跳到主要内容

IPRoute2

CommandDesc
ip
ss
bridge
rtacct
rtmon
ctstat
lnstat
nstat
routef
routel
rtstat
tipc
arpd
devlink
tc
Legacy utilityObsoleted byNote
ifconfigip addr, ip link, ip -s地址、链路配置
routeip route路由表
arpip neighNeighbors
iptunnelip tunnel通道
nameififrename, ip link set name网络设备别名
ipmaddrip maddrMulticast
netstatip -s, ss, ip route网络统计
net-toolsiproute2
arp -aip neigh
arp -vip -s neigh
arp -s 192.168.1.1 1:2:3:4:5:6ip neigh add 192.168.1.1 lladdr 1:2:3:4:5:6 dev eth1
arp -i eth1 -d 192.168.1.1ip neigh del 192.168.1.1 dev eth1
ifconfig -aip addr
ifconfig eth0 downip link set eth0 down
ifconfig eth0 upip link set eth0 up
ifconfig eth0 192.168.1.1ip addr add 192.168.1.1/24 dev eth0
ifconfig eth0 netmask 255.255.255.0ip addr add 192.168.1.1/24 dev eth0
ifconfig eth0 mtu 9000ip link set eth0 mtu 9000
ifconfig eth0:0 192.168.1.2ip addr add 192.168.1.2/24 dev eth0
netstatss
netstat -neopass -neopa
netstat -gip maddr
routeip route
route add -net 192.168.1.0 netmask 255.255.255.0 dev eth0ip route add 192.168.1.0/24 dev eth0
route add default gw 192.168.1.1ip route add default via 192.168.1.1
ss -s # 统计
ss -o state established '( dport = :smtp or sport = :smtp )'
ss -o state established '( dport = :http or sport = :http )'
ss -x src /tmp/.X11-unix/*
ss -o state fin-wait-1 '( sport = :http or sport = :https )'

ss -atr
flagfor
-H,--no-header
-O,--oneline
-n,--numeric
-r,--resolve
-a,--all
-l,--listening
-o,--options
-e,--extended
-m,--memory
-p,--processes
-T,--threads
-i,--info
--tos
--cgroup
--tipcinfo
-K,--kill
-s,--summary
-E,--eventswatch
-Z,--context
-z,--contexts
-N,--net=NSNAME
-b,--bpf
-4,--ipv4
-6,--ipv6
-O,--packet
-t,--tcp
-u,--udp
-d,--dccp
-w,--raw
-x,--unix
-S,--sctp
--tipc
--vsock
--xdp
-M,--mptcp
--inet-sockopt
-F,--family=FAMILY
-A,--query,--socket=QUERY
-D,--diag=FILE
-F,--filter=FILE
  • state
    • established, syn-sent, syn-recv, fin-wait-1, fin-wait-2, time-wait, closed, close-wait, last-ack, listening, closing
    • all
    • connected
    • synchronized - 除 syn-sent 的 connected
    • bucket
    • big - !bucket
  • UNCONN
  • ESTAB
  • LISTEN
{dst|src} [=] HOST
{dport|sport} [OP] [FAMILY:]:PORT
dev [=|!=] DEVICE
fwmark [=|!=] MASK
cgroup [=|!=] PATH
autobound
  • HOST - [FAMILY:]ADDRESS[:PORT]
    • FAMILY - unix, link, netlink, vsock, inet, inet6
  • OP
    • <=,le,leq,>=,ge,geq,=,==,eq,!=,ne,neq,<,gt,>,lt,!,not
    • |,||,or
    • &,&&,and

bridge​

# 添加桥接
ip li add name br0 type bridge
# 添加 if
ip li set dev eth0 master br0
# 移除 if
ip li set dev eth0 nomaster
# 同时给 br0 添加多个地址可在保证网络访问的同事进行桥接
# 因为桥接, 所以 gw 的信息要手动配置
# 默认网关
ip route add 0.0.0.0/0 via 10.0.2.2

# 删除最上层的默认网关
ip ro del default

ip li set dev eth0 mtu 9000

ip route flush table main

ip route flush 172.17.0.0/16

ip route flush cache

ip -s route show cache

# greptap
# ==============================
# GRE bridging, IPsec and NFQUEUE http://backreference.org/2013/07/23/gre-bridging-ipsec-and-nfqueue/
# Layer 2 over Layer 3
#
# A
ip link add gretap0 type gretap local 172.31.0.1 remote 172.31.0.2
ip link set dev gretap0 up
ip link set dev eth0 up
brctl addbr br0
brctl addif br0 gretap0
brctl addif br0 eth0
ip addr add 10.10.10.1/24 dev br0
ip link set br0 up
# B
ip link add gretap0 type gretap local 172.31.0.2 remote 172.31.0.1
ip link set dev gretap0 up
ip link set dev eth0 up
brctl addbr br0
brctl addif br0 gretap0
brctl addif br0 eth0
ip addr add 10.10.10.2/24 dev br0
ip link set br0 up

veth - Virtual Ethernet Device - 虚拟以太网设备​

ip li add veth0 type veth

相同网口进出​

auto eth2
iface eth2 inet static
  address 192.168.2.101
  netmask 255.255.252.0
  mtu 9000
  pre-up ip ro li tab tgbe &>/dev/null || echo '10 tgbe' >> /etc/iproute2/rt_tables
  post-up ip ru add from 192.168.2.101 table tgbe
  post-up ip ro add default via 192.168.2.1 dev eth2 table tgbe

table​

  • Table 映射配置 /etc/iproute2/rt_tables
  • local
    • 特殊表
    • 包含高优先的本地路由和广播地址
  • main
    • 包含所有非策略路由
  • default
    • 空的
# 所有路由表规则
ip route show table all
# 有效 table 列表
ip route show table all | grep -Po 'table \K[^\s]+' | sort -u

# 清除 table
ip route flush table 11

rule​

  • routing policy database - RPDB - 路由策略数据库
  • ip-rule.8
  • 传统路由基于目标地址，策略路由可基于包的其他字段
    • 来源地址、IP 协议、端口、包内容
  • rule=selector+action predicate
  • 使用降序 - 数字越低越优先
  • 类型
    • unicast
    • blackhole
    • unreachable
    • prohibit
    • nat
# 默认
# local = 255
0:      from all lookup local
# main = 254
32766:	from all lookup main
# default = 253
32767:	from all lookup default

mark​

macvlan​

FAQ​

所有 table​

ip route show table all | egrep -o "table \S+" | sed 's/table\s//' | sort -u

Stateless NAT with iproute2​