当前位置：首页 > news >正文

16-Linux学习之旅之网络诊断工具

news 2026/8/7 21:06:12

Linux学习之旅之网络诊断工具

一、IP目录族

1、ip addr（IP地址查看）

#查看IP详细信息root@ubt2604ser:~# ip addr1: lo:<LOOPBACK,UP,LOWER_UP>mtu65536qdisc noqueue state UNKNOWN group default qlen1000link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet127.0.0.1/8 scopehostlo valid_lft forever preferred_lft forever inet6 ::1/128 scopehostnoprefixroute valid_lft forever preferred_lft forever2: ens32:<BROADCAST,MULTICAST,UP,LOWER_UP>mtu1500qdisc pfifo_fast state UNKNOWN group default qlen1000link/ether 00:0c:29:e9:1e:90 brd ff:ff:ff:ff:ff:ff altname enp2s0 altname enx000c29e91e90 inet10.0.0.4/24 brd10.0.0.255 scope global ens32 valid_lft forever preferred_lft forever inet6 fe80::20c:29ff:fee9:1e90/64 scopelinkproto kernel_ll valid_lft forever preferred_lft forever#指定网卡查看IProot@ubt2604ser:~# ip addr show ens322: ens32:<BROADCAST,MULTICAST,UP,LOWER_UP>mtu1500qdisc pfifo_fast state UNKNOWN group default qlen1000link/ether 00:0c:29:e9:1e:90 brd ff:ff:ff:ff:ff:ff altname enp2s0 altname enx000c29e91e90 inet10.0.0.4/24 brd10.0.0.255 scope global ens32 valid_lft forever preferred_lft forever inet6 fe80::20c:29ff:fee9:1e90/64 scopelinkproto kernel_ll valid_lft forever preferred_lft forever#简要信息root@ubt2604ser:~# ip -r -br addrlo UNKNOWN localhost/8 ip6-localhost/128 ens32 UNKNOWN bogon/24 ubt2604ser/64

2、ip link（网卡管理）

#查看网卡信息root@ubt2604ser:~# ip link show1: lo:<LOOPBACK,UP,LOWER_UP>mtu65536qdisc noqueue state UNKNOWN mode DEFAULT group default qlen1000link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:002: ens32:<BROADCAST,MULTICAST,UP,LOWER_UP>mtu1500qdisc pfifo_fast state UNKNOWN mode DEFAULT group default qlen1000link/ether 00:0c:29:e9:1e:90 brd ff:ff:ff:ff:ff:ff altname enp2s0 altname enx000c29e91e90#启动网卡root@ubt2604ser:~# ip link set ens32 up#关闭网卡（生产环境慎用，会断网）root@ubt2604ser:~# ip link set ens32 down

3、ip route（路由表）

root@ubt2604ser:~# ip routedefault via10.0.0.2 dev ens32 proto static10.0.0.0/24 dev ens32 proto kernel scopelinksrc10.0.0.4

4、ip neigh（ARP缓存）

ARP协议用于将IP地址解析为MAC地址。 ip neigh 查看本机的ARP缓存表。

root@ubt2604ser:~# ip neighbo10.0.0.1 dev ens32 lladdr 00:50:56:c0:00:08 REACHABLE10.0.0.2 dev ens32 lladdr 00:50:56:ee:82:2f STALE root@ubt2604ser:~##arp测试[root@rockydesk ~]# arping 10.0.0.1ARPING10.0.0.1 来自10.0.0.6 ens160 单播 回复 来自10.0.0.1[00:50:56:C0:00:08]0.874毫秒 单播 回复 来自10.0.0.1[00:50:56:C0:00:08]1.031毫秒 ^C发送2次探测(1次广播)已接受到2个响应[root@rockydesk ~]#

