Linux中的涉及網絡基本知識

Linux中的涉及網絡基本知識：

            TCP/IP：

                        物理層：

                        鏈路層：MAC  從設備到設備主機通訊，MAC地址，IP<-->MAC(ARP/RARP)                        MTU：

                        網絡層：IP報文 從源主機到目標主機之間通訊，IP地址，IP報文

                        傳輸層：從源主機進程到目標主機特定進程之間通訊，TCP/UDP

                        應用層：        

         

 

            ISO/OSI：七層

                        1-4：通訊

                        5-7：資源

                                    會話層

                                    表示層

                                    應用層

 

            TCP：有鏈接協議，創建邏輯鏈接

                        SYN, ACK, FIN, RST, PSH,URG

 

                        三次握手：

                                    SYN=1,ACK=0, FIN=0

                                    SYN=1,ACK=1, FIN=0

                                    SYN=0,ACK=1, FIN=0

 

                        四次斷開：確認通信確實須要中斷

 

                        有限狀態機：

 

主機：TCP/IP協議棧

 

回顧：IPV4：私有5類地址網段：

                        A：10.0.0.0/8

                        B: 172.16.0.0/16,172.31.0.0/16

                        C: 192.168.0.0/24,192.168.255.0/24

                        D

                        E

 

            OSI：7 layers

                        4 :

                                    TCP, UDP                  

 

            tcp三次握手：

                        1次：SYN＝1，ACK＝0，FIN＝0

                        2次：SYN=1, ACK=1,FIN=0

                        3次：SYN＝0，ACK＝1，FIN=0

 

            A --> B, B --> A

           

            IP首部，TCP首部

 

            VLAN:

 

Linux網絡屬性配置：

            IP／NETMASK

            路由：

                        主機路由

                        網絡路由

                        默認網關

            DNS服務器：

                        主DNS服務器

                        備用DNS服務器

            主機名

 

            配置網絡屬性：

                        靜態配置

                        動態配置：DHCP

                                    Dynamic HostConfiguration Protocol

                                   

 

            配置IP：

                        用戶空間工具：ifconfig(net-tools), ip (iproute2)

                        網絡設備服務配置文件:/etc/sysconfig/network-scripts/

                                    主機名：/etc/resolv.conf

                        GUI／TUI

 

            網絡設備的配置方式：

                        內核識別硬件設備：驅動

                                   

                        設備名稱：

                                    以太網：ethX

                                                eth0,eth1, eth2, ...

                                    PPP網絡：pppX

                                    loopback: 本地迴環，lo

 

            ifconfig:

                        默認爲顯示全部處於激活狀態的鏈接

                        －a

 

                        ifconfig IFNAME:僅顯示指定接口的信息

                        ifconfig IFNAME ADDRESS

                                    ip/mask

                                                長格式：ifconfig IFNAMEIP netmask MASK

                                                短格式：ifconfig IFNAMEIP/MASK

 

            route:

                        route：顯示路由信息

                                    -n: 數字格式的地址

 

                        route add

                                    -host：目標爲主機

                                                -hostHOST_IP gw NEXT_HOP [dev DEVICE]

                                    -net：目標是網絡

                                                -netNET_ADDRESS gw NEXT_HOP [dev DEVICE]

 

                                                -net0.0.0.0: 表示目標爲任意地址

 

                                    route add default gw GW_ADD

                       

                        route del

                                    -hostHOST_IP

                                    -netNET_ADDRESS

 

            DNS服務器地址：

                        本地解析: /etc/hosts

                        DNS服務器解析：指定DNS服務器地址

 

                        dig -t A FQDN

                                    FullQualified Domain Name

                                    www.magedu.com

 

                        dig -x IP:

                                    反解IP至FQDN

 

            使用命令配置的信息直接送往內核（TCP／IP協議棧）並當即生效；

 

            IP／NETMASK：

                        配置文件有兩類(/etc/sysconfig/network-scripts):

