Linux学习之旅之网络诊断工具一、IP目录族1、ip addrIP地址查看#查看IP详细信息rootubt2604ser:~# ip addr1: lo:LOOPBACK,UP,LOWER_UPmtu65536qdisc noqueue state UNKNOWN group default qlen1000link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet127.0.0.1/8 scopehostlo valid_lft forever preferred_lft forever inet6 ::1/128 scopehostnoprefixroute valid_lft forever preferred_lft forever2: ens32:BROADCAST,MULTICAST,UP,LOWER_UPmtu1500qdisc pfifo_fast state UNKNOWN group default qlen1000link/ether 00:0c:29:e9:1e:90 brd ff:ff:ff:ff:ff:ff altname enp2s0 altname enx000c29e91e90 inet10.0.0.4/24 brd10.0.0.255 scope global ens32 valid_lft forever preferred_lft forever inet6 fe80::20c:29ff:fee9:1e90/64 scopelinkproto kernel_ll valid_lft forever preferred_lft forever#指定网卡查看IProotubt2604ser:~# ip addr show ens322: ens32:BROADCAST,MULTICAST,UP,LOWER_UPmtu1500qdisc pfifo_fast state UNKNOWN group default qlen1000link/ether 00:0c:29:e9:1e:90 brd ff:ff:ff:ff:ff:ff altname enp2s0 altname enx000c29e91e90 inet10.0.0.4/24 brd10.0.0.255 scope global ens32 valid_lft forever preferred_lft forever inet6 fe80::20c:29ff:fee9:1e90/64 scopelinkproto kernel_ll valid_lft forever preferred_lft forever#简要信息rootubt2604ser:~# ip -r -br addrlo UNKNOWN localhost/8 ip6-localhost/128 ens32 UNKNOWN bogon/24 ubt2604ser/642、ip link网卡管理#查看网卡信息rootubt2604ser:~# ip link show1: lo:LOOPBACK,UP,LOWER_UPmtu65536qdisc noqueue state UNKNOWN mode DEFAULT group default qlen1000link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:002: ens32:BROADCAST,MULTICAST,UP,LOWER_UPmtu1500qdisc pfifo_fast state UNKNOWN mode DEFAULT group default qlen1000link/ether 00:0c:29:e9:1e:90 brd ff:ff:ff:ff:ff:ff altname enp2s0 altname enx000c29e91e90#启动网卡rootubt2604ser:~# ip link set ens32 up#关闭网卡生产环境慎用会断网rootubt2604ser:~# ip link set ens32 down3、ip route路由表rootubt2604ser:~# ip routedefault via10.0.0.2 dev ens32 proto static10.0.0.0/24 dev ens32 proto kernel scopelinksrc10.0.0.44、ip neighARP缓存ARP协议用于将IP地址解析为MAC地址。 ip neigh 查看本机的ARP缓存表。rootubt2604ser:~# ip neighbo10.0.0.1 dev ens32 lladdr 00:50:56:c0:00:08 REACHABLE10.0.0.2 dev ens32 lladdr 00:50:56:ee:82:2f STALE rootubt2604ser:~##arp测试[rootrockydesk ~]# arping 10.0.0.1ARPING10.0.0.1 来自10.0.0.6 ens160 单播 回复 来自10.0.0.1[00:50:56:C0:00:08]0.874毫秒 单播 回复 来自10.0.0.1[00:50:56:C0:00:08]1.031毫秒 ^C发送2次探测(1次广播)已接受到2个响应[rootrockydesk ~]#二、tcpdump抓包tcpdump是命令行抓包工具可以捕获经过网卡的数据包是排查网络问题的最强手段1、基本用法#指定端口抓包rootubt2604ser:~# tcpdump -i ens32tcpdump: verbose output suppressed, use -v[v]...forfull protocol decode listening on ens32, link-type EN10MB(Ethernet), snapshot length262144bytes 00:42:33.694602 IP bogon.sshbogon.34412: Flags[P.],seq98999457:98999585, ack789952302, win284, length128#指定数量rootubt2604ser:~# tcpdump -i ens32 -c 2tcpdump: verbose output suppressed, use -v[v]...forfull protocol decode listening on ens32, link-type EN10MB(Ethernet), snapshot length262144bytes 00:43:24.919954 IP bogon.sshbogon.34412: Flags[P.],seq99002545:99002609, ack789952878, win284, length6400:43:24.968600 IP bogon.34412bogon.ssh: