CentOs网络管理:ifconfig家族,iproute家族及配置文件
在centos的网络管理中ifcfg家族一直占有举足轻重的位置,这个家族陪伴着centos走过了艰苦创业的青春岁月。但是按照社会法则,逐渐壮大的centos正在逐渐冷落这个糟糠之妻,迎娶对自己前途更有帮助的更庞大的家族--iproute家族。ifcfg家族正在滑向冷宫,iproute家族即将入住正宫。
ifcfg命令家族
ifconfig命令:用于接口及地址查看和管理
ifconfig 显示一启用的网卡信息
[root@yph7 ~]# ifconfig----------显示已启用的网络接口的状态信息 eno16777736: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 172.16.59.1 netmask 255.255.0.0 broadcast 172.16.255.255 inet6fe80::20c:29ff:fe90:fa11 prefixlen64 scopeid 0x20<link> ether00:0c:29:90:fa:11 txqueuelen 1000 (Ethernet) RX packets 641674 bytes 40563451 (38.6 MiB) RX errors 0 dropped 169 overruns 0 frame 0 TX packets 18804 bytes 10014415 (9.5 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10<host> loop txqueuelen 0 (Local Loopback) RX packets 131 bytes 7618 (7.4 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 131 bytes 7618 (7.4 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
ifconfig -a:显示所有接口,包括inactive状态的接口;
[root@yph7 ~]# ifconfig –a -------发现多了一块网卡,这块网卡未被启用 eno16777736:flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet172.16.59.1 netmask 255.255.0.0 broadcast 172.16.255.255 inet6fe80::20c:29ff:fe90:fa11 prefixlen64 scopeid 0x20<link> ether00:0c:29:90:fa:11 txqueuelen 1000 (Ethernet) RXpackets 646011 bytes 40828485 (38.9 MiB) RXerrors 0 dropped 169 overruns 0 frame 0 TXpackets 18835 bytes 10018077 (9.5 MiB) TXerrors 0 dropped 0 overruns 0 carrier 0 collisions 0 eno33554984:flags=4098<BROADCAST,MULTICAST> mtu 1500 - ether00:0c:29:90:fa:1b txqueuelen 1000 (Ethernet) RXpackets 0 bytes 0 (0.0 B) RXerrors 0 dropped 0 overruns 0 frame 0 TXpackets 0 bytes 0 (0.0 B) TXerrors 0 dropped 0 overruns 0 carrier 0 collisions 0 lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536 inet127.0.0.1 netmask 255.0.0.0 inet6::1 prefixlen 128 scopeid 0x10<host> loop txqueuelen 0 (Local Loopback) RXpackets 131 bytes 7618 (7.4 KiB) RXerrors 0 dropped 0 overruns 0 frame 0 TXpackets 131 bytes 7618 (7.4 KiB) TXerrors 0 dropped 0 overruns 0 carrier 0 collisions 0
查看指定网络接口的状态信息:
[root@yph7 ~]# ifconfigeno33554984 eno33554984:flags=4098<BROADCAST,MULTICAST> mtu 1500 ether 00:0c:29:90:fa:1b txqueuelen 1000 (Ethernet) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 0 bytes 0 (0.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
配置IP地址、掩码:
ifconfig IFACE IP/MASK [up|down]
为指定网络接口配置ip和子网掩码,并能够启用或停用此网络接口
----设置ip和netmask,并启用该网卡,下图出现“up”说明该网卡已启用
另外一种设置子网掩码的方式:
ifconfig IFACE IP netmask NETMASK
[root@yph7 ~]# ifconfig eno33554984 192.168.254.254netmask 255.255.255.0
[root@yph7 ~]# ifconfig eno33554984
eno33554984: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
inet192.168.254.254 netmask255.255.255.0 broadcast 192.168.254.255
ether00:0c:29:90:fa:1b txqueuelen 1000 (Ethernet)
RXpackets 0 bytes 0 (0.0 B)
RXerrors 0 dropped 0 overruns 0 frame 0
TXpackets 0 bytes 0 (0.0 B)
TXerrors 0 dropped 0 overruns 0 carrier 0 collisions 0
停用此网卡,“up”消失,说明此网卡已经停用
删除IP地址:
[root@yph7 apache2]# ifconfig eth0 0 删除eth0的ip地址 [root@yph7 apache2]# ifconfig eth0 查看eth0的信息 eth0 Link encap:Ethernet HWaddr 00:0C:29:40:7C:9B inet6 addr: fe80::20c:29ff:fe40:7c9b/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:3518 errors:0 dropped:0 overruns:0 frame:0 TX packets:208 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:331302 (323.5 KiB) TX bytes:56048 (54.7 KiB)
ifconfig [-]promisc混杂模式启用或关闭
开启混杂模式
关闭混杂模式,“PROMISC”消失
注意:ifconfig命令会立即送往内核中的TCP/IP协议栈,并生效;