                                    配置IP、掩碼和網關：

                                                以太網：ifcfg-IFNAME

                                                PPP:ifcfg-pppX

                                    配置路由：route-IFNAME

 

                        CentOS 5:/etc/rc.d/init.d/network

                        CentOS 6:/etc/rc.d/init.d/network

                                        /etc/rc.d/init.d/NetworkManager

 

            /etc/rc.d/init.d/，/etc/init.d/*

                        SysV風格的腳本：多數腳本都用於控制Linux的後臺進程，接受參數{start|stop|restart|status}

                       

                        # /etc/init.d/networkstart

                        # service network start           

                       

                        配置某服務是否開機自動運行：

                                    # chkconfigSRVNAME on｜off

                        查看哪些服務開機自動運行：

                                    # chkconfig--list

 

 

            ifcfg-IFNAME配置文件的格式：

                    DEVICE＝IFNAME: 此配置文件所關聯到的設備，設備名稱要與本文件名ifcfg-後面保持一致；

                        BOOTPROTO＝{bootp|dhcp|static|none}

                        HWADDR=00:11:22:33:44:55:66:當前設備的MAC地址；

                        NM_CONTROLLED={yes|no}: 是否接受NetworkManager服務腳原本配置此設備；

                        ONBOOT={yes|no}: 是否在開機過程當中，自動激活此接口

                        TYPE＝{Ethernet|Bridge}:網絡接口類型

                        UUID＝

                        IPADDR＝

                        NETMASK＝

                        GATEWAY＝

                        DNS1＝

                        DNS2＝

                        IPV6INIT＝{yes|no}

                        USERCTL={yes|no}: 是否容許普通用控制此接口

                       

                        PEERDNS＝{yes|no}: 不接受DHCP服務器指派的DNS服務器地址

 

            route-IFNAME:

                        配置文件的格式1：每行一個路由條目

                                    DESTINATIONvia NETX_HOP

 

                        配置文件格式2: 每三行一個路由條目

                                    ADDRESS＃＝DESTINATION

                                    NETMASK＃＝MASK

                                    GATEWAY＃＝GW

 

            如何配置主機名：

                        hostname

                        hostname HOSTNAME

 

                        配置文件：/etc/sysconfig/network

                                    HOSTNAME=主機名

 

 

            如何在一個網絡接口配置多個IP地址：

 

                        經過網絡接口的別名來實現：IFNAME:#

                                    ens33,ens33:0, ens33:1, ens33:2

                                    eth0，eth0:0, eth0:1

 

                        命令配置：當即生效

                                    ifconfigIFALIAS IP

 

                        配置文件配置：別名不支持使用DHCP進行配置

                                    ifcfg-IFALIAS

                                                DEVICE=IFALIAS

                                                BOOTPROTO={static|none}

                                                IPADDR=

                                                NETMASK=

                                                ONBOOT=

                                                USERCTL=

 

 

            TUI或者GUI：

                        TUI:system-config-network-tui

                        GUI：system-config-network-gui

 

                        setup --> NetworkConfiguration

 

 

                        修改的結果會保存至相應的網絡接口的配置文件ifcfg-IFNAME，所以，不會當即生效；

 

            網絡管理相關的工具：

                        ping: ICMP

                                    ping[option]... IP

                                                -c#: 報文的個數

                                                -Wtimeout: 等待響應報文的超時時長；

 

                        traceroute:

                                    tracerouteHOST

                                                獲取從當前主機到達目標主機所經由的全部網關；

 

                        mtr HOST

 

                        netstat: (ss)

                                    -t: tcp協議相關

                                    -u: udp協議相關

                                    -n: 顯示數字格式的地址

                                    -l: listen，顯示處於監聽狀態的鏈接

                                                -tunl

                                    -a: 全部狀態的鏈接

                                                -tan

                                    -p: 顯示會話中的進程程序名及進程號

                                    -r: routing，顯示路由表

                                                -rn

 

                                    名稱解析：

                                                FQDN<==> IP

                                                ServiceName <==> PORT

 

