netstat Recv-Q和Send-Q

通过netstat -anp可以查看机器的当前连接状态:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0  *               LISTEN      -               
tcp        0      0   *               LISTEN      -               
tcp        0      0 *               LISTEN      -               
tcp        0      0  *               LISTEN      -               
tcp        0      0  *               LISTEN      -               
tcp6       0    910        ESTABLISHED 7072/java       
tcp6       0      0        ESTABLISHED 7072/java       
tcp6       0    914        ESTABLISHED 7072/java       
tcp6       0    910        ESTABLISHED 7072/java       
tcp6       0      0        ESTABLISHED 7072/java       
tcp6       0      0        ESTABLISHED 7072/java 

对proto,localAddress等都比较好理解,其中Recv-Q Send-Q具体是什么含义呢?为什么Send-Q时长不为0呢?不为0是不是表示网络出口阻塞了呢?针对这个问题查了下相关资料。

What It Means
"Proto" is short for protocol, which is either TCP or UDP. "Recv-Q" and "Send-Q" mean receiving queue and sending queue. These should always be zero; if they're not you might have a problem. Packets should not be piling up in either queue, except briefly, as this example shows: 
tcp 0 593 ESTABLISHED 
That happened when I hit the "check mail" button in KMail; a brief queuing of outgoing packets is normal behavior. If the receiving queue is consistently jamming up, you might be experiencing a denial-of-service attack. If the sending queue does not clear quickly, you might have an application that is sending them out too fast, or the receiver cannot accept them quickly enough. 
"Local address" is either your IP and port number, or IP and the name of a service. "Foreign address" is the hostname and service you are connected to. The asterisk is a placeholder for IP addresses, which of course cannot be known until a remote host connects. "State" is the current status of the connection. Any TCP state can be displayed here, but these three are the ones you want to see。

Recv-Q Send-Q分别表示网络接收队列,发送队列。Q是Queue的缩写。


如果接收队列Recv-Q一直处于阻塞状态,可能是遭受了拒绝服务 denial-of-service 攻击。