Linux之网络工具

1 ifconfig：显示网卡信息

[root@localhost proc]# ifconfig

eth0      Link encap:Ethernet  HWaddr 00:0C:29:B8:90:BE  

          inet addr:192.168.154.128  Bcast:192.168.154.255  Mask:255.255.255.0

          inet6 addr: fe80::20c:29ff:feb8:90be/64 Scope:Link

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:3847 errors:0 dropped:0 overruns:0 frame:0

          TX packets:5152 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000 

          RX bytes:326187 (318.5 KiB)  TX bytes:882894 (862.2 KiB)

          Interrupt:19 Base address:0x2024 

2 arp：显示arp条目

[root@localhost proc]# arp

Address                  HWtype  HWaddress           Flags Mask            Iface

192.168.154.1            ether   00:50:56:c0:00:08   C                     eth0

192.168.154.2            ether   00:50:56:ec:fe:4a   C                     eth0

192.168.154.254          ether   00:50:56:f5:05:c8   C                     eth0

3 ethtool：查询和设置网卡参数

[root@localhost proc]# ethtool -P eth0            #查询端口位置

 

4 netstat：显示和网络相关的信息，网络连接、接口状态、路由信息等

[root@localhost proc]# netstat -r

Kernel IP routing table

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface

192.168.154.0   *               255.255.255.0   U         0 0          0 eth0

link-local      *               255.255.0.0     U         0 0          0 eth0

default         192.168.154.2   0.0.0.0         UG        0 0          0 eth0

[root@localhost proc]# netstat -anpt

Active Internet connections (servers and established)

Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name   

tcp        0      0 0.0.0.0:39709               0.0.0.0:*                   LISTEN      1643/rpc.statd      

tcp        0      0 0.0.0.0:3306                0.0.0.0:*                   LISTEN      2172/mysqld         

tcp        0      0 0.0.0.0:111                 0.0.0.0:*                   LISTEN      1621/rpcbind        

tcp        0      0 0.0.0.0:80                  0.0.0.0:*                   LISTEN      2412/nginx          

tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      1872/sshd           

tcp        0      0 127.0.0.1:631               0.0.0.0:*                   LISTEN      1699/cupsd          

tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      2289/master         

5 ping：测试网络的连通性

[root@localhost proc]# ping -c 5 www.qq.com

PING www.qq.com (120.198.201.156) 56(84) bytes of data.

64 bytes from 120.198.201.156: icmp_seq=1 ttl=128 time=12.9 ms

64 bytes from 120.198.201.156: icmp_seq=2 ttl=128 time=11.0 ms

64 bytes from 120.198.201.156: icmp_seq=3 ttl=128 time=10.4 ms

64 bytes from 120.198.201.156: icmp_seq=4 ttl=128 time=40.8 ms

64 bytes from 120.198.201.156: icmp_seq=5 ttl=128 time=13.5 ms

mtr：mtr命令把ping命令和tracepath命令合成了一个

[root@localhost proc]#mtr www.qq.com

6 lsof：列出系统当前打开的文件（在Linux中一切皆文件）

COMMAND    PID      USER   FD      TYPE     DEVICE SIZE/OFF       NODE NAME

init         1      root  cwd       DIR        8,2     4096          2 /

init         1      root  rtd       DIR        8,2     4096          2 /

init         1      root  txt       REG        8,2   153380       1666 /sbin/init

init         1      root  mem       REG        8,2    41812       4884 /lib/librt-2.12.so

init         1      root  mem       REG        8,2   146728       4880 /lib/ld-2.12.so

init         1      root  mem       REG        8,2  1911528       4882 /lib/libc-2.12.so

init         1      root  mem       REG        8,2    58728       1310 /lib/libnss_files-2.12.so

init         1      root  mem       REG        8,2   286396       4885 /lib/libdbus-1.so.3.4.0

init         1      root  mem       REG        8,2   122232       4911 /lib/libgcc_s-4.4.7-20120601.so.1

...

