Contents of this article:

13.1 Linux Packet Forwarding

13.2 Several network-related file descriptions

13.2.1 Network Card Profile ifcfg-*

13.2.2 DNS Profile/etc/resolve.conf

13.2.3 /etc/udev/rules.d/70-persistent-net.rules

13.2.4 /etc/services

13.3 Network Interface Configuration and Host Name

13.3.1 ifconfig

13.3.2 ifcfg

13.3.3 hostname command

13.4 Gateway/Routing

13.4.1 route command

13.4.2 Configure Permanent Routing

13.5 arp and arping commands

13.5.1 arp command

13.5.2 arping command

13.6 ip command

13.6.1 Get help with ip commands

13.6.2 ip addr

13.6.3 ip route

13.6.4 ip link

When explaining Linux network management related content, I feel it is necessary to first explain the packet forwarding capabilities and the resulting routing decisions.Then the network configuration commands and related files are introduced.

13.1 Linux Packet Forwarding

If the Linux host has multiple network cards, they cannot communicate with each other unless they are in the same segment address unless packet forwarding is turned on.For example, eth0 is 172.16.10.0/24 and eth1 is 192.168.100.0/24. Packets arriving at the Linux host cannot be handed over from eth0 to eth1 or eth1 to eth0 unless the Linux host has enabled packet forwarding.This is different from router devices, which essentially forward packets across network segments, so router devices are enabled for forwarding by default.

There are several ways to turn on Forwarding on Linux:

These two methods are temporary and should be written to the configuration file if they are to be permanent.In CentOS 6, the value of "net.ipv4.ip_forward" in the /etc/sysctl.conf file can be changed to 1. However, in CentOS 7, systemd manages too many functions, and sysctl's configuration files are divided into multiple files, including/etc/sysctl.d/*.conf, etc/sysctl.d/*.conf and/usr/lib/sysctl.d/*.conf, and there are no net.ipv4.ip_forward entries by default in these files.Of course, it is also possible to write this item directly to these configuration files, and it is recommended that you write it in/etc/sysctl.d/*.conf, which is the directory where systemd provides custom kernel modifications.For example:

There are several ways to see if forwarding is turned on.

In addition, IP addresses belong to the kernel (not only, the entire tcp/ip stack belongs to the kernel, including port numbers), and can communicate with one address, regardless of whether packet forwarding is enabled or not.For example, a Linux host has two network cards eth0:172.16.10.5 and eth1:192.168.100.20, and a 192.168.100.22 host gateway points to 192.168.100.20. If it pings 172.16.10.5, the result will be passable because the address belongs to the kernel. When the packets coming from eth1 are analyzed by the kernel, the target address is found to be the local address, and the response packet continues to leave eth1.Do not leave eth1 unless the route is explicitly set.

The following diagram shows the communication mechanism of the Linux host.Suppose the host has two network cards, eth0 and eth1, and they belong to different network segments.

According to the figure above, if the host of segment 1 ping ip_addr1 or ping ip_addr2 enters the packet from eth0, the kernel analyzes the packet and finds that the ultimate destination of the packet is the IP address on the local machine, and the kernel makes routing decisions. Generally, the routing entries for such packets specify that they flow from the direct connection port, eth0.This is the black route shown above.

Although the Segment 1 host can ping through ip_addr2, the packet is not handed over to eth1.

If the segment 1 host Ping segment 2 host, the kernel will analyze the packet when ping's request packet flows from eth0 to the Linux host, and find that the target of the packet is the segment 2 address. According to the routing table, such packets will generally go out of the direct connection port eth1, so the eth0 packet will be transferred to eth1, but forwarding is not enabled, so the packet cannot reach eth1, so it will be discarded.If packet forwarding is enabled, the blue and red dotted lines above will be connected, and the packet forwarding will reach the eth1 interface, then go out to the host of segment 2.

13.2 Several network-related file descriptions

13.2.1 Network Card Profile ifcfg-*

There are many files in the / etc/sysconfig/network-scripts/directory, most of which are script files, but there is one type of ifcfg file that starts with the interface config. All ifcfg files are loaded and read when the network service is started, but the specific file name ifcfg-XX can be named arbitrarily.

The following is an example of the contents of an ifcfg-XX file (on CentOS 7).

