1. 程式人生 > >netstat的Recv-Q和Send-Q

netstat的Recv-Q和Send-Q

通過netstat -anp可以檢視機器的當前連線狀態:

Active Internet connections (servers and established)

Proto Recv-Q Send-Q Local Address          Foreign Address         State      PID/Program name

tcp        0      00.0.0.0:8139            0.0.0.0:*              LISTEN      -              

tcp        0      0 0.0.0.0:111            0.0.0.0:*              LISTEN      -              

tcp        0      00.0.0.0:26837           0.0.0.0:*              LISTEN      -              

tcp        0      00.0.0.0:1046            0.0.0.0:*              LISTEN      -              

tcp        0      0127.0.0.1:25            0.0.0.0:*              LISTEN      -              

tcp6       0    910 10.100.83.145:57142    10.100.83.140:80        ESTABLISHED 7072/java      

tcp6       0      010.100.83.145:57114     10.100.83.140:80       ESTABLISHED 7072/java       

tcp6       0    914 10.100.83.145:57117    10.100.83.140:80        ESTABLISHED 7072/java      

tcp6       0    910 10.100.83.145:57126    10.100.83.140:80        ESTABLISHED 7072/java      

tcp6       0      010.100.83.145:57159     10.100.83.140:80       ESTABLISHED 7072/java       

tcp6       0      010.100.83.145:57128     10.100.83.140:80       ESTABLISHED 7072/java 

 

一個較詳細的解釋是

WhatIt Means

"Proto"is short for protocol, which is either TCP or UDP. "Recv-Q" and"Send-Q" mean receiving queue and sending queue. These should alwaysbe zero; if they're not you might have a problem. Packets should not be pilingup in either queue, except briefly, as this example shows: 

tcp 0593 192.168.1.5:34321 venus.euao.com:smtp ESTABLISHED 

Thathappened when I hit the "check mail" button in KMail; a brief queuingof outgoing packets is normal behavior. If the receiving queue is consistentlyjamming up, you might be experiencing a denial-of-service attack. If thesending queue does not clear quickly, you might have an application that issending them out too fast, or the receiver cannot accept them quicklyenough. 

"Localaddress" is either your IP and port number, or IP and the name of aservice. "Foreign address" is the hostname and service you areconnected to. The asterisk is a placeholder for IP addresses, which of coursecannot be known until a remote host connects. "State" is the currentstatus of the connection. Any TCP state can be displayed here, but these threeare the ones you want to see.

 

大致的意思是

Recv-Q Send-Q分別表示網路接收佇列,傳送佇列。QQueue的縮寫。

這兩個值通常應該為0,如果不為0可能是有問題的。packets在兩個佇列裡都不應該有堆積狀態。可接受短暫的非0情況。如文中的示例,短暫的Send-Q佇列傳送packets0是正常狀態。

如果接收佇列Recv-Q一直處於阻塞狀態,可能是遭受了拒絕服務 denial-of-service 攻擊。

如果傳送佇列Send-Q不能很快的清零,可能是有應用向外傳送資料包過快,或者是對方接收資料包不夠快。

Recv-Q:表示收到的資料已經在本地接收緩衝,但是還有多少沒有被程序取走

Send-Q:對方沒有收到的資料或者說沒有Ack,還是本地緩衝區。

通過netstat的這兩個值就可以簡單判斷程式收不到包到底是包沒到還是包沒有被程序接收