COMMAND：进程的名称

PID：进程标识符

USER：进程所有者

FD：文件描述符，应用程序通过文件描述符识别该文件。如cwd、txt等

TYPE：文件类型，如DIR、REG等

DEVICE：指定磁盘的名称

SIZE：文件的大小

NODE：索引节点（文件在磁盘上的标识）

NAME：打开文件的确切名称

显示某个端口是否被使用

[root@localhost proc]# lsof -i :3306

COMMAND  PID  USER   FD   TYPE DEVICE SIZE/OFF NODE NAME

mysqld  2172 mysql    3u  IPv4  14673      0t0  TCP *:mysql (LISTEN)

显示某个用户的进程打开的文件

[root@localhost proc]# lsof -u mysql

COMMAND  PID  USER   FD   TYPE     DEVICE SIZE/OFF   NODE NAME

mysqld  2172 mysql  cwd    DIR        8,3     4096   2668 /var/lib/mysql

mysqld  2172 mysql  rtd    DIR        8,2     4096      2 /

mysqld  2172 mysql  txt    REG        8,6  8064320   5203 /usr/libexec/mysqld

mysqld  2172 mysql  mem    REG        8,2    40296   4897 /lib/libcrypt-2.12.so

mysqld  2172 mysql  mem    REG        8,6   942040 670610 /usr/lib/libstdc++.so.6.0.13

mysqld  2172 mysql  mem    REG        8,2    15496   4901 /lib/libcom_err.so.2.1

mysqld  2172 mysql  mem    REG        8,2   907576   4902 /lib/libkrb5.so.3.3

mysqld  2172 mysql  mem    REG        8,2   171484   4900 /lib/libk5crypto.so.3.1

...

7 nslookup：域名解析查询

[root@localhost proc]# nslookup www.qq.com

Server:192.168.154.2

Address:192.168.154.2#53

Non-authoritative answer:

Name:www.qq.com

Address: 120.198.201.156

能实现域名查询的还有另一个命令：dig

[root@localhost proc]# dig www.qq.com

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.47.rc1.el6 <<>> www.qq.com

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47549

;; flags: qr rd cd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; WARNING: recursion requested but not available

;; QUESTION SECTION:

;www.qq.com.INA

;; ANSWER SECTION:

www.qq.com.5INA120.198.201.156

;; Query time: 11 msec

;; SERVER: 192.168.154.2#53(192.168.154.2)

;; WHEN: Tue May 16 10:53:23 2017

;; MSG SIZE  rcvd: 44

8 traceroute：跟踪报文路径，在Windows下为tracert

[root@localhost proc]# traceroute www.qq.com

traceroute to www.qq.com (120.198.201.156), 30 hops max, 60 byte packets

 1  192.168.154.2 (192.168.154.2)  0.125 ms  0.106 ms  0.410 ms

 2  * * *

 3  * * *

 4  * * *

 5  * * *

 6  * * *

 7  * * *

 8  * * *

 9  * * *

在Linux系统中，mtr也可以实现路由跟踪，而且结合了ping的功能，更加强大，但是默认没有安装。

[root@localhost proc]# mtr www.qq.com

9 route：查看路由信息

 

[root@localhost proc]# route

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

192.168.154.0   *               255.255.255.0   U     0      0        0 eth0

link-local      *               255.255.0.0     U     1002   0        0 eth0

default         192.168.154.2   0.0.0.0         UG    0      0        0 eth0

10 tcpdump：网络报文截获工具

指定端口：

[root@localhost proc]# tcpdump -i eth0             

...

11:18:14.179947 IP 192.168.154.1.57827 > 192.168.154.128.ssh: Flags [P.], seq 65:129, ack 253984, win 16425, length 64

11:18:14.180481 IP 192.168.154.128.ssh > 192.168.154.1.57827: Flags [P.], seq 253984:254384, ack 129, win 720, length 400

11:18:14.180845 IP 192.168.154.128.ssh > 192.168.154.1.57827: Flags [P.], seq 254384:254560, ack 129, win 720, length 176

11:18:14.181006 IP 192.168.154.1.57827 > 192.168.154.128.ssh: Flags [.], ack 254560, win 16281, length 0

指定主机，打印发出和收到的报文

[root@localhost proc]# tcpdump host 192.168.154.128

...

11:20:23.429911 IP 192.168.154.128.ssh > 192.168.154.1.57827: Flags [P.], seq 229536:229824, ack 1, win 720, length 288

11:20:23.437865 IP 192.168.154.128.ssh > 192.168.154.1.57827: Flags [P.], seq 229824:230000, ack 1, win 720, length 176

11:20:23.444348 IP 192.168.154.1.57827 > 192.168.154.128.ssh: Flags [.], ack 230000, win 16425, length 0

11:20:23.444371 IP 192.168.154.1.57827 > 192.168.154.128.ssh: Flags [P.], seq 1:65, ack 230000, win 16425, length 64

打印两台主机之间的报文

[root@localhost proc]# tcpdump host 192.168.154.128 and $192.168.154.1$

...