13.2.2 DNS Profile/etc/resolve.conf

This file is used to set DNS pointing and parsing order.The file format is as follows:

domain  domain_name         # Declare a local domain name, that is, a domain name that is automatically implicitly complemented upon resolution
search  domain_name_list    # Specifies the domain name search order (up to 6), and domains cannot coexist. If they coexist, the lines written below take effect
nameserver  IP1             # Set DNS Pointing, up to 3
nameserver  IP2
nameserver  IP3        
options timeout:n attempts:n  # Specify resolution timeout (default 5 seconds) and number of parses (default 2)

For example, set /etc/resolve.conf as shown below, and do not set the nameserver for testing purposes.

domain malong.com

When resolving host names without dots, such as "www", which is not considered fqdn, automatically add ".malong.com" to resolve "www.malong.com".

When the name is resolved without a dot at the end but with a dot in the middle, such as "www.host", which is considered fqdn, it will directly resolve "www.host", and then resolve the name with "malong.com", that is, "www.host.malong.com".

When a name with a dot at the end of the resolution, such as "www.host." is considered to be a complete fqdn, it will directly resolve "www.host". When the resolution is complete, it will end directly without completing the local domain name resolution.

The search keyword works the same as the domain, except that search also implies the order in which domain names are searched.For example, set search to the following:

search  malongshuai.com longshuai.com mashuai.com

If you parse "www.host", you will parse "www.host","www.host.malongshuai.com", "www.host.longshuai.com", "www.host.mashuai.com".

The domain and search parts cannot coexist, and if they do, subsequent rows will be valid.

13.2.3 /etc/udev/rules.d/70-persistent-net.rules

When a new network device is inserted, the kernel first recognizes it, then generates the corresponding information file for the device in the sysfs file system (typically mounted under / sys).The kernel then notifies udevd's daemon udevd (if you don't know what it is, consider it a device manager in the Windows system to manage and monitor hardware devices). udevd reads information about the corresponding device in sysfs and compares or generates a rule set for udev to do the corresponding action for matching rules.For a network card, its rule set file defaults to / etc/udev/rules.d/70-persistent-net.rules, and after successfully matching the rules, a corresponding device subdirectory is generated in the / sys/class/net directory.

The following are the contents of the rule set for the two network cards:

The specific udev rule set syntax is not the content of this article, so only the two above rule sets are briefly explained here.Rule set files are written in key/value format, but are divided into matching key/vaule and behavior key/value.In the example above, from SUBSYSTEM to KERNEL, a'=='sign is used to indicate a match key/value, and the last NAME uses a single'=' sign to indicate an assignment key/value.So what the above file means is that when each information of a device in /sys matches one of the above rules, assign the device name to eth0 or eth1, and then name the directory of device information under the / sys/class/net directory. The value of DEVICE in the ifcfg-* configuration file must be the same as they are.

Note that network rule set files are automatically generated or written when the kernel detects a device, so emptying it has no effect.

When cloning a virtual machine, MAC address conflicts always occur because both the rule set file and the ifcfg configuration file are cloned, and the MAC address in the newly cloned machine is new, so a new rule set is generated, but the DEVICE value in the cloned ifcfg configuration file does not correspond to the rule, resulting in the cloned host's network will not start.The solution is to empty the file and restart the cloning host so that the kernel will generate a rule set file corresponding to the new MAC address.Of course, it is also possible to empty the rule set file of the template host before cloning and then clone it.

It is worth mentioning that in CentOS 7, systemd has integrated udevd functionality, so udev's rule set files are rare, but more convenient. When cloning a CentOS 7 host, there is no possibility of MAC address conflicts at all, since all rule sets are generated in memory by the kernel.However, the explicitly written rule set file is still valid.

13.2.4 /etc/services

This file records the relationship between the port and the service.

13.3 Network Interface Configuration and Host Name

13.3.1 ifconfig

Although the command is described as obsolete in the man document, it is clearly not forgotten by the public.The ifconfig command is an interface configuration command, but more is used to display activated network interface information.

ifconfig [ interface | -a ]
ifconfig interface options

Option description:
Interface: Specify the name of the network interface to be operated on, such as eth0
 Up: Activates the specified network interface, and defaults to up if an IP address is assigned to the network interface from the command line
 Down: Sets the specified interface to down state
 [-]arp: Enable or disable the use of ARP protocol on this interface, such as "ifconfig eth0-arp"
mtu N: Sets the maximum transfer unit (MTU) for the specified interface
 Netmask: Sets the IP netmask for the interface, using the number of bits masked for class A/B/C addresses by default
 Address: The IP address to be assigned to the interface

ifconfig example:

It is important to note that all ifconfig configurations are applied to the kernel, so they will only take effect temporarily and will fail immediately after restarting the network service.

For slave addresses, which are aliased addresses, to be permanently valid, a corresponding alias interface configuration file, such as/ets/sysconfig/network-scripts/ifcfg-eth0:0, should be established, and given an eth0:0 name on the DEVICE keyword in that file, the DEVICE entry must be configured correctly.