route命令:路由查看及管理
路由条目类型:
主机路由:目标地址为单个IP;
网络路由:目标地址为IP网络;
默认路由:目标为任意网络,0.0.0.0/0.0.0.0
查看:显示查看路由条目
route -n以数字格式显示路由信息,而不要反解,因为反解会消耗系统资源的
[root@yph7 ~]# route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 172.16.0.1 0.0.0.0 UG 100 0 0 eno16777736 172.16.0.0 0.0.0.0 255.255.0.0 U 100 0 0 eno16777736 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eno33554984
Destination指目标网络的地址,Genmask指目标网络的掩码。
Gateway指下一跳网关地址,Gateway为0.0.0.0说明不需要网关,直连路由。
Metric指到达这个地址需要的开销
Flags:路由条目的状态,U表示启用。G表示网关,但不一定是默认网关。
Iface:自己本地的网卡接口
添加一个路由,格式:
route add [-net|-host] target [netmask NETMASK] [gw GW] [[dev] If]
添加一个路由:以10.0.0.0/8为目的,以192.168.0.1为下一跳,通过eno33554984接口
由于10.0.0.0为网络地址,所以用-net。
下一跳地址必须是自己Destination能到的,由于我有两个网卡,其中一块网卡的IP为192.168.0.5,所以其Destination为192.168.0.0,所以如果要通过这块网卡添加路由的时候,gw就必须是192.168.0.x;通过另一块网卡添加是也是同一道理。
[root@yph7 ~]# route add -net 10.0.0.0/8 gw 192.168.0.1 eno33554984 [root@yph7 ~]# route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 172.16.0.1 0.0.0.0 UG 100 0 0 eno16777736 10.0.0.0 192.168.0.1 255.0.0.0 UG 0 0 0 eno33554984 172.16.0.0 0.0.0.0 255.255.0.0 U 100 0 0 eno16777736 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eno33554984
添加默认网关,下面这两种添加方式结果是一样的,default相当于-net 0.0.0.0/0.0.0.0
[root@yph7 ~]# route add default gw 192.168.0.2 [root@yph7 ~]# route add -net 0.0.0.0 netmask 0.0.0.0 gw 192.168.0.2 [root@yph7 ~]# route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.0.2 0.0.0.0 UG 0 0 0 eno33554984 0.0.0.0 172.16.0.1 0.0.0.0 UG 100 0 0 eno16777736 10.0.0.0 192.168.0.1 255.0.0.0 UG 0 0 0 eno33554984 172.16.0.0 0.0.0.0 255.255.0.0 U 100 0 0 eno16777736 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eno33554984
删除路由:
route del [-net|-host] target [gw Gw] [netmask Nm] [[dev] If]
删除默认网关:
[root@yph7 ~]# route del default [root@yph7 ~]# route -n Kernel IP routing table ----------以192.168.0.2为gw的默认网关已经没了 Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 172.16.0.1 0.0.0.0 UG 100 0 0 eno16777736 10.0.0.0 192.168.0.1 255.0.0.0 UG 0 0 0 eno33554984 172.16.0.0 0.0.0.0 255.255.0.0 U 100 0 0 eno16777736 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eno33554984
删除如果有重复的Destination的话,就必须指定gw
[root@yph7 ~]# route del -net 10.0.0.0/8 gw 192.168.0.1 [root@yph7 ~]# route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 172.16.0.1 0.0.0.0 UG 100 0 0 eno16777736 172.16.0.0 0.0.0.0 255.255.0.0 U 100 0 0 eno16777736 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eno33554984
netstat命令:
Print networkconnections, routing tables, interface statistics, masquerade connections, andmulticast memberships,显示网络连接状态,接口状态,路由表等信息。
netstat -rn显示路由表,与route –n相似
-r:routing,显示内核路由表
-n:数字格式
[root@yph7 ~]#netstat -rn Kernel IP routingtable Destination Gateway Genmask Flags MSS Window irtt Iface 0.0.0.0 172.16.0.1 0.0.0.0 UG 0 0 0 eno16777736 172.16.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eno16777736
显示网络连接:
-t:显示已经建立的TCP协议的相关连接,连接均有其状态;FSM(Finate State Machine)有限状态机包含的状态;
[root@yph7 ~]# netstat -t Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 52 localhost:ssh localhost:49973 ESTABLISHED
如果加上-n就不会反解主机名,直接以数字显示
[root@yph7 ~]# netstat -tn Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 52 172.16.59.1:22 172.16.59.0:49973 ESTABLISHED
proto:协议
recv-Q:接收队列,等待接收的队列长度
send-Q:发送队列,等待发送的长度
LocalAddress:本地主机地址
Foreign Address:远程连接地址
State:所处的状态
-u:UDP已经进行的相关的连接,没有状态概念了