11:22:37.082668 IP 192.168.154.1.57827 > 192.168.154.128.ssh: Flags [.], ack 521392, win 16425, length 0

11:22:37.082893 IP 192.168.154.128.ssh > 192.168.154.1.57827: Flags [P.], seq 521392:521680, ack 209, win 720, length 288

11:22:37.090535 IP 192.168.154.128.ssh > 192.168.154.1.57827: Flags [P.], seq 521680:521856, ack 209, win 720, length 176

11:22:37.092395 IP 192.168.154.1.57827 > 192.168.154.128.ssh: Flags [.], ack 521856, win 16309, length 0

11:22:37.098430 IP 192.168.154.1.57827 > 192.168.154.128.ssh: Flags [P.], seq 209:273, ack 521856, win 16309, length 64

11:22:37.100106 IP 192.168.154.128.ssh > 192.168.154.1.57827: Flags [P.], seq 521856:522256, ack 273, win 720, length 400

打印主机发送的报文

[root@localhost proc]# tcpdump -i eth0 src 192.168.154.128

...

11:26:39.511627 IP 192.168.154.128.ssh > 192.168.154.1.57827: Flags [P.], seq 89264:89440, ack 1, win 720, length 176

11:26:39.517580 IP 192.168.154.128.ssh > 192.168.154.1.57827: Flags [P.], seq 89440:89616, ack 1, win 720, length 176

11:26:39.517883 IP 192.168.154.128.ssh > 192.168.154.1.57827: Flags [P.], seq 89616:89792, ack 1, win 720, length 176

11:26:39.520735 IP 192.168.154.128.ssh > 192.168.154.1.57827: Flags [P.], seq 89792:89968, ack 65, win 720, length 176

打印主机接收的报文

[root@localhost proc]# tcpdump -i eth0 dst 192.168.154.128

...

11:28:01.032800 IP 192.168.154.1.57827 > 192.168.154.128.ssh: Flags [.], ack 8337, win 16141, length 0

11:28:01.233749 IP 192.168.154.1.57827 > 192.168.154.128.ssh: Flags [.], ack 8497, win 16101, length 0

11:28:01.434811 IP 192.168.154.1.57827 > 192.168.154.128.ssh: Flags [.], ack 8657, win 16061, length 0

11:28:01.584687 IP 192.168.154.1.57827 > 192.168.154.128.ssh: Flags [P.], seq 48:112, ack 8817, win 16425, length 64

获取指定主机指定端口接收和发送的报文

[root@localhost proc]# tcpdump tcp port 80 and host 192.168.154.128 -v

12:30:38.368441 IP (tos 0x0, ttl 64, id 16834, offset 0, flags [DF], proto TCP (6), length 40)

    192.168.154.128.http > 192.168.154.1.64941: Flags [F.], cksum 0x2e4e (correct), seq 1, ack 2, win 457, length 0

12:30:38.368663 IP (tos 0x0, ttl 64, id 6217, offset 0, flags [DF], proto TCP (6), length 40)

    192.168.154.1.64941 > 192.168.154.128.http: Flags [.], cksum 0xefed (correct), ack 2, win 16425, length 0

12:30:38.369111 IP (tos 0x0, ttl 64, id 21138, offset 0, flags [DF], proto TCP (6), length 40)

    192.168.154.128.http > 192.168.154.1.64942: Flags [F.], cksum 0x76ed (correct), seq 1, ack 2, win 457, length 0

12:30:38.369321 IP (tos 0x0, ttl 64, id 6218, offset 0, flags [DF], proto TCP (6), length 40)

    192.168.154.1.64942 > 192.168.154.128.http: Flags [.], cksum 0x388d (correct), ack 2, win 16425, length 0

11 ss：显示socket状态，比netstat更强大和高效

-l：显示本地监听的所有端口

-t -a：显示所有TCP连接，a为显示所有套接字

-u -a：显示所有UDP连接

-o：显示计时器信息

显示所有ＴＣＰ连接：

[Vpnwjoj@stash ~]$ sudo ss -a -t

[root@localhost proc]# ss

显示所有打开的网络连接端口：

[root@localhost proc]# ss -l

 