Flags[.], ack64, win4104, length02packets captured9packets received by filter0packets dropped by kernel rootubt2604ser:~##不进行服务解析rootubt2604ser:~# tcpdump -i ens32 -nn -c2tcpdump: verbose output suppressed, use -v[v]...forfull protocol decode listening on ens32, link-type EN10MB(Ethernet), snapshot length262144bytes 00:44:04.058092 IP10.0.0.4.2210.0.0.1.34412: Flags[P.],seq99005505:99005553, ack789954366, win284, length4800:44:04.109402 IP10.0.0.1.3441210.0.0.4.22: Flags[.], ack48, win4104, length02packets captured2packets received by filter0packets dropped by kernel#指定服务端口rootubt2604ser:~# tcpdump -i ens32 -nn -c2 port 22tcpdump: verbose output suppressed, use -v[v]...forfull protocol decode listening on ens32, link-type EN10MB(Ethernet), snapshot length262144bytes 00:44:45.476988 IP10.0.0.4.2210.0.0.1.34412: Flags[P.],seq99006561:99006609, ack789954942, win284, length4800:44:45.527805 IP10.0.0.1.3441210.0.0.4.22: Flags[.], ack48, win4106, length02packets captured2packets received by filter0packets dropped by kernel#指定服务端口和主机rootubt2604ser:~# tcpdump -i ens32 -nn -c2 port 22 and host 10.0.0.1tcpdump: verbose output suppressed, use -v[v]...forfull protocol decode listening on ens32, link-type EN10MB(Ethernet), snapshot length262144bytes 00:45:00.144767 IP10.0.0.4.2210.0.0.1.34412: Flags[P.],seq99008161:99008225, ack789955998, win284, length6400:45:00.145573 IP10.0.0.4.2210.0.0.1.34412: Flags[P.],seq64:128, ack1, win284, length642packets captured4packets received by filter0packets dropped by kernel rootubt2604ser:~#2、保存和读取#将抓取的包存放在家目录下rootubt2604ser:~# tcpdump -i ens32 -nn -c2 port 22 and host 10.0.0.1 -w /root/sshd.tcpdumptcpdump: listening on ens32, link-type EN10MB(Ethernet), snapshot length262144bytes2packets captured2packets received by filter0packets dropped by kernel rootubt2604ser:~##读取文件rootubt2604ser:~# tcpdump -nn -r sshd.tcpdumpreading fromfilesshd.tcpdump, link-type EN10MB(Ethernet), snapshot length26214400:50:59.845708 IP10.0.0.4.2210.0.0.1.34412: Flags[P.],seq99023697:99023761, ack789967326, win284, length6400:50:59.897586 IP10.0.0.1.3441210.0.0.4.22: Flags[.], ack64, win4103, length0rootubt2604ser:~#三、curl http验证curl是命令行HTTP客户端用于测试Web服务连通性是排障时的必备工具。准备一台带有nginx服务的虚拟机[rootrockydesk ~]# dnf install -y nginx[rootrockydesk ~]# systemctl enable --now nginx#GET请求可以再nginx服务器上抓包试试看看没有TCP握手和挥手协议rootubt2604ser:~# curl http://10.0.0.6 | head -10% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed10076201007620001.39M00!doctype htmlhtmlheadmetacharsetutf-8metanameviewportcontentwidthdevice-width, initial-scale1titleHTTP Server Test Page powered by: Rocky Linux/titlestyletypetext/css/*![CDATA[*/#查看响应头rootubt2604ser:~# curl -I http://10.0.0.6HTTP/1.1200OK Server: nginx/1.26.3 Date: Wed, 05 Aug202600:58:31 GMT Content-Type: text/html Content-Length:7620Last-Modified: Fri,12Dec202519:34:10 GMT Connection: keep-alive ETag:693c6e32-1dc4Accept-Ranges: bytes#详细信息rootubt2604ser:~# curl -v http://10.0.0.6 |head -10% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed000000000* Trying10.0.0.6:80... * Established