网络命令总结：
1. 网络命令总结：
1.1 nmcli命令
nmcli命令可以用于在命令行中修改IP地址，并且还可以查看命令网卡及连接状态信息。
- 参数：
| 参数选项 | 说明 |
|---|---|
| conn show | 查看连接信息 |
| device status | 查看网卡状态信息 |
| modify | 修改网卡连接信息 |
| conn reload | 重新加载网卡文件，一般用于修改完网卡文件后进行重新加载 |
| conn up ens160 | 重新激活网卡连接，一般用于使用命令修改完网卡信息和修改完配置文件重新激活 |
| conn delete ens192 | 删除ens192连接 |
| conn add | 添加网卡连接，对应的参数type ethernet con-name ens192 ifname ens192 type：设置类型是以太网类型，con-name:设置新连接名字 ifname: 物理设备名称 |
- modify参数:
| 参数 | 选项 |
|---|---|
| ipv4.addresses | 手动修改IPV4地址/子网掩码 |
| +ipv4.addresses | 在网卡连接添加IPV4地址 |
| ipv4.dns | 修改dns |
| +ipv4.dns | 添加dns |
| ipv4.gateway | 修改网关地址 |
| ipv4.method | 修改IP地址获取方式，auto是自动获取，manual是手动获取 |
| autoconnect | 开机是否自启动，yes是，no不开机自启动 |
| +ipv4.routes | 永久添加路由表 |
1.1.0 nmcli查看网卡及连接状态
查看网卡状态:
shell
[root@studry ~]# nmcli device status
DEVICE TYPE STATE CONNECTION
ens160 ethernet connected ens160
lo loopback connected (externally) lo 查看网卡连接信息
shelll
[root@studry ~]# nmcli conn show
NAME UUID TYPE DEVICE
ens160 4769c1a0-f049-3073-88fc-5b78fa8afc37 ethernet ens160
lo 56fe649d-e395-40ec-a7f8-6bc3cceb6ab1 loopback lo 查看某个网卡连接信息：
shell
[root@studry ~]# nmcli conn show ens1601.1.1 命令行修改/增加IP地址信息及增加连接
修改网卡连接IP信息：
- 查看原先网卡信息：
shell
1)查看网卡信息：
[root@studry system-connections]# ip a show ens192
3: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:0c:29:22:bb:3c brd ff:ff:ff:ff:ff:ff
altname enp11s0
altname enx000c2922bb3c
inet 10.0.0.143/24 brd 10.0.0.255 scope global dynamic noprefixroute ens192
valid_lft 1122sec preferred_lft 1122sec
inet6 fe80::9a8f:8eeb:70c6:c14e/64 scope link noprefixroute
valid_lft forever preferred_lft forever
2)查看dns:
[root@studry system-connections]# cat /etc/resolv.conf
# Generated by NetworkManager
search localdomain
nameserver 10.0.0.150
nameserver 10.0.0.2- 修改静态IP地址：
shell
[root@studry system-connections]# nmcli conn modify ens192 ipv4.addresses 10.0.0.10/24
[root@studry system-connections]# nmcli conn up ens192- 设置网关，网关必须修改成真实网关信息：
shell
[root@studry system-connections]# nmcli conn mod ens192 ipv4.gateway 10.0.0.2
[root@studry system-connections]# nmcli conn up ens192
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/6)- 修改DNS：
shell
1)查看当前的DNS：
root@studry:~# cat /etc/resolv.conf
# Generated by NetworkManager
search localdomain
nameserver 10.0.0.2
2)把DNS修改成"223.5.5.5 223.6.6.6"
root@studry:~# nmcli conn mod ens160 ipv4.dns "223.5.5.5 223.6.6.6"
root@studry:~# nmcli conn up ens160
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)
root@studry:~# cat /etc/resolv.conf
# Generated by NetworkManager
search localdomain
nameserver 223.5.5.5
nameserver 223.6.6.6
nameserver 10.0.0.2- 一键式进行修改:
shell
1)查看当前信息：
root@studry:~# ip -4 -br a
lo UNKNOWN 127.0.0.1/8