            顯示網絡接口設備的屬性信息：

                        ethtool IFNAME

                                    -S: 顯示設備接口的統計數據

 

            課外任務：nmap, ncat,tcpdump

 

            ip命令：

                        ip link : 管理接口

                                    show[IFNAME]

                                    set IFNAME{up|down}

                                                multicast{on|off}

 

                                    # ifconfigIFNAME {up|down}

                                    # ifupIFNAME

                                    # ifdownIFNAME

 

                        ip addr: 管理協議地址

                                    ip addr{show|flush} [dev DEVICE]

 

                                    ip addr{add|del} ADDRESS dev DEVICE  [label IFALIAS][broadcast BCAST_ADDRESS]

 

                                                #ifconfig IFNAME ADDRESS broadcast BCAST_ADDRESS

 

                        ip route: 管理路由

                                    ip routelist

 

                                    ip routeflush

 

                                    ip route addDESTINATION [via NEXT_HOP] [src SOURCE_ADDRESS] [dev DEVICE]

                                    ip route delDESTINATION

 

命令總結：ifconfig, ifup,ifdown, route, netstat, ping, traceroute, mtr, ethtool, setup, dig, ip, ss

           

            ss:

                        -t: tcp

                        -u: udp

                        -p: process

                        -l: listening

                        -n: numeric

                        -a: all

                        -e: 擴展信息

                        -m: 套接字相關的內存使用信息

                        -o state{established,fin_wait_1, fin_wait_2, listening}

                                    '( dport=   or sport =  )'

                                    只顯示指定狀態的鏈接，還能夠指定過濾條件

【網絡信息及設置命令Linux Network Commands】

  COMMAND DESCRIPTION    

    dhclient -v /Sudo dhclient -v -r     //let's manually release our address with -r. Let's keep the -v option in there so we can see what's going on.

    netstat -tulpn      Show Linux network ports with process ID's (PIDs)

    watch ss -stplu     Watch TCP, UDP open ports in real time with socket summary.

    lsof -i       Show established connections.

    macchanger -m MACADDR INTR      Change MAC address on KALI Linux.

    ifconfig -a 

    ifconfig eth0 192.168.2.1/24      Set IP address in Linux.

    ifconfig eth0:1 192.168.2.3/24        Add IP address to existing network interface in Linux.

    ifconfig eth0 hw ether MACADDR        Change MAC address in Linux using ifconfig.

    ifconfig eth0 mtu 1500        Change MTU size Linux using ifconfig, change 1500 to your desired MTU.

    dig -x 192.168.1.1      Dig reverse lookup on an IP address.

    host 192.168.1.1        Reverse lookup on an IP address, in case dig is not installed.

    dig @192.168.2.2 domain.com -t AXFR       Perform a DNS zone transfer using dig.

    host -l domain.com nameserver       Perform a DNS zone transfer using host.

    nbtstat -A x.x.x.x      Get hostname for IP address.

    ip addr add 192.168.2.22/24 dev eth0        Adds a hidden IP address to Linux, does not show up when performing an ifconfig.

    ip address 

    tcpkill -9 host google.com      Blocks access to google.com from the host machine.

    echo "1" > /proc/sys/net/ipv4/ip_forward        Enables IP forwarding, turns Linux box into a router - handy for routing traffic through a box.

    echo "8.8.8.8" > /etc/resolv.conf       Use Google DNS.