[root@yph7 ~]# netstat -un -------由于有udp相关服务,所以没法显示 Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State [root@yph7 ~]#
-w:raw socket裸套接字相关的连接
-l:处于监听状态的连接,一直处于等待接待别人的状态。
-a:所有状态
-n:以数字格式显示IP和Port;
-e:扩展格式;user为0说明是root启动此进程,Inode表示对应的套接字文件的inode号
[root@yph7 ~]# netstat -tne Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State User Inode tcp 0 0 172.16.59.1:22 172.16.59.0:49973 ESTABLISHED 0 20867
-p:显示相关的进程及PID;
常用组合:
-tnl:加上l说明处于监听状态,一直在全神贯注的关注着网络信息,State变成了“LISTEN”
[root@yph7 ~]# netstat -tnl Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN tcp6 0 0 :::22 :::* LISTEN tcp6 0 0 ::1:25 :::* LISTEN
-unl:监听udp,因为udp没有状态一说,所以State一栏就没有内容
[root@yph7 ~]# netstat -unl Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State udp 0 0 0.0.0.0:123 0.0.0.0:* udp 0 0 127.0.0.1:323 0.0.0.0:* udp6 0 0 :::123 :::* udp6 0 0 ::1:323 :::*
-tunlp:同时监听tcp和udp,PID指的是哪个进程在监听。
[root@yph7 ~]# netstat -tnulp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1037/sshd tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 2163/master tcp6 0 0 :::22 :::* LISTEN 1037/sshd tcp6 0 0 ::1:25 :::* LISTEN 2163/master udp 0 0 0.0.0.0:123 0.0.0.0:* 807/chronyd udp 0 0 127.0.0.1:323 0.0.0.0:* 807/chronyd udp6 0 0 :::123 :::* 807/chronyd udp6 0 0 ::1:323 :::* 807/chronyd
-tan: 显示tcp状态机里所有状态链接。如下,既显示通信状态的链接,又显示监听等状态
[root@yph7 ~]# netstat -tan Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN tcp 0 52 172.16.59.1:22 172.16.59.0:49973 ESTABLISHED tcp6 0 0 :::22 :::* LISTEN tcp6 0 0 ::1:25 :::* LISTEN
-uan:如下,由于udp暂时没有通信,所以只显示了监听状态的链接
[root@yph7 ~]# netstat -uan Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State udp 0 0 0.0.0.0:123 0.0.0.0:* udp 0 0 127.0.0.1:323 0.0.0.0:* udp6 0 0 :::123 :::* udp6 0 0 ::1:323 :::*
传输层协议:
tcp:面向连接的协议;通信开始之前,要建立一个虚链路;通信完成后还要拆除连接;类似打电话,双方都要准备,双方都要被占线,结束后要解除联系,否则别人就打不进来。
udp:无连接的协议;直接发送数据报文;类似写信,发过去不需让对方确认,不会占线。
显示接口的统计数据:
netstat {--interfaces|-I|-i} [iface] [--all|-a] [--extend|-e] [--verbose|-v] [--program|-p] [--numeric|-n]
-i:显示所有接口的相关统计信息
[root@yph7 ~]# netstat -i Kernel Interface table Iface MTU RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg eno16777 1500 9504 0 17 0 1104 0 0 0 BMRU eno33554 1500 0 0 0 0 0 0 0 0 BMU lo 65536 6 0 0 0 6 0 0 0 LRU
-I<IFace>:显示指定指定接口的相关统计信息,注意:“-I”和接口名之间没有空格
[root@yph7 ~]# netstat -Ieno33554984 Kernel Interface table Iface MTU RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg eno33554 1500 0 0 0 0 0 0 0 0 BMU
ifup/ifdown命令:启用或禁某网卡
注意:通过配置文件/etc/sysconfig/network-scripts/ifcfg-IFACE来识别接口并完成配置;如果新添加的网卡没有配置文件,必须手动添加后再使用此命令。例如我要手动添加/etc/sysconfig/network-scripts/ifcfg-eno33554984这个配置文件后才可以使用这两个命令。
hostname查看和配置主机名:
查看主机名:
[root@yph7 ~]# hostname yph7.localdomain
配置主机名:但只对当前系统有效,重启后无效;而且是在设置好主机名后,系统重启前这个范围登陆的用户生效。也就是是说设置好主机名后,退出登陆再登陆才生效,所以下面的例子并没有看到生效。
[root@yph7 ~]# hostname vbird [root@yph7 ~]# hostname vbird
hostnamectl命令:只适用于CentOS 7。 查看帮助用hostnamectl --help
hostnamectl status:显示当前主机名的详细信息;
[root@yph7 ~]# hostnamectl status Static hostname: yph7.localdomain Transient hostname: yph7 Icon name: computer-vm Chassis: vm Machine ID: 0ceb40c75866411c8ccc966de90ff915 Boot ID: 0d23420528e0406480bb2ba9d87aaaec Virtualization: vmware Operating System: CentOS Linux 7 (Core) CPE OS Name: cpe:/o:centos:centos:7 Kernel: Linux 3.10.0-229.el7.x86_64 Architecture: x86_64
hostnamectl set-hostname NAME:设定主机名,永久有效;但必须重新登陆的shell才生效
