IP address connection. You can find out total established connections, closing connection,
SYN and FIN bits and much more. You can also display summary statistics for each protocol using netstat.
This is useful to find out if your server is under attack or not.
You can also list abusive IP address using this method.
查看服务器是否受到攻击,并找出攻击的IP
# netstat -nat | awk '{print $6}' | sort | uniq -c | sort -n
Output:
1 CLOSE_WAIT
1 established)
1 Foreign
3 FIN_WAIT1
3 LAST_ACK
13 ESTABLISHED
17 LISTEN
154 FIN_WAIT2
327 TIME_WAIT
Dig out more information about a specific ip address:
找出更多的信息:
# netstat -nat |grep {IP-address} | awk '{print $6}' | sort | uniq -c | sort -n
2 LAST_ACK
2 LISTEN
4 FIN_WAIT1
14 ESTABLISHED
91 TIME_WAIT
130 FIN_WAIT2
Busy server can give out more information:
# netstat -nat |grep 202.54.1.10 | awk '{print $6}' | sort | uniq -c | sort -n
Output:
15 CLOSE_WAIT
37 LAST_ACK
64 FIN_WAIT_1
65 FIN_WAIT_2
1251 TIME_WAIT
3597 SYN_SENT
5124 ESTABLISHED
Get List Of All Unique IP Address
To print list of all unique IP address connected to server, enter:
# netstat -nat | awk '{ print $5}' | cut -d: -f1 | sed -e '/^$/d' | uniq
To print total of all unique IP address, enter:
# netstat -nat | awk '{ print $5}' | cut -d: -f1 | sed -e '/^$/d' | uniq | wc -l
Output:
449
Find Out If Box is Under DoS Attack or Not
If you think your Linux box is under attack,
print out a list of open connections on your box and sorts them by according to IP address, enter:
# netstat -atun | awk '{print $5}' | cut -d: -f1 | sed -e '/^$/d' |sort | uniq -c | sort -n
Output:
1 10.0.77.52
2 10.1.11.3
4 12.109.42.21
6 12.191.136.3
.....
...
....
13 202.155.209.202
18 208.67.222.222
28 0.0.0.0
233 127.0.0.1
You can simply block all abusive IPs using iptables or just null route them.
使用iptables来做限制
Get Live View of TCP Connections
You can use tcptrack command to display the status of TCP connections that
it sees on a given network interface. tcptrack monitors their state and displays information
such as state, source/destination addresses and bandwidth usage in a sorted,
updated list very much like the top command.
Display Summary Statistics for Each Protocol
Simply use netstat -s:
# netstat -s | less
# netstat -t -s | less
# netstat -u -s | less
# netstat -w -s | less
# netstat -s
Output:
Ip:
88354557 total packets received
0 forwarded
0 incoming packets discarded
88104061 incoming packets delivered
96037391 requests sent out
13 outgoing packets dropped
66 fragments dropped after timeout
295 reassemblies required
106 packets reassembled ok
66 packet reassembles failed
34 fragments failed
Icmp:
18108 ICMP messages received
58 input ICMP message failed.
ICMP input histogram:
destination unreachable: 7173
timeout in transit: 472
redirects: 353
echo requests: 10096
28977 ICMP messages sent
0 ICMP messages failed
ICMP output histogram:
destination unreachable: 18881
echo replies: 10096
Tcp:
1202226 active connections openings
2706802 passive connection openings
7394 failed connection attempts
47018 connection resets received
23 connections established
87975383 segments received
95235730 segments send out
681174 segments retransmited
2044 bad segments received.
80805 resets sent
Udp:
92689 packets received
14611 packets to unknown port received.
0 packet receive errors
96755 packets sent
TcpExt:
48452 invalid SYN cookies received
7357 resets received for embryonic SYN_RECV sockets
43 ICMP packets dropped because they were out-of-window
5 ICMP packets dropped because socket was locked
2672073 TCP sockets finished time wait in fast timer
441 time wait sockets recycled by time stamp
368562 delayed acks sent
430 delayed acks further delayed because of locked socket
Quick ack mode was activated 36127 times
32318597 packets directly queued to recvmsg prequeue.