網絡工具

1.  ping：經過ICMP迴應/回覆報文來檢查遠端主機的端到端鏈接性（RTT延時，抖動，丟包）。用來檢查系統狀態和可鏈接性很不錯。

2.  phping：網絡掃描和檢測工具，能夠產生ICMP/TCP/UDPping數據包。經常用於高級端口掃描，防火牆測試，手動MTU路徑發現和碎片測試。

3.  traceroute：經過TTL限定的ICMP/UDP/TCP偵測包來發現從本地主機到遠端目標主機之間的第三層轉發路徑。用來調試網絡鏈接性和路由問題。

4.  mtr：traceroute的一個變種，能根據運行時統計數據整理出每一跳的包丟失/抖動。用來評估路由路徑延時很不錯。

5.  netcat/socat：TCP/IP網絡裏的瑞士***，能夠讀/寫 TCP/UDP 協議字節流。用來調試防火牆策略和服務可用性很不錯。

6.  dig：DNS調試工具，能夠生成正向查詢，反向查詢，搜索域名服務器，檢查CNAME，MX和其餘DNS記錄。能夠在偵錯的時候查詢特定的DNS服務器。

7.  nslookup：另一個DNS檢查/調試工具。支持全部DNS查詢和記錄。能夠查詢特定DNS服務器。

8.  dnsyo：一個DNS測試工具，經過對全世界1500個不一樣網絡中的大量開放解析器執行DNS查詢來測試DNS傳輸。

9.  lsof：顯示進程打開的文件信息（例如，普通文件，管道或套接字）。用來監視網絡鏈接很不錯。

10.               iftop：一個基於ncurses的命令行界面應用，能夠實時監視各個網絡物理接口上的網絡鏈接和帶寬佔用。用來記錄霸佔帶寬的應用、用戶、目的地和端口等很不錯。

11.               netstat：一個網絡統計工具，能夠顯示狀態以及統計信息，當前網絡鏈接（TCP/UDP端口，IP地址）、路由表、TX/RX traffic以及網絡協議。用來作網絡相關診斷和性能調試很不錯。

12.               tcpdump：一個經常使用的基於libpcap抓包庫的包偵測工具。能夠按伯克利包過濾器格式定義抓包條件。

13.               tshark：另外一個命令行抓包工具，和它的GUI版本Wireshark徹底兼容。支持1000種協議並且這個列表還在增長。用來調試、分析和保存實時網絡封包信息很不錯。

14.               ip：一個多功能的命令行網絡工具，是iproute2包的一部分。能夠檢查和修改路由表、網絡設備狀態以及IP隧道設置。用來查看路由表、增長/刪除靜態路由、配置網絡接口、以及調試路由問題頗有用。

15.               ifup/ifdown：用來激活和關閉特定的網絡接口。常常用於重啓整個網絡服務。

16.               autossh：一個能創建SSH鏈接並在斷線後自動從新鏈接的程序。用來建立長時間保持的穿越嚴格企業網絡的SSH隧道頗有用。

17.               iperf：一個網絡測試工具，經過在發送自定義TCP/UDP數據流來衡量主機間雙向最大吞吐量。

18.               elinks/lynx：爲基於命令行的服務器環境下使用的基於文字的網頁瀏覽器。

課外任務：nmap, netcat, tcpdump

Nmap(Network Mapper) is a security scanner originally written by Gordon Lyon (alsoknown by his pseudonym Fyodor Vaskovich)[1] used to discover hosts and serviceson a computer network, thus creating a "map" of the network. Toaccomplish its goal, Nmap sends specially crafted packets to the target host andthen analyzes the responses. 發現特定網段下存在hosts 

NmapExamples : nmap-sP 10.0.0.0/24  //Pingscans the network, listing machines that respond to ping.

Netcat(often abbreviated to nc) is a computer networking service for reading from andwriting to network connections using TCP or UDP. Netcat is designed to be adependable back-end that can be used directly or easily driven by otherprograms and scripts. At the same time, it is a feature-rich network debuggingand investigation tool, since it can produce almost any kind of correlation itsuser could need and has a number of built-in capabilities.

Itslist of features includes port scanning, transferring files, and portlistening, and it can be used as a backdoor.

掃描host端口狀況

tcpdump is a common packet analyzer that runs under the command line. It allows the user to display TCP/IP and other packets being transmitted or received over anetwork to which the computer is attached. 

查找發出ip到目的ip端口的數據包

#TCP traffic from 10.5.2.3 destined for port 3389 

tcpdump-nnvvS src 10.5.2.3 and dst port 3389