13.3.2 ifcfg

The usage is simple.

ifcfg DEV [[add|del [ADDR[/LEN]] | stop]
       add - add new address
       del - delete address
       stop - completely disable IP

For example:

13.3.3 hostname command

Used to set the host name, but there are several other useful features.

hostname [-I] [-f] [-d] [-s] [hostname]

Option description:
-I: Get all non-loopback IP addresses on this host, this option does not depend on host name resolution
 -f,--fqdn: Get FQDN
 -d,--domain: Gets the domain name portion of fqdn, which is equivalent to the command dnsdomainname
 -s,--short: Get the host name part of fqdn, strictly before the first'.', for example,'www.baidu.com'will be obtained as'www'

Using the -I option, you can get all the IP addresses on the host directly, including the alias address, which is sometimes too convenient.

The hostname modified host name is temporarily in effect, and it modifies the / proc/sys/kernel/hostname file.

Although there is a permanently valid option (-b) in the man documentation, it is ineffective to test.To be permanently effective, you need to modify the configuration file/etc/hostname(CentOS 7) or/etc/sysconfig/network(CentOS 6).For example, on CentOS 7:

13.4 Gateway/Routing

There are three routes on Linux:

• Host Routing: Directly indicates how to get to a specific host. Host routing is also known as static routing.
• Network Routing: Indicates where a certain type of network is going
• Default Route: Default Route without Host Route or Network Route.Default routes set on the operating system are also commonly referred to as gateways.

If there are multiple routes to a host on Linux, the route with the highest priority will be selected.In Linux, routing entries are prioritized by matching the length of the mask bits before comparing the management distances.That is, route entries with long mask bits must have higher priority than those with short mask bits, so host routes have the highest priority, followed by direct-connected networks (that is, network routes), network routes, and finally default routes.If the masks of the route entries are the same length, the shorter managed distances will take effect by comparing the managed distances between nodes.

For example, in the routing table below, if ping 192.168.5.20, a mismatch is found first against 192.168.100.78, then against 192.168.100.0, a mismatch is found, and then against 192.168.0.0, the network route entry is found to match, so select the route entry.

Another example is the routing table below.Since both eth0 and eth1 network cards are 192.168.100.0/24 segment addresses, their routing entries are identical in mask length matching, but when communicating with eth0 directly connected segment hosts, eth0 is definitely chosen because eth1 and the segment host are separated by an eth0 and the distance increases by 1.

13.4.1 route command

The route command displays and manages routing tables.When the add or del option is used, the route command sets the route entry, otherwise the route command displays the route table.

To display routing table information, simply route -n, where the -n option means that the host name is not resolved.

For example:

For systems above CentOS 6, ignore the Metric and Ref columns, which are no longer used by the kernel, but may be used by some routing software.

For Flags columns, if no routing software is installed, only the following three values are possible:

U (route is up)

H (target is a host)

G (use gateway, which is the route entry with the next hop set)

To manage the routing table, use the add or del option.

route [add/del] [-host/-net/default] [address[/mask]] [netmask] [gw] [dev]

Option description:
add/del: add or delete route entries
 -net: a network route was added or deleted
 -host: A host route was added or deleted
 Default: a default route was added or deleted
 Netmask: explicitly use the netmask keyword to specify a mask, so that you can use the cidr format mask directly on the address, that is, IP/MASK, without using this option.
gw: specify the address of the next hop.Requires that the next hop address must be reachable and typically a direct connection to the network segment.
dev: Forces routing entries to be associated to a specified interface.In general, the kernel automatically determines which network interface a route entry should be associated with.

For example:

(1). Add and remove default routes

Since the destination of the default route is 0.0.0.0, the default keyword can also be replaced by 0.0.0 to operate on the default route, but this is more cumbersome.

(2). Adding and deleting network routes

If you really don't know who to jump to next, it's also possible to specify a native interface.

Deleting a route directly changes the add keyword to the del keyword in the statement that adds the route.as

But most of the time, you can be lazy, as long as you can only decide which route to delete.For example:

(3) Add and delete host routes

13.4.2 Configure Permanent Routing

Create a routing profile/etc/syconfig/network-scripts/route-ethX based on the interface from which X will be exported.

The configuration format of the route profile is very simple, with one route entry per line, first the destination to be reached, then the via keyword, and finally the next-hop address.Requires that the next hop must be reachable and generally be in the same segment as ethX.

DEST    via     nexthop

For example, the IP address of the eth0 network card is 192.168.10.123. To get out to 10.0.0.10 through the eth0 network card, the address of the next hop should be in the same network segment as the eth0 address, such as 192.168.10.222.

