网络工具netstat与ss

建议使用ss命令，2001年的时候netstat 1.42版本之后就没更新了，之后取代的工具是ss。netstat命令在很多场景下比较慢。ss可以显示跟netstat类似的信息，但是速度却比netstat快很多，netstat是基于/proc/net/tcp获取信息,而ss是直接从内核读取信息。

Recv-Q Send-Q

netstat与ss 都有这两列，特别重要的两组数据，看看这两列的说明
Recv-Q
Established: The count of bytes not copied by the user program connected to this socket.
Listening: Since Kernel 2.6.18 this column contains the current syn backlog.

Send-Q
Established: The count of bytes not acknowledged by the remote host.
Listening: Since Kernel 2.6.18 this column contains the maximum size of the syn backlog.

可以看到如果连接时Established状态
Recv-Q 指收到的数据还在缓存中，还没被进程读取，这个值就是还没被进程读取的 bytes
Send-Q 指发送队列中没有被远程主机确认的 bytes

如果连接时Listening状态的话
Recv-Q 指当前syn半连接队列的大小
Send-Q 指syn半连接的最大容量

这个就能推到出很多我们平常调试中甩锅的的情况
比如我们压测中，指标一直上不去，Send-Q 有积压，那么大概率是对方机器到瓶颈了，如果 Recv-Q 有积压，大概率是自己的机器有问题。或者在Listening状态下，Recv-Q 积压越来越多，可以相应放大半连接队列的大小。

netstat 命令

netstat -h
usage: netstat [-vWeenNcCF] [<Af>] -r         netstat {-V|--version|-h|--help}netstat [-vWnNcaeol] [<Socket> ...]netstat { [-vWeenNac] -I[<Iface>] | [-veenNac] -i | [-cnNe] -M | -s [-6tuw] } [delay]-r, --route              display routing table-I, --interfaces=<Iface> display interface table for <Iface>-i, --interfaces         display interface table-g, --groups             display multicast group memberships-s, --statistics         display networking statistics (like SNMP)-M, --masquerade         display masqueraded connections-v, --verbose            be verbose-W, --wide               don't truncate IP addresses-n, --numeric            don't resolve names--numeric-hosts          don't resolve host names--numeric-ports          don't resolve port names--numeric-users          don't resolve user names-N, --symbolic           resolve hardware names-e, --extend             display other/more information-p, --programs           display PID/Program name for sockets-o, --timers             display timers-c, --continuous         continuous listing-l, --listening          display listening server sockets-a, --all                display all sockets (default: connected)-F, --fib                display Forwarding Information Base (default)-C, --cache              display routing cache instead of FIB-Z, --context            display SELinux security context for sockets

经常使用的 netstat -altp
a 显示所有的链接
l 显示listening状态的链接
t 仅显示TCP
p 显示PID和项目名

ss 命令

ss -h
Usage: ss [ OPTIONS ]ss [ OPTIONS ] [ FILTER ]-h, --help          this message-V, --version       output version information-n, --numeric       don't resolve service names-r, --resolve       resolve host names-a, --all           display all sockets-l, --listening     display listening sockets-o, --options       show timer information-e, --extended      show detailed socket information-m, --memory        show socket memory usage-p, --processes     show process using socket-i, --info          show internal TCP information-s, --summary       show socket usage summary-b, --bpf           show bpf filter socket information-E, --events        continually display sockets as they are destroyed-Z, --context       display process SELinux security contexts-z, --contexts      display process and socket SELinux security contexts-N, --net           switch to the specified network namespace name-4, --ipv4          display only IP version 4 sockets-6, --ipv6          display only IP version 6 sockets-0, --packet        display PACKET sockets-t, --tcp           display only TCP sockets-S, --sctp          display only SCTP sockets-u, --udp           display only UDP sockets-d, --dccp          display only DCCP sockets-w, --raw           display only RAW sockets-x, --unix          display only Unix domain sockets--vsock         display only vsock sockets-f, --family=FAMILY display sockets of type FAMILYFAMILY := {inet|inet6|link|unix|netlink|vsock|help}-K, --kill          forcibly close sockets, display what was closed-H, --no-header     Suppress header line-A, --query=QUERY, --socket=QUERYQUERY := {all|inet|tcp|udp|raw|unix|unix_dgram|unix_stream|unix_seqpacket|packet|netlink|vsock_stream|vsock_dgram}[,QUERY]-D, --diag=FILE     Dump raw information about TCP sockets to FILE-F, --filter=FILE   read filter information from FILEFILTER := [ state STATE-FILTER ] [ EXPRESSION ]STATE-FILTER := {all|connected|synchronized|bucket|big|TCP-STATES}TCP-STATES := {established|syn-sent|syn-recv|fin-wait-{1,2}|time-wait|closed|close-wait|last-ack|listen|closing}connected := {established|syn-sent|syn-recv|fin-wait-{1,2}|time-wait|close-wait|last-ack|closing}synchronized := {established|syn-recv|fin-wait-{1,2}|time-wait|close-wait|last-ack|closing}bucket := {syn-recv|time-wait}big := {established|syn-sent|fin-wait-{1,2}|closed|close-wait|last-ack|listen|closing}

经常使用的 ss -lnt
l 显示listening状态的链接
t 仅显示TCP
n 不要解析服务名称