ens160 UP 10.0.0.141/24
root@studry:~# cat /etc/resolv.conf
# Generated by NetworkManager
search localdomain
nameserver 223.5.5.5
nameserver 223.6.6.6
nameserver 10.0.0.2
2)进行修改：
root@studry:~# nmcli conn mod ens160 ipv4.method manual ipv4.addresses 10.0.0.90/24 ipv4.gateway 10.0.0.2 ipv4.dns "10.0.0.150" autoconnect yes
`说明:`
ipv4.method: 修改获取模式，manual是静态配置，auto是DHCP动态获取
autoconnect: 开机是否自动启动网卡连接，auto是自动启动，manual是静态配置。
root@studry:~# nmcli conn up ens160
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/4)
3)查看是否修改：
root@studry:~# ip -4 -br a
lo UNKNOWN 127.0.0.1/8
ens160 UP 10.0.0.90/24
root@studry:~# cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 10.0.0.150在连接上增加IPV4地址及DNS：
在连接上增加IPV4地址:
shell
1)进行增加IP地址：
root@studry:~# nmcli conn mod ens160 +ipv4.addresses 10.0.0.91/24
`说明：`
+号是在原来连接基础之上增加个地址
重新激活网卡连接
root@studry:~# nmcli conn up ens160
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/5)
2)查看是否增加成功
root@studry:~# ip -4 -br a
lo UNKNOWN 127.0.0.1/8
ens160 UP 10.0.0.90/24 10.0.0.91/24 在网卡连接上增加dns:
shell
0)查看原先的DNS：
root@studry:~# cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 10.0.0.150
1)增加DNS：
root@studry:~# nmcli conn mod ens160 +ipv4.dns "223.5.5.5 223.6.6.6"
激活：
root@studry:~# nmcli conn up ens160
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/6)
2)查看是否增加成功：
root@studry:~# cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 10.0.0.150
nameserver 223.5.5.5
nameserver 223.6.6.6增加连接及删除连接
- 增加连接：
shell
[root@studry system-connections]#nmcli conn add type ethernet con-name ens192 ifname ens192
`说明:`
add: 添加连接
type: 设置ethernet类型
con-name: 设置连接名称
ifname: 指定网卡设备名称
2)查看是否添加成功:
[root@studry system-connections]# nmcli conn show
NAME UUID TYPE DEVICE
ens160 4769c1a0-f049-3073-88fc-5b78fa8afc37 ethernet ens160
Wired connection 1 48964d46-20f9-386d-b0d0-f3bbda818c47 ethernet ens192
lo 6ace94bb-94b4-4a8e-8cc6-5c9a3fb0ab62 loopback lo - 删除网卡连接
shell
[root@studry system-connections]#nmcli conn delete Wired\ connection\ 1
`说明：`
Wired\ connection\ 1：是连接名称
2)查看是否删除掉：
[root@studry system-connections]# nmcli conn show
NAME UUID TYPE DEVICE
ens160 4769c1a0-f049-3073-88fc-5b78fa8afc37 ethernet ens160
ens192 837d0988-ce57-41de-95de-638900786894 ethernet ens192
lo 6ace94bb-94b4-4a8e-8cc6-5c9a3fb0ab62 loopback lo 永久添加/删除路由表
- 永久添加路由表，重启后不会删除：
shell
1)添加路由表
wmn@studry:~$ sudo nmcli con mod ens192 +ipv4.routes "20.0.0.0/24 10.0.0.2"
wmn@studry:~$ nmcli conn up ens192
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/4)
2)查看是否添加成功:
wmn@studry:~$ ip r
default via 10.0.0.2 dev ens160 proto static metric 100
default via 10.0.0.2 dev ens192 proto dhcp src 10.0.0.144 metric 101
10.0.0.0/24 dev ens160 proto kernel scope link src 10.0.0.93 metric 100