10.0.0.0 via 192.168.10.222

The route-ethX file has another configuration way to write persistent routes, but the above method is simpler and faster, so I won't say much here.

13.5 arp and arping commands

Maintain or view the system arp cache, which is obsolete and replaced by ip neigh.

arp is an address resolution protocol that finds the corresponding MAC address of a given ipv4 address in the network.

In general, the host MAC in the LAN is acquired by using the arp protocol, so the hosts in the LAN are also called network neighbors.

13.5.1 arp command

arp command syntax:

arp-n-v-i #View arp cache
 arp-i-d hostname #Delete arp cache entries

Option description:
-n: do not resolve ip address to name
 -v: Details
 -i: the interface for the specified operation
 -d: delete an arp entry

hostname: Operates the host's arp entries. In addition to deleting the host's arp entries, there are other actions, such as adding the host's arp entries manually. This usage is not explained here.

For example:

The information you are viewing is actually the content in the / proc/net/arp file.

The arp command can only delete one arp entry at a time. To delete or empty the entire arp entry in batch, use the ip neigh flush command.For example:

13.5.2 arping command

arping is used to send an arp request message, parse and get the MAC of the target address.By default, the broadcast message will be sent first, then the unicast message will be sent after the reply is received. All hosts in the LAN can receive the broadcast message, but only the target host will reply to its MAC address.

Note: Sending an arp request message is actually an alternative ping, so you can detect whether the target is alive or not, and you need to communicate with the target, which also caches the arp entries of the host (that is, the source address).

Grammar:

arping [-fqbDU] [-c count] [-w timeout] [-I device] [-s source] destination
-f : First received reply Exit immediately
-q : Quiet mode, nothing to output
-b : Only broadcast, no unicast
-D : Address Conflict Detection
-U : Actively updating neighbors arp cache(Unsolicited ARP mode)
-c count : How many to send arp Exit after requesting package
-w timeout : wait for reply Timeout
-I device : Which interface to use to send the request package.Send out arp Request Package Interface MAC Address will be cached on target host
-s source : Appoint arp The source address in the request message. If the sending interface and the source address are different, the destination host will cache the address and the interface's MAC Address, not the interface of the source address MAC address
 destination : To whom arp Request message to get the message IP Or hostname MAC address

For example:

(1). Request resolution of MAC address for 192.168.100.70 host

This will send a broadcast message until a response from 192.168.100.70 is received.

At the same time, 192.168.100.70 also caches local IP and MAC entries. Since there is no specified sending interface and source address for the request message, the interface and corresponding interface address are selected according to the routing table when sending the message.

(2) Specify that a request message should be sent to 192.168.100.70 to exit, that the interface to send the message is eth1, and that the source address of the request message should be 192.168.100.54 on the native eth0 interface.

Sending such an arp request packet would cause the target host 192.168.100.70 to cache the native arp entry as "192.168.100.54 MAC_eth1", but in fact, the MAC address of the interface on which 192.168.100.54 resides is MAC_eth0.

The arping command can only implement this simple arp spoofing, and more arp Spoofing methods can use specialized tools.

(3). Detect if the other host is alive

For example, if you send four probes, a response means the other party is alive

Four probing messages have been sent, the first of which is a broadcast message, and four responses have been received.

13.6 ip command

This is a very powerful command, all the previous commands for network information display and management can be replaced by ip commands.It is a strictly modeled command.

13.6.1 Get help with ip commands

Start with a brief description of the ip command and how to get help.

Visible commands are complex, with many options and many objects, each corresponding to a different command.But only a few objects can be used: addr/route/neigh/link.

Use ip object help to get syntax help for the object.For example:

Under the ip command line, any object can have its full name or its abbreviated name, such as address, which can be abbreviated as addr or a letter.

Although there is also an object beginning with a that is addrlabel.This is because IP will match backwards and forwards from the order of objects given in the above syntax, for example, "ip m" will match to "ip maddr". If you want to match something else, such as addrlabel, you can write "ip addrl" longer.

For CentOS 6, man ip outputs help documentation for the entire ip, including commands and instructions for each object.In CentOS 7, each object is manned independently, such as addr.

The following is a list of man for all Object s.

13.6.2 ip addr

ip addr is used to manage IP addresses on network devices and also to view the property information of IP addresses.In older versions of Linux, multiple IPs were set on a single network card. These IPs were called aliased IPs, but starting with CentOS 6, these IPs were called secondary or slave IP s because they also had attributes attached to them.