二、tcpdump抓包

tcpdump是命令行抓包工具，可以捕获经过网卡的数据包，是排查网络问题的最强手段

1、基本用法

#指定端口抓包root@ubt2604ser:~# tcpdump -i ens32tcpdump: verbose output suppressed, use -v[v]...forfull protocol decode listening on ens32, link-type EN10MB(Ethernet), snapshot length262144bytes 00:42:33.694602 IP bogon.ssh>bogon.34412: Flags[P.],seq98999457:98999585, ack789952302, win284, length128#指定数量root@ubt2604ser:~# tcpdump -i ens32 -c 2tcpdump: verbose output suppressed, use -v[v]...forfull protocol decode listening on ens32, link-type EN10MB(Ethernet), snapshot length262144bytes 00:43:24.919954 IP bogon.ssh>bogon.34412: Flags[P.],seq99002545:99002609, ack789952878, win284, length6400:43:24.968600 IP bogon.34412>bogon.ssh: Flags[.], ack64, win4104, length02packets captured9packets received by filter0packets dropped by kernel root@ubt2604ser:~##不进行服务解析root@ubt2604ser:~# tcpdump -i ens32 -nn -c2tcpdump: verbose output suppressed, use -v[v]...forfull protocol decode listening on ens32, link-type EN10MB(Ethernet), snapshot length262144bytes 00:44:04.058092 IP10.0.0.4.22>10.0.0.1.34412: Flags[P.],seq99005505:99005553, ack789954366, win284, length4800:44:04.109402 IP10.0.0.1.34412>10.0.0.4.22: Flags[.], ack48, win4104, length02packets captured2packets received by filter0packets dropped by kernel#指定服务端口root@ubt2604ser:~# tcpdump -i ens32 -nn -c2 port 22tcpdump: verbose output suppressed, use -v[v]...forfull protocol decode listening on ens32, link-type EN10MB(Ethernet), snapshot length262144bytes 00:44:45.476988 IP10.0.0.4.22>10.0.0.1.34412: Flags[P.],seq99006561:99006609, ack789954942, win284, length4800:44:45.527805 IP10.0.0.1.34412>10.0.0.4.22: Flags[.], ack48, win4106, length02packets captured2packets received by filter0packets dropped by kernel#指定服务端口和主机root@ubt2604ser:~# tcpdump -i ens32 -nn -c2 port 22 and host 10.0.0.1tcpdump: verbose output suppressed, use -v[v]...forfull protocol decode listening on ens32, link-type EN10MB(Ethernet), snapshot length262144bytes 00:45:00.144767 IP10.0.0.4.22>10.0.0.1.34412: Flags[P.],seq99008161:99008225, ack789955998, win284, length6400:45:00.145573 IP10.0.0.4.22>10.0.0.1.34412: Flags[P.],seq64:128, ack1, win284, length642packets captured4packets received by filter0packets dropped by kernel root@ubt2604ser:~#

2、保存和读取

#将抓取的包存放在家目录下root@ubt2604ser:~# tcpdump -i ens32 -nn -c2 port 22 and host 10.0.0.1 -w /root/sshd.tcpdumptcpdump: listening on ens32, link-type EN10MB(Ethernet), snapshot length262144bytes2packets captured2packets received by filter0packets dropped by kernel root@ubt2604ser:~##读取文件root@ubt2604ser:~# tcpdump -nn -r sshd.tcpdumpreading fromfilesshd.tcpdump, link-type EN10MB(Ethernet), snapshot length26214400:50:59.845708 IP10.0.0.4.22>10.0.0.1.34412: Flags[P.],seq99023697:99023761, ack789967326, win284, length6400:50:59.897586 IP10.0.0.1.34412>10.0.0.4.22: Flags[.], ack64, win4103, length0root@ubt2604ser:~#

三、curl http验证

curl是命令行HTTP客户端，用于测试Web服务连通性，是排障时的必备工具。

准备一台带有nginx服务的虚拟机[root@rockydesk ~]# dnf install -y nginx[root@rockydesk ~]# systemctl enable --now nginx#GET请求（可以再nginx服务器上抓包试试，看看没有TCP握手和挥手协议）root@ubt2604ser:~# curl http://10.0.0.6 | head -10% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed10076201007620001.39M00<!doctype html><html><head><metacharset='utf-8'><metaname='viewport'content='width=device-width, initial-scale=1'><title>HTTP Server Test Page powered by: Rocky Linux</title><styletype="text/css">/*<![CDATA[*/#查看响应头root@ubt2604ser:~# curl -I http://10.0.0.6HTTP/1.1200OK Server: nginx/1.26.3 Date: Wed, 05 Aug202600:58:31 GMT Content-Type: text/html Content-Length:7620Last-Modified: Fri,12Dec202519:34:10 GMT Connection: keep-alive ETag:"693c6e32-1dc4"Accept-Ranges: bytes#详细信息root@ubt2604ser:~# curl -v http://10.0.0.6 |head -10% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed000000000* Trying10.0.0.6:80... * Established connection to10.0.0.6(10.0.0.6 port80)from10.0.0.4 port34970* using HTTP/1.x>GET / HTTP/1.1>Host:10.0.0.6>User-Agent: curl/8.18.0>Accept: */*>* Request completely sent off<HTTP/1.1200OK<Server: nginx/1.26.3<Date: Wed, 05 Aug202600:59:26 GMT<Content-Type: text/html<Content-Length:7620<Last-Modified: Fri,12Dec202519:34:10 GMT<Connection: keep-alive<ETag:"693c6e32-1dc4"<Accept-Ranges: bytes<{[7620bytes data]1007620100762000832.4k<!doctype html><html><head><metacharset='utf-8'><metaname='viewport'content='width=device-width, initial-scale=1'><title>HTTP Server Test Page powered by: Rocky Linux</title><styletype="text/css">/*<![CDATA[*/ html{1007620100762000721.8k00* Connection#0 to host 10.0.0.6:80 left intact

