命令

常用命令
抓包

• sudo tcpdump -i bond0 -s0 host 106.48.52.51 and port 23456 -nvvv -XX -A
• sudo tcpdump -i eth0 host 172.17.39.8 or host 223.202.197.8 -nvvv -s0 -w jdx.pcap

访问

• curl -vo hls0aa.file --local-port 23456 ‘url’ --resolve audio.itunes.apple.com:80:106.48.52.51 --range 0-2047 -H ‘hostHeader:audio.itunes.apple.com’ -H ‘x-c3-debug:enabled’ -H ‘user-agent:ChinaCache-NOC’

查询30分钟内被访问最多的源站ip

• cclog hpc access 30m|awk ‘{print $9}’ |sort |uniq -c |sort -rn |tail -20

测试30次源站的状态码
for ((i=1;i<31;i++));do curl -I -m 10 -o /dev/null -s -w %{http_code}"\n" http://xxxx -x 152.70.40.23:80;done
-x 代理

查看时间戳

• date -d @“1560066310”

查看201906091300 201906091700 13点到17点中异常状态码最多的IP（也可以直接写分 时）

• cclog hpc access 201906091300 201906091700 |awk ‘$7~“http://m.chn.lottedfs.cn”&& $4~"/50"{print $9}’|sort|uniq -c |sort -rn

• cclog hpc access 201906091300 201906091305 |awk ‘$7_{"http://m.chn.lottedfs.cn"&&$9}"152.70.40.21"{print $4}’|sort|uniq -c

1小时内这个域名的状态码数量

• cclog hpc access 1h | grep https://mob-t0.ete.cathaypacific.com | awk ‘{print $4}’ | sort | uniq -c | sort -nr | head

测试url返回状态码

• while true;do curl -so /dev/null -w "date +%F\ %T %{http_code}\n" url --resolve assets-origin.itunes.apple.com:80:117.149.250.128 -r 0-0; sleep 2;done

• curl -ksvo /dev/null -H “host:book.cathaypacific.com” https://106.48.55.38/CathayPacificV3/dyn/air/booking/%7B%7BstaticFilesPath%7D%7Dbooking/skin/img/social-login/icon-twitter.png

没有reslvoed测试，设备curl版本不同

• while true;do curl -so /dev/null -k -H “Host: book.cathaypacific.com” -w "date +%F\ %T %{http_code}\n"
  https://book.cathaypacific.com/CathayPacificV3/dyn/air/booking/%7B%7BstaticFilesPath%7D%7Dbooking/skin/img/social-login/icon-wechat.png ;done

• cclog hpc access 5m|awk ‘$7_{"iosapps.itunes"&&$4}"TCP_MISS/403"{a++;split($7,t,/[_=]/);b=t[2]>$1?“not_expired”:“expired”;s[b]++}END{for(i in s){print i,s[i]};print "total "a}’

输出说明：

• expired url过期数量
• total 403请求总数
• not_expired url未过期但响应状态码是403

筛选url

• awk {‘print $5" "$7’} |awk -F / {‘print $1"//"$3"/"’} | awk ‘{sums[$2] += $1} END { for (i in sums) printf("%s %s\n", sums[i], i)}’ | sort -r -n -k1 | head|awk ‘{a[NR]=$2;x+=(b[NR]=$1)}END{while(++i<=NR)print 100*b[i]/x"%",b[i]/1024/1024"M",a[i]}’|column -t

域名回源验证方法 ：more /usr/local/squid/etc/origin_domain_ip |grep 域名
统计状态码数量：

cclog hpc access 72h |awk '{num[$4]++}END{for(i in num)print num[i],i}' |sort -nr | head

统计访问url次数：

cclog hpc access 5m |awk '{num[$7]++}END{for(i in num)print num[i],i}' |sort -nr | head

5分钟内域名出现403的次数

 cclog hpc access 5m|awk '$7~"iosapps.itunes"&&$4~"TCP_MISS/403"{a++;split($7,t,/[_=]/);b=t[2]>$1?"not_expired":"expired";s[b]++}END{for(i in s){print i,s[i]};print "total "a}' 

状态码比率：

cclog hpc access 20190823 | awk '$7~"updates-http.cdn-apple.com"&&$4~"/403"' | awk '{ print $7}' | sort | uniq -c | sort -k1nr | head -n20 | awk '{ astrChannel[NR]=$2; nErrSum+=(anChnlErrTotal[NR]=$1); } \
BEGIN { printf("Ratio\trequests\tStaus\n--------\t------------\t------------------------------------------------------------------------------\n"); }
END { while(++nChnlIdx<=NR) printf("%.2f%%\t%d\t%s\n", 100*anChnlErrTotal[nChnlIdx]/nErrSum,anChnlErrTotal[nChnlIdx],astrChannel[nChnlIdx] ); }' | column -t

设备比率：

cclog hpc access 10m  |awk -F "|" '{print $2}'|sort|sort -rn| uniq -c | sort -k1nr | head -n20 | awk '{ astrChannel[NR]=$2; nErrSum+=(anChnlErrTotal[NR]=$1); } \
BEGIN { printf("Ratio\trequests\tStaus\n--------\t------------\t------------------------------------------------------------------------------\n"); }
END { while(++nChnlIdx<=NR) printf("%.2f%%\t%d\t%s\n", 100*anChnlErrTotal[nChnlIdx]/nErrSum,anChnlErrTotal[nChnlIdx],astrChannel[nChnlIdx] ); }' | column -t

当前设备流量来源：

cclog hpc access 5m|awk -F 'cc_info=|[ ]+' '{split($(NF-4),a,"|");s[a[2]]++;t[a[2]]+=$5}END{for(i in s){printf("%-15s%-6d%-10s\n",i,s[i],t[i])}}'|sort -k3nr|head -30

当前设备流量排名：

cclog hpc access 10m|awk 'BEGIN{printf("%-50s%-20s%-20s%-20s%-20s\n","ChannelName","SumOfTraffic","TrafficRatio","CountOfRequests","CountRatio")}{split($7,url,"/");h=url[1]"//"url[3];s[h]+=$5;a+=$5;c[h]++;b++}END{for(i in s)printf("%-50s%-20.3e%-20.2f%-20d%-20.2f\n",i,s[i],s[i]*100/a,c[i],c[i]*100/b) |"sort -r -g -k2 |head -20"}'

配置文件：

vim /Application/SSR/GHR/conf/default.conf
grep 'node_bandwidth=' /Application/SSR/GHR/conf/default.conf

启动：

/Application/SSR/GHR/sbin/lighttpd -f /Application/SSR/GHR/conf/lighttpd.conf
#node_bandwidth=http://imp.chinacache.com:8900/api/v3.0/query_node_bandwidth
node_bandwidth=DEV:bond0

sed -i 's/node_bandwidth/#node_bandwidth/g' /Application/SSR/GHR/conf/default.conf
sed -i 's/#node_bandwidth=DEV:bond0/node_bandwidth=DEV:bond0/g' /Application/SSR/GHR/conf/default.conf

查看已经delete状态的文件，杀掉对应的进程号，即可释放(文件僵死)
lsof |grep delete

推送命令：

curl -X GET http://bsp.v3.gslb.cdnservice.cn:9999/ghrconfig/tonameid/rels/put/ -H "Content-Type:application/json" \
-d '[{
    "nameid": "act-dl-1-iosapps.ccgslb.com.cn",
    "node_name": "ACT-DL-1-CLOUD"
  }]' 

ab压力测试工具：

ab   -n10000 -c 500 -H "iosapps.itunes.apple.com"  "url"