[root@yph7 ~]# hostnamectl set-hostname vbird [root@yph7 ~]# cat /etc/hostname -------查看配置文件里的名字是否改变 vbird .........................重新登陆一下,下面可以看到新的主机名已经生效了 Hello,root Welcome to login,the time is 2015-12-27-21:55:46 [root@vbird ~]#
主机名的配置文件
centos6:/etc/sysconfig/network
centos7:/etc/hostname
配置DNS服务器指向:把ip地址解析成主机名或把主机名解析成ip地址
编辑配置文件:/etc/resolv.conf
nameserver DNS_SERVER_IP
例如:nameserver 202.106.195.68
最多可配置三个
如何测试,看DNS是否生效(host/nslookup/dig):
hosts文件的作用:
[root@yph7 ~]# cat /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 172.16.0.1 www.baidu.com g.cn google
如上所示,修改hosts文件,在最后一行添加一个IP和主机的解析,并给172.16.0.1添加了好几个别名,从下面可以看出,我不论ping的是www.baidu.com,还是g.cn还是google最终都会解析到172.16.0.1这个主机上。只是这样一来就不能用www.baidu.com这个域名上百度了。
[root@yph7 ~]# ping www.baidu.com PING www.baidu.com (172.16.0.1) 56(84) bytes of data. [root@yph7 ~]# ping g.cn PING www.baidu.com (172.16.0.1) 56(84) bytes of data. [root@yph7 ~]# ping google PING www.baidu.com (172.16.0.1) 56(84) bytes of data.
dig -t A FQDN,把主机名解析成ip地址,直接拿ip地址也可以访问网站
[root@yph7 ~]# dig -t A www.magedu.com 600 IN A 101.200.188.230
dig -x IP:将ip解析成主机名
不过大多网站都是进行这样反解析的,所以很可能不成功
iproute家族
iproute的版本号与内核是一一致的,因为iproute很多设置是直接放置到内核中去的。(想要验证版本号的话请用:rpm -qi iproute;查看内核版本用uname -r)
ip命令:
show / manipulaterouting, devices, policy routing and tunnels
ip OBJECT:link、addr 、 route 、 netns
ip link: network device configuration完成网络设备配置,查看帮助用ip link help
注意: ip link set 可简写成ip li se
ip link set - change device attributes管理设备属性
dev NAME(default):指明要管理的设备,dev这个关键字可省略;
up和down:启用和禁用网卡
禁用网卡
[root@yph7 ~]# ip link set eno33554984 down [root@yph7 ~]# ip link list 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 2: eno16777736: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT qlen 1000 link/ether 00:0c:29:90:fa:11 brd ff:ff:ff:ff:ff:ff 3: eno33554984: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast state DOWN mode DEFAULT qlen 1000 link/ether 00:0c:29:90:fa:1b brd ff:ff:ff:ff:ff:ff
启用网卡
[root@yph7 ~]# ip link set eno33554984 up ----请用此网卡,“up”标志又回来了 [root@yph7 ~]# ip link list dev eno33554984 3: eno33554984: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN mode DEFAULT qlen 1000 link/ether 00:0c:29:90:fa:1b brd ff:ff:ff:ff:ff:ff
multicast on或multicast off:启用或禁用多播功能;
禁用多播功能
[root@yph7 ~]# ip link set eno33554984 multicast off [root@yph7 ~]# ip link show eno33554984 --------可看出多播功能已经关闭 3: eno33554984: <NO-CARRIER,BROADCAST,UP> mtu 1500 qdisc pfifo_fast state DOWN mode DEFAULT qlen 1000 link/ether 00:0c:29:90:fa:1b brd ff:ff:ff:ff:ff:ff
启用多播功能
[root@yph7 ~]# ip link set eno33554984 multicast on [root@yph7 ~]# ip link list eno33554984 -----------可以看出多播功能又会来了 3: eno33554984: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN mode DEFAULT qlen 1000 link/ether 00:0c:29:90:fa:1b brd ff:ff:ff:ff:ff:ff
name NAME:为网络接口重命名
[root@yph7 ~]# ip link set eno33554984 down --------改名前先禁用网卡 [root@yph7 ~]# ip link set eno33554984 name eno33333333 [root@yph7 ~]# ip link show ------------------网卡重命名成功 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 2: eno16777736: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT qlen 1000 link/ether 00:0c:29:90:fa:11 brd ff:ff:ff:ff:ff:ff 3: eno33333333: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast state DOWN mode DEFAULT qlen 1000 link/ether 00:0c:29:90:fa:1b brd ff:ff:ff:ff:ff:ff
mtu NUMBER:设置MTU的大小,默认为1500;
[root@yph7 ~]# ip link set eno33554984 mtu 1200 [root@yph7 ~]# ip link list eno33554984 -----------mtu已经变成1200了 3: eno33554984: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1200 qdisc pfifo_fast state DOWN mode DEFAULT qlen 1000 link/ether 00:0c:29:90:fa:1b brd ff:ff:ff:ff:ff:ff
