linux统计ip数据包,如何在Linux上显示网络接口数据包统计信息

在Linux系统上，我们可以通过 [ip] , [netstat] 或者 [ethtool] 命令显示网络接口丢弃数据包的统计信息。接下来我们看看如何使用每个命令。

使用netstat按接口显示数据包

其实 [netstat] 命令已经过时，可使用命令 [ip] 和 [ss] 来代替。但是 [netstat] 依然在一些旧的Linux分发版本上可用，因此在 ip/ss 不可用的情况，我们可以使用netstat，其语法如下

netstat -i

netstat --interfaces

例如

~$ netstat -i

Kernel Interface table

Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg

docker0 1500 0 188180 0 0 0 151852 0 0 0 BMRU

eth0 1500 0 472368 0 0 0 375351 0 0 0 BMRU

lo 65536 0 51687 0 0 0 51687 0 0 0 LRU

vethc8f46ea 1500 0 136984 0 0 0 79587 0 0 0 BMRU

如果想显示每种协议的概要统计信息，可以执行

netstat -s

netstat --statistics

例如

$ netstat -s

Ip:

527622 total packets received

19 with invalid addresses

329762 forwarded

0 incoming packets discarded

191137 incoming packets delivered

568337 requests sent out

Icmp:

8 ICMP messages received

8 input ICMP message failed.

ICMP input histogram:

destination unreachable: 7

timeout in transit: 1

5 ICMP messages sent

0 ICMP messages failed

ICMP output histogram:

destination unreachable: 5

IcmpMsg:

InType3: 7

InType11: 1

OutType3: 5

Tcp:

2509 active connections openings

26 passive connection openings

748 failed connection attempts

14 connection resets received

4 connections established

182968 segments received

241886 segments send out

72 segments retransmited

279 bad segments received.

1844 resets sent

InCsumErrors: 279

Udp:

8067 packets received

5 packets to unknown port received.

0 packet receive errors

11440 packets sent

只显示tcp的信息

netstat -s -t

netstat --statistics --tcp

只显示udp的信息

netstat -s -u

netstat --statistics --udp

使用ip命令显示网络接口数据包信息

如果要显示所有接口的统计信息，命令如下

ip -s link

如果要显示某一个接口的，则制定接口名

ip -s link show {interface}

例如

$ ip -s link show eth0

2: eth0: mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000

link/ether 00:16:3e:02:c8:e3 brd ff:ff:ff:ff:ff:ff

RX: bytes packets errors dropped overrun mcast

377786943 473945 0 0 0 0

TX: bytes packets errors dropped carrier collsns

266024587 377467 0 0 0 0

RX指示了接收的数据包，TX指示了发送的数据包。

使用ethtool命令查询指定网络接口的信息

可以使用 -S 或者 --statistics 选项来显示统计信息，语法如下

ethtool -S {device}

例如

❯ ethtool -S wlan1

NIC statistics:

rx_packets: 487703

rx_bytes: 207474712

rx_duplicates: 180

rx_fragments: 487682

rx_dropped: 19952

tx_packets: 141579

tx_bytes: 34804215

tx_filtered: 0

tx_retry_failed: 0

tx_retries: 19541

sta_state: 4

txrate: 400000000

rxrate: 360000000

signal: 201

channel: 0

noise: 18446744073709551615

ch_time: 18446744073709551615

ch_time_busy: 18446744073709551615

ch_time_ext_busy: 18446744073709551615

ch_time_rx: 18446744073709551615

ch_time_tx: 18446744073709551615

还可以直接使用cat或者column命令来查询 /proc/net/dev 文件，例如

❯ column -t /proc/net/dev

Inter-| Receive | Transmit

face |bytes packets errs drop fifo frame compressed multicast|bytes packets errs drop fifo colls carrier compressed

lo: 230352757 1201722 0 0 0 0 0 0 230352757 1201722 0 0 0 0 0 0

eth0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

wlan1: 1346770664 2865963 0 14 0 0 0 0 282983658 1154942 0 0 0 0 0 0

br-13cb4d22d1c8: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

br-44561b4ee062: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

br-70b0dad49865: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

docker0: 6824830 44848 0 0 0 0 0 0 133304965 47104 0 0 0 0 0 0

vetheb8b528: 2360070 13321 0 0 0 0 0 0 60431688 18817 0 0 0 0 0 0

vetha4dc663: 461283 2464 0 0 0 0 0 0 2981558 2302 0 0 0 0 0 0

补充：如何诊断数据包丢弃的原因

发现网络数据有被丢弃的请，想找出原因，这里介绍一个工具 dropwath。

首先使用需要自己编译安装该工具，下面示例在Ubuntu上编译安装：

sudo apt-get install libpcap-dev libnl-3-dev libnl-genl-3-dev binutils-dev libreadline6-dev autoconf libtool pkg-config build-essential

git clone https://github.com/nhorman/dropwatch.git

cd dropwatch

./autogen.sh

./configure

make

make install

然后可以运行dropwatch进行监控

$ dropwatch -l kas

Initializing kallsyms db

dropwatch> help

Command Syntax:

exit - Quit dropwatch

help - Display this message

set:

alertlimit - capture only this many alert packets

alertmode - set mode to "summary" or "packet"

trunc - truncate packets to this length. Only applicable when "alertmode" is set to "packet"

queue - queue up to this many packets in the kernel. Only applicable when "alertmode" is set to "packet"

sw - monitor software drops

hw - monitor hardware drops

start - start capture

stop - stop capture

show - show existing configuration

stats - show statistics

dropwatch>

还可以通过 [tcpdump] 进行网络抓包，然后使用 [wireshark] 来进行分析。