(1).ip addr add/del

ip address { add | del } IFADDR dev STRING
IFADDR := PREFIX [ broadcast ADDR ] [ anycast ADDR ] [ label STRING ]

Take add for example:
dev NAME: Specify the network card to set the IP address
 local ADDRESS (default): The IP address of the interface.The format of an IP address depends on whether it is IPv4 or ipv6.For ipv4, a given address may also require a given cidr mask bit length
 broadcast ADDRESS: broadcast ADDRESS of the interface
 label NAME: Sets the label NAME for the IP address of the interface. The label NAME must start with the network interface name followed by a colon, such as eth0:X

The del and add parameters are the same, and dev must be given. The remaining parameters are optional, because del is a wildcard del, and if more than one item meets the criteria when deleting, the first one is deleted.

Addresses added this way are not shown in the ifconfg command, and ifconfg captures aliases, so label can be added to the address so that the secondary is viewed by ifconfig.For example:

Deleting ip is much simpler, but dev must be specified, and ideally, cidr's mask length.

(2).ip addr show

There are also several options, but it doesn't feel useful, just ip addr show.Because the ip command can be abbreviated, it can be written as

(3).ip addr flush

For batch address deletion, this command is actually dangerous, accidentally hurting innocent people. Fortunately, when flush does not give any parameters or when there are no entries to match, it will not perform the flush action. In short, this command should be used with care.The dev parameter must also be given.

For example, delete all addresses on eth1.

Delete all secondary addresses on eth1.

13.6.3 ip route

This command maintains and views routing tables in the kernel.

(1).ip route add/del/change/append/replace

The grammar format is:

ip route { add | del | change | append | replace } dest[/cidr_mask] [ via ADDRESS ] [ dev STRING ]

Dest is the target address, which can be the host address and the segment address. Generally, the address will be followed by a mask length in cidr format, which defaults to 32-bit length when not.If dest is "0/0" or written as "default", it represents the default route.

For example, add/modify/replace regular routes:

Add/modify/replace default routes:

Delete a route:

(2).ip route show

List routing tables.

The grammar format is:

ip route show [to [ root | match | exact ] ADDR_pattern ] [ via ADDR ]

The to keyword is the default keyword used to match the destination address of the route.It can then be followed by the modifier root/match/exact, which is the default modifier for the exact match mask bit length, the root modifier for the matched mask bit length greater than or equal to the mask bit length given by ADDR_patternand the match modifier matching less than or equal to the ADDR_patternmask bit length.For example, "to match 16.0/16" will match "16.0/16", "16/8" and "0/0", but it will not match "16.1/16" and "16.0/24" and "16.0.1/24", while "to root 16.0/16" will match "16.0/24" and "16.0.1/24".

via lists the route entries according to the next hop.

For example:

In fact, there is no need to be so fancy, simple "ip r" is convenient.

(3).ip route flush

Bulk deletion of routing table entries.The parameters are the same as those of the ip route show.

For example, delete the route entry from eth1.

Delete the route entry with the next jump of 192.168.100.70.

Delete routes that target 192.168.0.0/16 segments

(4).ip route save/restore

Used to save the current routing table and restore the routing table.When saving a routing table, the routing table will be output in the format of binary bare data, that is, binary files that you cannot understand.When restoring a routing table, device settings are required to be the same as when saving the routing table. Routing entries that already exist in the routing table at the time of restore will be ignored.

For example, the current routing table information is as follows:

Save the current routing table.

Delete several routing tables.

Restore routing table.

13.6.4 ip link

Link stands for link layer, which is the link layer.This command is used to manage and view network interfaces, and can even add virtual network interfaces to manage them in groups.

(1).ip link set

ip link set DEVICE  { up | down | arp { on | off } | name NEWNAME | address LLADDR }  

Option description:
dev DEVICE: Specify the name of the device to operate on
 up and down: Start or stop the device
 arp on or arp off: Enable or disable the arp protocol for the device
 name NAME: Modifies the name of the specified device and does not recommend renaming when the interface is running or an IP address has been assigned
 address LLADDRESS: Sets the MAC address of the specified interface

For example, disable eth1 network card.

Equivalent to:

Modify the MAC address of eth1 network card.

(2).ip link show

Grammar Format:

ip [ -s | -h ] link show [dev DEV]  

Option description:
-s: Displays traffic statistics on each network interface
 -h: Explicitly in a human readable manner, i.e., unit conversion.Note: "-h" is only supported on CentOS 7.

For example:

Back to the series article outline: http://www.cnblogs.com/f-ck-need-u/p/7048359.html

For reprinting, please indicate the source: http://www.cnblogs.com/f-ck-need-u/p/7074594.html