ip link show - display device attributes显示设备属性ip ; link help - 显示简要使用帮助。
ip link list:用法与ip link show 相似
[root@yph7 ~]# ip link show ----显示出所有网卡的状态,包括未启用的网卡 [root@yph7 ~]# ip link show eno33554984 -------显示指定网络接口的状态
ip netns: - manage network namespaces.管理网络用户空间
netns PID:ns为namespace,用于将接口移动到指定的网络名称空间;可用此方法构建非常复杂的虚拟网络。只有centos7可以用
ip netns list:列出所有的netns;可以简写:ip link list或ip li li
ip netns add NAME:创建指定的netns
ip netns del NAME:删除指定的netns
ip netns exec NAME COMMAND:在指定的netns中运行命令
[root@yph7 ~]# ip netns add mynet --------添加新的网络名称空间 [root@yph7 ~]# ip netns list -------查看是否添加成功 mynet [root@yph7 ~]# ip link show -----------现在一共有两块网卡 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 2: eno16777736: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT qlen 1000 link/ether 00:0c:29:90:fa:11 brd ff:ff:ff:ff:ff:ff 3: eno33333333: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast state DOWN mode DEFAULT qlen 1000 link/ether 00:0c:29:90:fa:1b brd ff:ff:ff:ff:ff:ff [root@yph7 ~]# ip link set eno33333333 netns mynet ---将指定网卡移动到网络名称空间 [root@yph7 ~]# ip link show ---------------现在只剩一块网卡,因为另一块被移走了 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 2: eno16777736: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT qlen 1000 link/ether 00:0c:29:90:fa:11 brd ff:ff:ff:ff:ff:ff [root@yph7 ~]# ip netns exec mynet ip link show ----类似进入虚拟世界执行ip link show命令 1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN mode DEFAULT link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 3: eno33333333: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT qlen 1000 link/ether 00:0c:29:90:fa:1b brd ff:ff:ff:ff:ff:ff [root@yph7 ~]# ip netns del mynet -------------删除虚拟网络名称空间 [root@yph7 ~]# ip link show -----------------我们的网卡又回到现实世界中来了 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 2: eno16777736: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT qlen 1000 link/ether 00:0c:29:90:fa:11 brd ff:ff:ff:ff:ff:ff 3: eno33554984: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN mode DEFAULT qlen 1000 link/ether 00:0c:29:90:fa:1b brd ff:ff:ff:ff:ff:ff
ip addr -protocol address management.管理ip网络接口地址
ip address add -add new protocol address添加新的协议地址
ip addr add IFADDR dev IFACE
[root@yph7 apache2]# ip addr add 192.168.100.10/24 dev eth0 [root@yph7 apache2]# ip addr add 192.168.100.20/24 dev eth0 [root@yph7 apache2]# ip addr add 10.0.0.0/8 dev eth0 ---给eth0添加3个ip地址 [root@yph7 apache2]# ip addr show eth0 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:40:7c:9b brd ff:ff:ff:ff:ff:ff inet 192.168.100.10/24 scope global eth0 inet 10.0.0.0/8 scope global eth0 ----------eth0有三个ip地址 inet 192.168.100.20/24 scope global secondary eth0---为secondary,因为前面有了一个同一网段的ip inet6 fe80::20c:29ff:fe40:7c9b/64 scope link valid_lft forever preferred_lft forever
label NAME:为额外添加的地址指明接口别名;给某一接口的ip地址都添加一个别名,用ifconfig命令才能查看到接口的所有ip。
[root@yph7 apache2]# ip addr add 192.168.100.1 dev eth0 [root@yph7 apache2]# ip addr add 192.168.100.2 dev eth0 label eth0:0 [root@yph7 apache2]# ifconfig eth0 Link encap:Ethernet HWaddr 00:0C:29:40:7C:9B inet addr:192.168.100.1 Bcast:0.0.0.0 Mask:255.255.255.255---没指定掩码的结果 ...................................................... eth0:0 Link encap:Ethernet HWaddr 00:0C:29:40:7C:9B inet addr:192.168.100.2 Bcast:0.0.0.0 Mask:255.255.255.255 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
