一台Linux这两天不停往外发包，造成外部无法访问。
[root@ct-nat ~]# watch ifconfig-------------查看数据包新增情况
Every 2.0s: ifconfig Thu Jun 5 14:24:14 2014
eth0 Link encap:Ethernet HWaddr 00:18:FE:FA:C3:42
inet addr:124.14.10.68 Bcast:124.14.10.71 Mask:255.255.255.248
inet6 addr: fe80::218:feff:fefa:c342/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1665533 errors:0 dropped:0 overruns:0 frame:0
TX packets:73298941 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1547042409 (1.4 GiB) TX bytes:803948852 (766.7 MiB)
Interrupt:169 Memory:dc200000-dc210000
eth1 Link encap:Ethernet HWaddr 00:18:FE:FA:C3:43
inet addr:118.26.96.1 Bcast:118.26.96.255 Mask:255.255.255.0
inet6 addr: fe80::218:feff:fefa:c343/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1568748 errors:0 dropped:0 overruns:0 frame:0
TX packets:1634074 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1067734779 (1018.2 MiB) TX bytes:1544805241 (1.4 GiB)
Interrupt:82 Memory:dc300000-dc310000
[root@ct-nat ~]# ifstat－－－－查看网卡流量
eth0 eth1
KB/s in KB/s out KB/s in KB/s out
407.34 154.99 134.96 324.29
274.08 191.48 210.72 248.32
240.20 192.91 257.22 179.06
136.48 236.72 203.89 179.84
243.03 198.90 221.65 241.85
198.83 281.42 271.65 195.79
820.90 247.96 254.28 791.47
109.24 226.05 208.80 94.16
311.23 190.03 190.82 523.41
394.65 216.71 215.69 284.40
651.62 232.83 196.13 599.50
147.94 162.41 199.19 102.64
119.03 222.98 210.04 135.29
214.74 132.68 80.85 227.86
286.41 75.55 88.74 386.44
321.54 91.63 120.95 228.31
146.83 221.96 407.25 124.37
[root@ct-nat ~]# nload－－－－－－－以流量图显示
Device eth0 [124.14.10.68] (1/4):
==================================================================================================
Incoming:
||
##
##
##
##
##|| ##
#### | ## ..
#### # ## ##
## |##### ## # ## .. ## Curr: 439.54 kBit/s
## .. ###### ## #. ##.. ## ####|| ## Avg: 1.88 MBit/s
## ..## ## ######|| ##### #### ##.. ###### ## Min: 0.00 Bit/s
## #### ||## ######## #####..#### ..#### ######||..||## Max: 8.05 MBit/s
########## ######.. #########################||######||||##############... Ttl: 1.65 GByte
Outgoing:
........||
.. ############
## ..############
## ################
||##..################ Curr: 1.00 MBit/s
| ###################### Avg: 2.16 MBit/s
.. ........ .... # ######################.. || Min: 0.00 Bit/s
....##||########||## ################| ########################||##..####. Max: 5.48 MBit/s
############################################################################ Ttl: 898.95 MByte
[root@ct-nat ~]# iptraf －－－－－－－－－－－－很直观的工具
IPTraf
+---------------------------------+
| IP traffic monitor |
| General interface statistics |
| Detailed interface statistics |
| Statistical breakdowns... |
| LAN station monitor |
|---------------------------------|
| Filters... |
|---------------------------------|
| Configure... |
|---------------------------------|
| Exit |
+-----------------------------
可以用 sar -n DEV 1 4 查看发包数量：
[root@ct-nat ~]# sar -n DEV 1 4
Linux 2.6.18-164.el5PAE (ct-nat) 06/05/2014
02:20:38 PM IFACE rxpck/s txpck/s rxbyt/s txbyt/s rxcmp/s txcmp/s rxmcst/s
02:20:39 PM lo 0.00 0.00 0.00 0.00 0.00 0.00 0.00
02:20:39 PM eth0 855.10 290.82 832319.39 140028.57 0.00 0.00 0.00
02:20:39 PM eth1 244.90 856.12 100502.04 884775.51 0.00 0.00 0.00
02:20:39 PM sit0 0.00 0.00 0.00 0.00 0.00 0.00 0.00
02:20:39 PM IFACE rxpck/s txpck/s rxbyt/s txbyt/s rxcmp/s txcmp/s rxmcst/s
02:20:40 PM lo 0.00 0.00 0.00 0.00 0.00 0.00 0.00
02:20:40 PM eth0 1010.20 251.02 1059435.71 79747.96 0.00 0.00 0.00
02:20:40 PM eth1 287.76 1108.16 76557.14 1143078.57 0.00 0.00 0.00
02:20:40 PM sit0 0.00 0.00 0.00 0.00 0.00 0.00 0.00
用这个查看发包的端口：netstat -tu -c
[root@ct-nat ~]# netstat -tu -c
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 124.1.1.68:49995 218.66.170.184:10991 ESTABLISHED
tcp 0 0 ::ffff:118.26.96.1:ssh ::ffff:118.26.96.248:41077 ESTABLISHED
tcp 0 0 ::ffff:118.26.96.1:ssh ::ffff:118.26.96.248:42562 ESTABLISHED
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 124.1.1.68:49995 218.66.170.184:10991 ESTABLISHED
tcp 0 0 ::ffff:118.26.96.1:ssh ::ffff:118.26.96.248:41077 ESTABLISHED
tcp 0 0 ::ffff:118.26.96.1:ssh ::ffff:118.26.96.248:42562 ESTABLISHED
用 lsof -i :39733 查看端口的进程，Kill就可以了