Linux系統上的網絡工具甚多，如何根據實際需要選擇稱手的工具呢？在此作一個簡單介紹：
觀察網絡流量：
“sar -n DEV 1 5” 可以統計每個網卡上的網絡流速：
# sar -n DEV 2 5
...
02:47:12PM IFACE rxpck/s txpck/s rxkB/s txkB/s rxcmp/s txcmp/s rxmcst/s
02:47:14PM lo 0.00 0.00 0.00 0.00 0.00 0.00 0.00
02:47:14PM eth0 2.51 0.00 0.17 0.00 0.00 0.00 0.00
...
ptraf 是觀察網絡流速的強力工具，它可以讓你的觀察逐步深入，從硬件層（網卡），到網絡層（IPv4，IPv6），到傳輸層（TCP，UDP etc.），一直到每一對socket pair。
iptraf-d
觀察網絡連接的狀態：
“netstat -a“
這是傳統的工具，但是它無力處理海量的網絡連接。所以在大規模網絡連接的主機上，建議使用ss。
1
2
3
4
5
6
7 # netstat -a
Active Internet connections(servers andestablished)
Proto Recv-QSend-QLocal Address Foreign Address State
tcp 0 0*:mysql *:* LISTEN
tcp 0 0*:5901 *:* LISTEN
...
tcp 0 104bj71s060.chn.hp.com:ssh 16.169.16.67:52681 ESTABLISHED
“ss -a” 列出所有的網絡連接。ss特別適合海量連接的主機。
如果加上”-p”選項，還可以顯示對應的進程號。
# ss -a
State Recv-QSend-Q Local Address:Port Peer Address:Port
LISTEN 0 50 *:mysql *:*
LISTEN 0 5 *:5901 *:*
...
LISTEN 0 128 :::38246 :::*
ESTAB 0 184 16.187.252.58:ssh 16.169.16.67:52681
觀察靜態統計值：
“netstat -i“
# netstat -i
Kernel Interfacetable
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0 1500 0572421962 0 0 016831237 0 0 0BMRU
lo 16436 0 556534 0 0 0 556534 0 0 0LRU
ifconfig 可以看到網卡層面的少量統計值，packet數量，collision，errors等：
# ifconfig eth0
eth0 Link encap:Ethernet HWaddr00:19:BB:5B:07:34
inet addr:16.187.252.58 Bcast:16.187.255.255 Mask:255.255.252.0
inet6 addr:fe80::219:bbff:fe5b:734/64Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:572422657errors:0dropped:0overruns:0frame:0
TX packets:16831252errors:0dropped:0overruns:0carrier:0
collisions:0txqueuelen:1000
RX bytes:50512945748(47.0GiB) TX bytes:11194760435(10.4GiB)
Interrupt:19Memory:f0500000-f0520000
“ip -s link” 看到的信息基本類似：
# ip -s link
1:lo:<LOOPBACK,UP,LOWER_UP>mtu16436qdisc noqueue state UNKNOWN
link/loopback00:00:00:00:00:00brd00:00:00:00:00:00
RX:bytes packets errors dropped overrun mcast
2255610398556534 0 0 0 0
TX:bytes packets errors dropped carrier collsns
2255610398556534 0 0 0 0
2:eth0:<BROADCAST,MULTICAST,UP,LOWER_UP>mtu1500qdisc pfifo_fast state UP qlen1000
link/ether00:19:bb:5b:07:34brd ff:ff:ff:ff:ff:ff
RX:bytes packets errors dropped overrun mcast
32683320875724229790 0 0 16733497
TX:bytes packets errors dropped carrier collsns
2604833405168312850 0 0 0
“netstat -s” 提供了各個協議下的統計信息，有些統計值比如retransmit是很有用的，只有 “netstat -s” 能看到：
# netstat -s
...
Tcp:
71479active connections openings
7181passive connection openings
13723failed connection attempts
407connection resets received
1connections established
18969163segments received
11210435segments send out
85883segments retransmited
0bad segments received.
80162resets sent
...
475fast retransmits
30forward retransmits
110retransmits inslow start
22772other TCP timeouts
5sack retransmits failed
...