broadcast ADDRESS:广播地址;会根据IP和NETMASK自动计算得到,所以一般不用我们手动设定
scope SCOPE_VALUE:下面是scope的三个选项
global:全局可用;别人可以ping通
link:接口可用;别人ping不通,自己可以ping通
host:仅本机可用;除本主机以外的主机看不到这个ip
ip address delete- delete protocol address删除指定接口的指定ip地址
ip addr delete IFADDR dev IFACE
[root@yph7 apache2]# ip addr add 192.168.100.2/24 dev eth0 [root@yph7 apache2]# ip addr del 192.168.100.2/24 dev eth0 [root@yph7 apache2]# ip addr show dev eth0 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:40:7c:9b brd ff:ff:ff:ff:ff:ff inet 192.168.100.1/32 scope global eth0
ip address show -look at protocol addresses
ip addr list [IFACE]:显示接口的地址;
ip address flush- flush protocol addresses清空指定接口所有的ip地址
ip addr flush dev IFACE
[root@yph7 apache2]# ip addr show eth0 -----eth0原有3个ip 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:40:7c:9b brd ff:ff:ff:ff:ff:ff inet 192.168.100.10/24 scope global eth0 inet 10.0.0.0/8 scope global eth0 inet 192.168.100.20/24 scope global secondary eth0 inet6 fe80::20c:29ff:fe40:7c9b/64 scope link valid_lft forever preferred_lft forever [root@yph7 apache2]# ip addr flush eth0 -----------清空eth0的所有ip地址 Failed to send flush request: Cannot assign requested address [root@yph7 apache2]# ip addr list eth0 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:40:7c:9b brd ff:ff:ff:ff:ff:ff
ip route -routing table management实现路由表管理
ip route add -add new route
ip route change -change route
ip route replace- change or add new one替换路由
ip route add TYPE PREFIX via GW [dev IFACE] [src SOURCE_IP]
src是你网卡的ip,只有你网卡的ip被设置多个时才有必要指定src。例如你给某网卡配置了三个ip,src应为这三个ip中的某一个。
[root@yph7 ~]# ip addr add 172.16.10.20/16 dev eth2 增加一个新IP [root@yph7 ~]# ip addr list dev eth2 3: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:40:7c:a5 brd ff:ff:ff:ff:ff:ff inet 192.168.0.106/24 brd 192.168.0.255 scope global eth2 inet 172.16.10.20/16 scope global eth2 inet6 fe80::20c:29ff:fe40:7ca5/64 scope link valid_lft forever preferred_lft forever
利用新IP添加一个新路由
[root@yph7 ~]# ip route add 192.168.10.0/24 via 172.16.0.20 dev eth2 src 172.16.10.20 [root@yph7 ~]# ip route list 192.168.0.0/24 dev eth0 proto kernel scope link src 192.168.0.110 192.168.0.0/24 dev eth2 proto kernel scope link src 192.168.0.106 metric 1 192.168.10.0/24 via 172.16.0.20 dev eth2 src 172.16.10.20 172.16.0.0/16 dev eth2 proto kernel scope link src 172.16.10.20 169.254.0.0/16 dev eth0 scope link metric 1002 default via 192.168.0.1 dev eth0 proto static
添加默认路由:
[root@yph7 ~]# ip route add default via 172.16.0.10 dev eth2 src 172.16.10.20 [root@yph7 ~]# ip route list via 172.16.0.10 default dev eth2 src 172.16.10.20
第一次写错提示“RTNETLINK answers: Network is unreachable”,后来发现把eth2写错成eth0了。
ip route del TYPE PRIFIX 删除路由
[root@yph7 ~]# ip route del default [root@yph7 ~]# ip route del 192.168.0.0/24 dev eth0 [root@yph7 ~]# ip route del 192.168.10.0/24 一连删除了三个路由 [root@yph7 ~]# ip route list 192.168.0.0/24 dev eth2 proto kernel scope link src 192.168.0.106 metric 1 172.16.0.0/16 dev eth2 proto kernel scope link src 172.16.10.20 169.254.0.0/16 dev eth0 scope link metric 1002
ip route show -,显示路由,可以指定via、src等
[root@yph7 ~]# ip route show src 172.16.10.20 172.16.0.0/16 dev eth2 proto kernel scope link
ip route flush -flush routing tables清空某类路由