10.0.0.0/24 dev ens192 proto kernel scope link src 10.0.0.144 metric 101
20.0.0.0/24 via 10.0.0.2 dev ens192 proto static metric 101 - 永久删除路由表中一条路由表：
shell
1)查看之前的路由表：
wmn@studry:~$ ip r
default via 10.0.0.2 dev ens160 proto static metric 100
default via 10.0.0.2 dev ens192 proto dhcp src 10.0.0.144 metric 101
10.0.0.0/24 dev ens160 proto kernel scope link src 10.0.0.93 metric 100
10.0.0.0/24 dev ens192 proto kernel scope link src 10.0.0.144 metric 101
20.0.0.0/24 via 10.0.0.2 dev ens192 proto static metric 101
2)进行删除路由表一条记录：
root@studry:~# nmcli conn mod ens192 -ipv4.routes "20.0.0.0/24 10.0.0.2"
root@studry:~# nmcli conn up ens192
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/4)
3)查看是否删除：
root@studry:~# ip r
default via 10.0.0.2 dev ens160 proto static metric 100
default via 10.0.0.2 dev ens192 proto dhcp src 10.0.0.144 metric 101
10.0.0.0/24 dev ens160 proto kernel scope link src 10.0.0.93 metric 100
10.0.0.0/24 dev ens192 proto kernel scope link src 10.0.0.144 metric 101 1.2 IP系列命令：
命令参数：
| 命令参数 | 说明 |
|---|---|
| ip a/ip a show | 查看网卡连接信息，可以指定查看某个网卡连接信息：ip a show ens160,只查看ens160网卡连接信息 |
| ip r | 查看路由表 |
| ip link show | 查看所有网卡连接，可以指定某个网卡连接，ip link show ens160:只查看ens160网卡连接 |
| ip neigh | 查看ARP缓存信息 |
| ip link set ens160 down | 把ens160网卡链接设置为down状态 |
| ip link set ens160 up | 把ens160网卡链接设置为up状态 |
| ip -br a | 以简洁的方式显示ip地址及网卡连接状态 |
ip命令示例：
- 查看ip地址：
方式一：
shell
1)查看所有网卡信息：
root@studry:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host noprefixroute
valid_lft forever preferred_lft forever
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:0c:29:89:35:b7 brd ff:ff:ff:ff:ff:ff
altname enp3s0
altname enx000c298935b7
inet 10.0.0.90/24 brd 10.0.0.255 scope global noprefixroute ens160
valid_lft forever preferred_lft forever
inet 10.0.0.91/24 brd 10.0.0.255 scope global secondary noprefixroute ens160
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe89:35b7/64 scope link noprefixroute
valid_lft forever preferred_lft forever
2)指定查看某个网卡上信息：
root@studry:~# ip a show ens160
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:0c:29:89:35:b7 brd ff:ff:ff:ff:ff:ff
altname enp3s0
altname enx000c298935b7
inet 10.0.0.90/24 brd 10.0.0.255 scope global noprefixroute ens160
valid_lft forever preferred_lft forever
inet 10.0.0.91/24 brd 10.0.0.255 scope global secondary noprefixroute ens160
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe89:35b7/64 scope link noprefixroute
valid_lft forever preferred_lft forever方式二：简洁查看网卡信息：
shell
1)以简洁的方式查看ipv4地址及链接状态信息
root@studry:~# ip -4 -br a
lo UNKNOWN 127.0.0.1/8
ens160 UP 10.0.0.90/24 10.0.0.91/24 - 查看路由表：
shell
1)查看路由表：
root@studry:~# ip r
default via 10.0.0.2 dev ens160 proto static metric 100