741479256 packets directly received from backlog
1502338990 packets directly received from prequeue
18343750 packets header predicted
10220683 packets header predicted and directly queued to user
17516622 acknowledgments not containing data received
36549771 predicted acknowledgments
102672 times recovered from packet loss due to fast retransmit
Detected reordering 1596 times using reno fast retransmit
Detected reordering 1 times using time stamp
8 congestion windows fully recovered
32 congestion windows partially recovered using Hoe heuristic
19 congestion windows recovered after partial ack
0 TCP data loss events
39951 timeouts after reno fast retransmit
29653 timeouts in loss state
197005 fast retransmits
186937 retransmits in slow start
131433 other TCP timeouts
TCPRenoRecoveryFail: 20217
147 times receiver scheduled too late for direct processing
29010 connections reset due to unexpected data
365 connections reset due to early user close
6979 connections aborted due to timeout
Display Interface Table
You can easily display dropped and total transmitted packets with netstat for eth0:
# netstat --interfaces eth0
Output:
Kernel Interface table
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0 1500 0 2040929 0 0 0 3850539 0 0 0 BMRU
十三、 iptraf - 网络实时信息
iptraf是一个可交互式的IP网络监控工具。它可以生成多种网络统计信息包括:
TCP信息、UDP数量、ICMP和OSPF信息、以太网负载信息、节点状态、IP校验错误等。
有下面几种信息格式:
• 不同网络TCP链接传输量
• 不同网络接口IP传输量
• 不同协议网络传输量
• 不同TCP/UDP端口和不同包大小网络传输量
• 不同第二层地址网络传输量
图02:一般接口信息:不同网络接口IP传输量
图03:不同网络TCP链接传输量
十三、tcpdump:详细的网络流量分析
tcpdump是一个简单网络流量转储工具,然而要使用好需要对TCP/IP协议非常熟悉。
例如要显示关于DNS的网络流量,输入:
# tcpdump -i eth1 'udp port 53'
显示所有进出80端口IPv4 HTTP包,也就是只打印包含数据的包。例如:SYN、FIN包和ACK-only包输入:
# tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
显示所有到的FTP会话,输入:
# tcpdump -i eth1 'dst 202.54.1.5 and (port 21 or 20'
显示所有到192.168.1.5的HTTP会话
# tcpdump -ni eth0 'dst 192.168.1.5 and tcp and port http'
用wireshark浏览转储文件中的详细信息,输入:
# tcpdump -n -i eth1 -s 0 -w output.txt src or dst port 80
十四、strace - 系统调用
追踪系统调用和型号,这对于调试Web服务器和其他服务器非常有用。了解怎样追踪进程和他功能。
十五、/proc文件系统 - 各种内核信息
/proc目录下文件提供了很多不同硬件设备和内核的详细信息。更多详情参见Linux kernel /proc。一般/proc例如:
# cat /proc/cpuinfo
# cat /proc/meminfo
# cat /proc/zoneinfo
# cat /proc/mounts
十六、Nagios - 服务器及网络监控
Nagios 是一款非常流行的系统及网络监控软件。
你可以轻松监控所有的主机、网络设备及服务。它能在发生故障和重新恢复后发送警讯。
FAN是"Fully Automated Nagios"的缩写。
FAN的目标就是由Nagios社群提供Nagios的安装。
为了使安装Nagios服务器更加容易,FAN提供一个标准ISO格 式的光盘镜像。
此发行版中还会包含一组增强用户使用体验的工具。
十七、Cacti - 基于Web的监控工具
Cacti是一套完成的网络图形化解决方案,基于RRDTool的资料存储和图形化功能。
Cacti提供一个快速的轮询器、进阶的图形化模板、多种 数据采集方法和用户管理功能。
All of this is wrapped in an intuitive, easy to use interface that makes sense for
LAN-sized installations up to complex networks with hundreds of devices.
它提供关于网络、CPU、内存、已登录用户、Apache、DNS等信息。
关于怎样在CentOS / RHEL安装配置Cacti,
详见:http://www.cyberciti.biz/faq/fedora-rhel-install-cacti- monitoring-rrd-software/
- linux网络工具应用详解之二
- linux网络工具应用详解之一
- linux下网络工具之tcpdump
- linux下网络工具之tcpdump
- Linux网络工具
- linux 网络工具
- linux 网络工具
- LINUX网络工具
- Linux 网络工具
- linux下网络工具之tcpdump精析
- linux下网络工具之netstat精析
- Linux常用网络工具:路由扫描之traceroute
- Android应用开发:网络工具——Volley(二)
- Android应用开发:网络工具——Volley(二)
- Android应用开发:网络工具——Volley(二)
- Android应用开发:网络工具——Volley(二)
- 网络工具的应用
- Linux常用网络工具:批量主机服务扫描之nmap
- 数据挖掘经典书籍
- 在Struts 2中实现文件上传
- 指向继承类的基类指针解引用后,是否还具备多态性
- 改进平滑滚动,修改音量调节级数实现音量微调【编译自XDA 适用于大部分设备】
- ARM架构kprobe应用及实现分析(1.0 简单示例)
- linux网络工具应用详解之二
- 十种心理征兆表明是时候辞职了
- qt 使用opengl库来画圆环
- android 中的 ViewFlipper 的简单使用
- Android系统的Binder机制之二——服务代理对象(1)
- 逆向编程教程(7)
- 网络通信的大端小端问题
- XML简单介绍
- ASP.NET的CMS代表作DNN7--这下默认界面总算是可以拿得出手了