connection to10.0.0.6(10.0.0.6 port80)from10.0.0.4 port34970* using HTTP/1.xGET / HTTP/1.1Host:10.0.0.6User-Agent: curl/8.18.0Accept: */** Request completely sent offHTTP/1.1200OKServer: nginx/1.26.3Date: Wed, 05 Aug202600:59:26 GMTContent-Type: text/htmlContent-Length:7620Last-Modified: Fri,12Dec202519:34:10 GMTConnection: keep-aliveETag:693c6e32-1dc4Accept-Ranges: bytes{[7620bytes data]1007620100762000832.4k!doctype htmlhtmlheadmetacharsetutf-8metanameviewportcontentwidthdevice-width, initial-scale1titleHTTP Server Test Page powered by: Rocky Linux/titlestyletypetext/css/*![CDATA[*/ html{1007620100762000721.8k00* Connection#0 to host 10.0.0.6:80 left intact四、ping/tracerroute/mtr命令1、ping测试连通和延迟#ping2个包、间隔1秒、包大小1024每一个可以单独使用rootubt2604ser:~# ping -c 2 -i 1 -s 1024 10.0.0.6PING10.0.0.6(10.0.0.6)1024(1052)bytes of data.1032bytes from10.0.0.6:icmp_seq1ttl64time0.671ms1032bytes from10.0.0.6:icmp_seq2ttl64time0.512ms ---10.0.0.6pingstatistics ---2packets transmitted,2received,0% packet loss,time1002ms rtt min/avg/max/mdev0.512/0.591/0.671/0.079 ms rootubt2604ser:~#2、traceroute路由跟踪# ICMP模式[rootrockydesk ~]# traceroute -I jd.comtracerouteto jd.com(106.39.171.134),30hops max,60byte packets1_gateway(10.0.0.2)0.319ms0.262ms *2192.168.16.1(192.168.16.1)3.118ms3.887ms *3192.168.10.1(192.168.10.1)2.002ms1.983ms1.951ms4161.73.27.117.broad.fz.fj.dynamic.163data.com.cn(117.27.73.161)2.880ms2.858ms2.822ms5120.36.57.45(120.36.57.45)4.998ms * *# 不解析主机名更快[rootrockydesk ~]# traceroute -n jd.comtracerouteto jd.com(211.144.24.218),30hops max,60byte packets110.0.0.21.433ms1.355ms1.246ms3、mtr动态路由跟踪mtr结合了ping和traceroute动态显示丢包率和延迟是排查网络质量的最佳工具。#交互式[rootrockydesk ~]# mtr jd.comrockydesk(10.0.0.6)-jd.com(111.13.149.108)2026-08-05T09:42:280800 Keys: Help Display mode Restart statistics Order of fields quit Packets Pings Host Loss% Snt Last Avg Best Wrst StDev1. _gateway0.0%30.43.30.48.94.92.192.168.16.10.0%33.33.12.83.30.3#只看结果[rootrockydesk ~]# mtr -r jd.comStart:2026-08-05T09:43:120800 HOST: rockydesk Loss% Snt Last Avg Best Wrst StDev1.|-- _gateway0.0%100.20.40.20.60.12.|--192.168.16.10.0%102.63.52.68.71.8#不解析主机名[rootrockydesk ~]# mtr -n jd.comMytraceroute[v0.95]rockydesk(10.0.0.6)-jd.com(106.39.171.134)2026-08-05T09:44:010800 Keys: Help Display mode Restart statistics Order of fields quit Packets Pings Host Loss% Snt Last Avg Best Wrst StDev1.10.0.0.20.0%40.80.70.50.90.22.192.168.16.10.0%42.82.82.73.00.13.192.168.10.1五、firewalld防火墙基础防火墙状态和规则#查看防火墙运行状态 [rootrockydesk ~]# systemctl status firewalld.service ○ firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; preset: enabled) Active: inactive (dead) Docs: man:firewalld(1) #开启 [rootrockydesk ~]# systemctl start firewalld.service #查看规则 [rootrockydesk ~]# firewall-cmd --list-all public (default, active) target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: ens160 sources: services: cockpit dhcpv6-client ssh ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: [rootrockydesk ~]#马哥教育