[root@yph7 ~]# ip route flush 169/8 ---凡是169网段的都删掉,但不一定能删掉系统创建的路由 [root@yph7 ~]# ip route list 192.168.0.0/24 dev eth2 proto kernel scope link src 192.168.0.106 metric 1 172.16.0.0/16 dev eth2 proto kernel scope link src 172.16.10.20 169.254.0.0/16 dev eth0 scope link metric 1002 default via 172.16.0.10 dev eth2 src 172.16.10.20
[root@yph7 ~]# ip route flush 169.254/16---在上面的基础上把范围再精确一些,发现就能删掉了 [root@yph7 ~]# ip route list 192.168.0.0/24 dev eth2 proto kernel scope link src 192.168.0.106 metric 1 172.16.0.0/16 dev eth2 proto kernel scope link src 172.16.10.20 default via 172.16.0.10 dev eth2 src 172.16.10.20
ip route get -get a single route 查看单条路由
ip route get TYPE PRIFIX
[root@yph7 ~]# ip route get 192.168.0.0/24 broadcast 192.168.0.0 dev eth0 src 192.168.0.110 cache <local,brd> mtu 1500 advmss 1460 hoplimit 64
ss命令:是显示socket的工具,被设计用来独爱netstat的工具
ss [options] [ FILTER ]
选项:
-t:TCP协议的相关连接
-u:UDP相关的连接
-w:raw socket相关的连接
-l:监听状态的连接
-a:所有状态的连接
-n:数字格式
-p:相关的程序及其PID
-e:扩展格式信息
下面两个是netstat没有的:
-m:内存用量
-o:计时器信息
[root@yph7 ~]# ss -m State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 52 192.168.0.110:ssh 192.168.0.104:51158 mem:(r0,w604,f3492,t0) [root@yph7 ~]# ss -o State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 52 192.168.0.110:ssh 192.168.0.104:51158 timer:(on,370ms,0)
FILTER := [ stateTCP-STATE ] [ EXPRESSION ] 只看相关状态的链接
TCP的常见状态:
TCP FSM:
LISTEN:监听
ESTABLISEHD:建立的连接,双方正在通话
FIN_WAIT_1:一方提出分手,在等待回应
FIN_WAIT_2:分就分,答应分手
SYN_SENT:
SYN_RECV:
CLOSED:
[root@yph7 ~]# ss -tan state CLOSED 没有这种状态的进程 Recv-Q Send-Q Local Address:Port Peer Address:Port
[root@yph7 ~]# ss -tan state ESTABLISHED Recv-Q Send-Q Local Address:Port Peer Address:Port 0 52 192.168.0.110:22 192.168.0.104:51158
EXPRESSION:
dport = 目标端口
sport = 源端口
例如:'( dport = :22or sport = :22)' 把源端口或目标端口为22号端口的都显示出来
[root@yph7 ~]# ss -tan state ESTABLISHED '( dport = :22 or sport = :22 )' Recv-Q Send-Q Local Address:Port Peer Address:Port 0 52 192.168.0.110:22 192.168.0.104:51158
[root@yph7 ~]# ss -tan '( dport = :22 or sport = :22 )' State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 :::22 :::* LISTEN 0 128 *:22 *:* ESTAB 0 52 192.168.0.110:22 192.168.0.104:51158
配置文件:
IP/NETMASK/GW/DNS等属性的配置文件为:
/etc/sysconfig/network-scripts/ifcfg-IFACE
例如: /etc/sysconfig/network-scripts/ifcfg-eno16777736
/etc/sysconfig/network-scripts/ifcfg-eth0
路由属性配置文件为:
/etc/sysconfig/network-scripts/route-IFACE
配置文件的修改:
1、通过vim等文本编辑器直接修改
2、使用命令的进行修改
CentOS 6:system-config-network 或者setup
CentOS 7: nmtui
ifcfg-IFACE配置文件参数:
DEVICE:此配置文件对应的设备的名称;
ONBOOT:在系统引导过程中,是否激活此接口;
UUID:此设备的惟一标识;
IPV6INIT:是否初始化IPv6;
BOOTPROTO:激活此接口时使用什么协议来配置接口属性(ip),常用的有dhcp、bootp、static、none(其实也是静态);
TYPE:接口类型,常见的有Ethernet, Bridge;
DNS1:第一DNS服务器指向;
DNS2:备用DNS服务器指向;
DOMAIN:DNS搜索域;
IPADDR: IP地址;
NETMASK:子网掩码;CentOS 7支持使用PREFIX以长度方式指明子网掩码(PREFIX=16);
GATEWAY:默认网关;
USERCTL:是否允许普通用户控制此设备;
PEERDNS:如果BOOTPROTO的值为“dhcp”,是否允许dhcpserver分配的dns服务器指向覆盖本地手动指定的DNS服务器指向;默认为yes;
HWADDR:设备的MAC地址;这个不用配置,因为是网卡自带的
NM_CONTROLLED:是否使用NetworkManager服务来控制接口;对centos6一般为no;centos7为yes
为eth2手动配置文件(centos6):
[root@yph7 network-scripts]# cp ifcfg-eth0 ifcfg-eth2 [root@yph7 network-scripts]# vim ifcfg-eth2 [root@yph7 network-scripts]# cat ifcfg-eth2 DEVICE="eth2" BOOTPROTO="none" NM_CONTROLLED="no" ONBOOT="yes" TYPE="Ethernet" IPADDR=10.100.100.10 NETMASK=255.0.0.0
[root@yph7 network-scripts]# service network restart -------重启网卡 [root@yph7 network-scripts]# ip addr list dev eth2 ----发现刚才的配置应经生效了 3: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:40:7c:a5 brd ff:ff:ff:ff:ff:ff inet 10.100.100.10/8 brd 10.255.255.255 scope global eth2 inet6 fe80::20c:29ff:fe40:7ca5/64 scope link valid_lft forever preferred_lft forever
