netstat 与 ss

建议使用 ss 命令，2001 年的时候 netstat 1.42 版本之后就没更新了，之后取代的工具是 ss。netstat 命令在很多场景下比较慢。ss 可以显示跟 netstat 类似的信息，但是速度却比 netstat 快很多，netstat 是基于/proc/net/tcp 获取 信息,而 ss 是直接从内核读取信息。

Recv-Q Send-Q

netstat 与 ss 都有这两列，特别重要的两组数据，看看这两列的说明 Recv-QEstablished: The count of bytes not copied by the user program connected to this socket.Listening: Since Kernel 2.6.18 this column contains the current syn backlog.

Send-QEstablished: The count of bytes not acknowledged by the remote host.Listening: Since Kernel 2.6.18 this column contains the maximum size of the syn backlog.

可以看到如果连接时 Established 状态 Recv-Q 指收到的数据还在缓存中，还没被进程读取，这个值就是还没被进程读取的 bytesSend-Q 指发送队列中没有被远程主机确认的 bytes

如果连接时 Listening 状态的话 Recv-Q 指当前 syn 半连接队列的大小 Send-Q 指 syn 半连接的最大容量

这个就能推到出很多我们平常调试中甩锅的的情况比如我们压测中，指标一直上不去，Send-Q 有积压，那么大概率是对方机器到瓶颈了，如果 Recv-Q 有积压，大概率是自己的机器有问题。或者在 Listening 状态下，Recv-Q 积压越来越多，可以相应放大半连接队列的大小。

netstat 命令

netstat -husage: netstat [-vWeenNcCF] [<Af>] -r netstat {-V|--version|-h|--help}netstat [-vWnNcaeol] [<Socket> ...]netstat { [-vWeenNac] -I[<Iface>] | [-veenNac] -i | [-cnNe] -M | -s [-6tuw] } [delay]

    -r, --route              display routing table    -I, --interfaces=<Iface> display interface table for <Iface>    -i, --interfaces         display interface table    -g, --groups             display multicast group memberships    -s, --statistics         display networking statistics (like SNMP)    -M, --masquerade         display masqueraded connections
    -v, --verbose            be verbose    -W, --wide               don't truncate IP addresses    -n, --numeric            don't resolve names    --numeric-hosts          don't resolve host names    --numeric-ports          don't resolve port names    --numeric-users          don't resolve user names    -N, --symbolic           resolve hardware names    -e, --extend             display other/more information    -p, --programs           display PID/Program name for sockets    -o, --timers             display timers    -c, --continuous         continuous listing
    -l, --listening          display listening server sockets    -a, --all                display all sockets (default: connected)    -F, --fib                display Forwarding Information Base (default)    -C, --cache              display routing cache instead of FIB    -Z, --context            display SELinux security context for sockets

经常使用的 netstat -altpa 显示所有的链接 l 显示 listening 状态的链接 t 仅显示 TCPp 显示 PID 和项目名

ss 命令

ss -hUsage: ss [ OPTIONS ]ss [ OPTIONS ] [ FILTER ]-h, --help this message-V, --version output version information-n, --numeric don't resolve service names-r, --resolve resolve host names-a, --all display all sockets-l, --listening display listening sockets-o, --options show timer information-e, --extended show detailed socket information-m, --memory show socket memory usage-p, --processes show process using socket-i, --info show internal TCP information-s, --summary show socket usage summary-b, --bpf show bpf filter socket information-E, --events continually display sockets as they are destroyed-Z, --context display process SELinux security contexts-z, --contexts display process and socket SELinux security contexts-N, --net switch to the specified network namespace name

-4, --ipv4 display only IP version 4 sockets-6, --ipv6 display only IP version 6 sockets-0, --packet display PACKET sockets-t, --tcp display only TCP sockets-S, --sctp display only SCTP sockets-u, --udp display only UDP sockets-d, --dccp display only DCCP sockets-w, --raw display only RAW sockets-x, --unix display only Unix domain sockets--vsock display only vsock sockets-f, --family=FAMILY display sockets of type FAMILYFAMILY := {inet|inet6|link|unix|netlink|vsock|help}

-K, --kill forcibly close sockets, display what was closed-H, --no-header Suppress header line

-A, --query=QUERY, --socket=QUERYQUERY := {all|inet|tcp|udp|raw|unix|unix_dgram|unix_stream|unix_seqpacket|packet|netlink|vsock_stream|vsock_dgram}[,QUERY]

-D, --diag=FILE Dump raw information about TCP sockets to FILE-F, --filter=FILE read filter information from FILEFILTER := [ state STATE-FILTER ] [ EXPRESSION ]STATE-FILTER := {all|connected|synchronized|bucket|big|TCP-STATES}TCP-STATES := {established|syn-sent|syn-recv|fin-wait-{1,2}|time-wait|closed|close-wait|last-ack|listen|closing}connected := {established|syn-sent|syn-recv|fin-wait-{1,2}|time-wait|close-wait|last-ack|closing}synchronized := {established|syn-recv|fin-wait-{1,2}|time-wait|close-wait|last-ack|closing}bucket := {syn-recv|time-wait}big := {established|syn-sent|fin-wait-{1,2}|closed|close-wait|last-ack|listen|closing}

经常使用的 ss -lntl 显示 listening 状态的链接 t 仅显示 TCPn 不要解析服务名称