流量显示服务器异常,怀疑服务器存在异常流量排查日记，使用ifconfig，nethogs等命令...

怀疑服务器存在异常流量排查日记

一、用ifconfig查看网卡流量

root@AP ~]# ifconfig

eth4 Link encap:Ethernet HWaddr 00:50:56:0A:A6:E9

inet addr:192.168.1.91 Bcast:192.168.1.255 Mask:255.255.255.0

inet6 addr: fa70::220:58af:faba:6e8/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:21148074982 errors:0 dropped:0 overruns:0 frame:0

TX packets:21944211957 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:7069850347226 (6.4 TiB) TX bytes:8936760647131 (8.1 TiB)

lo Link encap:Local Loopback

inet addr:127.0.0.1 Mask:255.0.0.0

inet6 addr: ::1/128 Scope:Host

UP LOOPBACK RUNNING MTU:16436 Metric:1

RX packets:13894306 errors:0 dropped:0 overruns:0 frame:0

TX packets:13894306 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:0

RX bytes:6506280062 (6.0 GiB) TX bytes:6506280062 (6.0 GiB)

virbr0 Link encap:Ethernet HWaddr 52:34:40:A1:04:BF

inet addr:192.168.122.1 Bcast:192.168.122.255 Mask:255.255.255.0

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:0 errors:0 dropped:0 overruns:0 frame:0

TX packets:26979 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:0

RX bytes:0 (0.0 b) TX bytes:1243664 (1.1 MiB)

2、安装

[root@AP yum.repos.d]# cd /tmp

[root@AP tmp]# rpm -ivh nethogs-0.8.5-1.el6.x86_64.rpm

warning: nethogs-0.8.5-1.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID 0608b895: NOKEY

Preparing... ########################################### [100%]

1:nethogs ########################################### [100%]

[root@AP tmp]#

NetHogs使用

[root@AP tmp]# nethogs

NetHogs提供交互式控制指令：

m : Cycle between display modes (kb/s, kb, b, mb) 切换网速显示单位

r : Sort by received. 按接收流量排序

s : Sort by sent. 按发送流量排序

q : Quit and return to the shell prompt. 退出NetHogs命令工具

三、找到进程ID后进一步查进程信息

[root@AP ~]# ps -fe|grep 29640

root 9660 9385 0 17:03 pts/4 00:00:00 grep 29640

root 29640 1 52 10:13 pts/3 03:36:56 /usr/java/jdk1.7.0_79/bin/java -server -XX:PermSize=256m -XX:MaxPermSize=512m -Djetty.state=/home/jetty-distribution-7.6.16.v20170903/jetty.state -Djetty.home=/home/jetty-distribution-7.6.16.v20170903 -Djava.io.tmpdir=/tmp -jar /home/jetty-distribution-7.6.16.v20170903/start.jar etc/jetty-logging.xml etc/jetty-started.xml

[root@AP ~]#