为eno33554984配置文件(centos7):
从eno16777737复制过去,然后编辑成下面样式
NAME="eno33554984" DEVICE="eno33554984" ONBOOT=yes NETBOOT=yes IPV6INIT=no BOOTPROTO=none TYPE=Ethernet DEFROUTE=yes IPADDR=172.10.100.10 PREFIX=24
网络服务:
network和NetworkManager
centos6中最好用network
centos7用NetworkManager
管理网络服务:
CentOS 6: service SERVICE {start|stop|restart|status(查看状态)}
CentOS 7:systemctl {start|stop|restart|status} SERVICE[.service]
配置文件修改之后,需要重启网络服务才能让配置文件生效哦;
CentOS 6:# service network restart
CentOS 7:# systemctl restart network.service
其实centos7也可与6的用法一样,只是不太正规。
配置非默认网关路由:/etc/sysconfig/network-scripts/route-IFACE
支持两种配置方式,但不可混用;
(1) 每行一个路由条目:
TARGET via GW
(2) 每三行一个路由条目:(#表示组号)
ADDRESS#=TARGET
NETMASK#=MASK
GATEWAY#=NEXTHOP
给eno33554984配置路由文件:
[root@yph7 network-scripts]# vim route-eno33554984
[root@yph7 network-scripts]# cat route-eno33554984
10.0.0.0/8 via 192.168.0.1
或者以下面的格式:
ADDRESS0=20.0.0.0
NETMASK0=255.0.0.0
GATEWAY0=192.168.10.2
给接口配置多个地址:
ip addr之外,ifconfig或配置文件都可以;
(1) 用ifconfig或ip addr 配置多个ip
[root@yph7 network-scripts]# ifconfig eth2:0 192.168.0.10
(2) 为网卡别名添加配置文件;
在上面讲的配置文件创建的基础上只需修改两项:
DEVICE="eth2:0"
IPADDR=
注意:BOOTPROTO:网上别名不支持动态获取地址;只支持static, none
nmcli:centos7上ip配置的另一个命令:
nmcli [ OPTIONS ] OBJECT { COMMAND | help }
device -- show andmanage network interfaces查看和管理网络接口
COMMAND = {status | show | connect | disconnect | delete | wifi | wimax }
[root@yph7 ~]# nmcli device show GENERAL.设备: eno16777736 GENERAL.类型: ethernet GENERAL.硬盘: 00:0C:29:90:FA:11 GENERAL.MTU: 1500 GENERAL.状态: 100 (连接的) GENERAL.CONNECTION: 有线连接 1 GENERAL.CON-PATH: /org/freedesktop/NetworkManager/ActiveConnection/0 WIRED-PROPERTIES.容器: 开 IP4.地址[1]: 192.168.0.111/24 IP4.网关: 192.168.0.1 IP4.DNS[1]: 211.140.197.58 IP4.DNS[2]: 211.137.32.178 IP6.地址[1]: fe80::20c:29ff:fe90:fa11/64 IP6.网关: fe80::512c:9097:f2a8:42f5
[root@yph7 ~]# nmcli device status 设备 类型 状态 CONNECTION eno16777736 ethernet 连接的 有线连接 1 eno33554984 ethernet 连接的 eno33554984 lo loopback 未管理 --
[root@yph7 ~]# nmcli device disconnect eno33554984 Device 'eno33554984' successfully disconnected.
[root@yph7 ~]# nmcli device status 设备 类型 状态 CONNECTION eno16777736 ethernet 连接的 有线连接 1 eno33554984 ethernet 已断开 -- lo loopback 未管理 --
connection -start, stop, and manage network connections开启、禁止、管理网络连接
COMMAND = { show| up | down | add | edit | modify | delete | reload | load }
[root@yph7 network-scripts]# nmcli conn down eno33554984 [root@yph7 network-scripts]# nmcli conn up eno33554984 [root@yph7 network-scripts]# nmcli conn show
如何修改IP地址等属性:
# nmcli conn modify IFACE [+|-]setting.property value
modify支持的属性如下:
ipv4.address
ipv4.gateway
ipv4.dns1
ipv4.method
manual
此命令不成熟,添加地址后,先down在up才能生效
[root@yph7 network-scripts]# nmcli conn modify eno33554984 +ipv4.address 192.168.200.10/24 [root@yph7 network-scripts]# nmcli conn down eno33554984 [root@yph7 network-scripts]# nmcli conn up eno33554984 [root@yph7 network-scripts]# nmcli conn show
[root@yph7 network-scripts]# nmcli conn modify eno33554984 -ipv4.address 192.168.200.10/24 [root@yph7 network-scripts]# nmcli conn down eno33554984 [root@yph7 network-scripts]# nmcli conn up eno33554984 [root@yph7 network-scripts]# nmcli conn show
免责声明:本站发布的内容(图片、视频和文字)以原创、转载和分享为主,文章观点不代表本网站立场,如果涉及侵权请联系站长邮箱:is@yisu.com进行举报,并提供相关证据,一经查实,将立刻删除涉嫌侵权内容。