四、ping/tracerroute/mtr命令

1、ping（测试连通和延迟）

#ping2个包、间隔1秒、包大小1024（每一个可以单独使用）root@ubt2604ser:~# ping -c 2 -i 1 -s 1024 10.0.0.6PING10.0.0.6(10.0.0.6)1024(1052)bytes of data.1032bytes from10.0.0.6:icmp_seq=1ttl=64time=0.671ms1032bytes from10.0.0.6:icmp_seq=2ttl=64time=0.512ms ---10.0.0.6pingstatistics ---2packets transmitted,2received,0% packet loss,time1002ms rtt min/avg/max/mdev=0.512/0.591/0.671/0.079 ms root@ubt2604ser:~#

2、traceroute（路由跟踪）

# ICMP模式[root@rockydesk ~]# traceroute -I jd.comtracerouteto jd.com(106.39.171.134),30hops max,60byte packets1_gateway(10.0.0.2)0.319ms0.262ms *2192.168.16.1(192.168.16.1)3.118ms3.887ms *3192.168.10.1(192.168.10.1)2.002ms1.983ms1.951ms4161.73.27.117.broad.fz.fj.dynamic.163data.com.cn(117.27.73.161)2.880ms2.858ms2.822ms5120.36.57.45(120.36.57.45)4.998ms * *# 不解析主机名（更快）[root@rockydesk ~]# traceroute -n jd.comtracerouteto jd.com(211.144.24.218),30hops max,60byte packets110.0.0.21.433ms1.355ms1.246ms

3、mtr（动态路由跟踪）

mtr结合了ping和traceroute，动态显示丢包率和延迟，是排查网络质量的最佳工具。

#交互式[root@rockydesk ~]# mtr jd.comrockydesk(10.0.0.6)->jd.com(111.13.149.108)2026-08-05T09:42:28+0800 Keys: Help Display mode Restart statistics Order of fields quit Packets Pings Host Loss% Snt Last Avg Best Wrst StDev1. _gateway0.0%30.43.30.48.94.92.192.168.16.10.0%33.33.12.83.30.3#只看结果[root@rockydesk ~]# mtr -r jd.comStart:2026-08-05T09:43:12+0800 HOST: rockydesk Loss% Snt Last Avg Best Wrst StDev1.|-- _gateway0.0%100.20.40.20.60.12.|--192.168.16.10.0%102.63.52.68.71.8#不解析主机名[root@rockydesk ~]# mtr -n jd.comMytraceroute[v0.95]rockydesk(10.0.0.6)->jd.com(106.39.171.134)2026-08-05T09:44:01+0800 Keys: Help Display mode Restart statistics Order of fields quit Packets Pings Host Loss% Snt Last Avg Best Wrst StDev1.10.0.0.20.0%40.80.70.50.90.22.192.168.16.10.0%42.82.82.73.00.13.192.168.10.1

五、firewalld防火墙基础

防火墙状态和规则

#查看防火墙运行状态 [root@rockydesk ~]# systemctl status firewalld.service ○ firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; preset: enabled) Active: inactive (dead) Docs: man:firewalld(1) #开启 [root@rockydesk ~]# systemctl start firewalld.service #查看规则 [root@rockydesk ~]# firewall-cmd --list-all public (default, active) target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: ens160 sources: services: cockpit dhcpv6-client ssh ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: [root@rockydesk ~]#

@马哥教育

查看全文

http://www.jsqmd.com/news/1341084/