[root@localhost bin]# ss -tnl

State       Recv-Q Send-Q                Local Address:Port                               Peer Address:Port              

LISTEN      0      128                               *:22                                            *:*                  

LISTEN      0      100                       127.0.0.1:25                                            *:*                  

LISTEN      0      100                              :::8080                                         :::*                  

LISTEN      0      128                              :::22                                           :::*                  

LISTEN      0      100                             ::1:25                                           :::*                  

LISTEN      0      1                  ::ffff:127.0.0.1:8005                                         :::*                  

LISTEN      0      100                              :::8009       

[root@localhost bin]# ss -o state established '( dport = :ssh or sport = :ssh )'

Netid Recv-Q Send-Q                 Local Address:Port                                  Peer Address:Port                

tcp   0      232                     192.168.3.56:ssh                                   192.168.3.17:59548                 timer:(on,375ms,0)

tcp   0      0                       192.168.3.56:ssh                                   192.168.3.17:56614                 timer:(keepalive,80min,0)

                                  :::*    

匹配本地地址和端口号：

[root@localhost proc]# ss src 192.168.154.128:80

State       Recv-Q Send-Q                                                                             Local Address:Port                                                                                 Peer Address:Port   

ESTAB       0      0                                                                                192.168.154.128:http                                                                                192.168.154.1:65206   

ESTAB       0      0                                                                                192.168.154.128:http                                                                                192.168.154.1:65212   

12 nmap：网络探测和安全审核工具

语法：nmap [扫描类型] [选项] 扫描目标

选项：-p：指定扫描的端口

      -n：禁用反向DNS解析（可以提高扫描速度）

扫描类型：

-sS, TCP SYN扫描，只向目标发出SYN数据包，如果收到SYN/ACK响应包就认为目标端口正在监听，并立即断开链接，否则会认为目标端口并未开放。

-sT，TCP连接扫描，这是完整的TCP扫描方式，用来建立TCP连接，如果成功则表示目标端口正在监听，否则表示端口并未开放。

-sP ICMP扫描：类似Ping检测快速判断目标主机是否存活。

[root@localhost proc]# nmap 192.168.154.1

Starting Nmap 5.51 ( http://nmap.org ) at 2017-05-16 12:59 CST

Nmap scan report for 192.168.154.1

Host is up (0.00030s latency).

Not shown: 997 filtered ports

PORT    STATE SERVICE

135/tcp open  msrpc

139/tcp open  netbios-ssn

445/tcp open  microsoft-ds

MAC Address: 00:50:56:C0:00:08 (VMware)

查看端口是否开启

[root@localhost proc]# nmap -p 22,80 192.168.154.1-10

Starting Nmap 5.51 ( http://nmap.org ) at 2017-05-16 13:00 CST

Nmap scan report for 192.168.154.1

Host is up (0.000065s latency).

PORT   STATE    SERVICE

22/tcp filtered ssh

80/tcp filtered http

MAC Address: 00:50:56:C0:00:08 (VMware)

Nmap scan report for 192.168.154.2

Host is up (0.00034s latency).

PORT   STATE  SERVICE

22/tcp closed ssh

80/tcp closed http

MAC Address: 00:50:56:EC:FE:4A (VMware)

查看哪些主机在线：

[root@localhost proc]# nmap -n -sP 192.168.154.0/24

Starting Nmap 5.51 ( http://nmap.org ) at 2017-05-16 13:01 CST

Nmap scan report for 192.168.154.1

Host is up (0.00021s latency).

MAC Address: 00:50:56:C0:00:08 (VMware)

Nmap scan report for 192.168.154.2

Host is up (0.0014s latency).

MAC Address: 00:50:56:EC:FE:4A (VMware)

Nmap scan report for 192.168.154.128

Host is up.

Nmap scan report for 192.168.154.254

Host is up (0.00040s latency).

MAC Address: 00:50:56:F5:05:C8 (VMware)

Nmap done: 256 IP addresses (4 hosts up) scanned in 4.43 seconds

本文转自 zengwj1949 51CTO博客，原文链接:http://blog.51cto.com/zengwj1949/1926177