10.0.0.0/24 dev ens160 proto kernel scope link src 10.0.0.90 metric 100
10.0.0.0/24 dev ens160 proto kernel scope link src 10.0.0.91 metric 100
2)也可以使用route -n进行查看：
root@studry:~# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.0.0.2 0.0.0.0 UG 100 0 0 ens160
10.0.0.0 0.0.0.0 255.255.255.0 U 100 0 0 ens160
10.0.0.0 0.0.0.0 255.255.255.0 U 100 0 0 ens160- 查看ARP缓存:
shell
1)方式一：
root@studry:~# ip neigh
10.0.0.2 dev ens160 lladdr 00:50:56:e1:2e:a7 STALE
10.0.0.150 dev ens160 lladdr 00:0c:29:b2:8b:8f STALE
2)也可以使用arp -a进行查看
root@studry:~# arp -a
_gateway (10.0.0.2) at 00:50:56:e1:2e:a7 [ether] on ens160
? (10.0.0.150) at 00:0c:29:b2:8b:8f [ether] on ens160- 查看网卡连接状态:
shell
1)查看所有网卡连接状态:
root@studry:~# ip link show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
link/ether 00:0c:29:89:35:b7 brd ff:ff:ff:ff:ff:ff
altname enp3s0
altname enx000c298935b7
2)可以指定查看某个网卡连接状态：
root@studry:~# ip link show ens160
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
link/ether 00:0c:29:89:35:b7 brd ff:ff:ff:ff:ff:ff
altname enp3s0
altname enx000c298935b7- 关闭连接和启动连接：
关闭连接：
shell
1)关闭连接
root@studry:~# ip link set ens160 down
root@studry:~# ip link show ens160
2: ens160: <BROADCAST,MULTICAST> mtu 1500 qdisc mq state DOWN mode DEFAULT group default qlen 1000
link/ether 00:0c:29:89:35:b7 brd ff:ff:ff:ff:ff:ff
altname enp3s0
altname enx000c298935b7
`说明：`
这时的网卡链接已经down掉了，远程连接也会断开
2)开启连接：
root@studry:~# ip link set ens160 up
root@studry:~# ip link show ens160
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
link/ether 00:0c:29:89:35:b7 brd ff:ff:ff:ff:ff:ff
altname enp3s0
altname enx000c298935b7
`说明：`
如果修改网卡连接信息，如修改IP地址或DNS，使用先停掉在开启连接，修改后的网卡连接信息不生效。- 增加IP地址,临时增加：
shell
1)增加临时的IP地址：
查看现在有哪些IP地址：
wmn@studry:~$ sudo ip -4 -br a
[sudo] password for wmn:
lo UNKNOWN 127.0.0.1/8
ens160 UP 10.0.0.93/24
进行增加IP：
wmn@studry:~$ sudo ip addr add 10.0.0.91/24 dev ens160
查看是否增加成功:
wmn@studry:~$ sudo ip -4 -br a
lo UNKNOWN 127.0.0.1/8
ens160 UP 10.0.0.93/24 10.0.0.91/24
`注意：`
只是临时增加IP，当服务器重启时候，新增加的IP地址则会删除。- 临时删除IP地址：
shell
1)查看现有的IP地址：
wmn@studry:~$ sudo ip -4 -br a
lo UNKNOWN 127.0.0.1/8
ens160 UP 10.0.0.93/24 10.0.0.91/24
2)临时删除IP地址：
wmn@studry:~$ sudo ip addr del 10.0.0.93/24 dev ens160
3)查看是否删除：
wmn@studry:~$ ip -br -4 a
lo UNKNOWN 127.0.0.1/8
ens160 UP 10.0.0.91/24
`注意：`
使用ip del删除是临时删除，重启服务器，地址则会恢复，可以删除所有地址。- 临时添加/删除路由表
临时添加路由：
shell
1)临时添加：
root@studry:~# ip route add 20.0.0.0/24 via 10.0.0.3 dev ens192 proto dhcp src 10.0.0.144 metric 102
2)查看是否添加成功
root@studry:~# ip r
default via 10.0.0.2 dev ens160 proto static metric 100
default via 10.0.0.2 dev ens192 proto dhcp src 10.0.0.144 metric 101
10.0.0.0/24 dev ens160 proto kernel scope link src 10.0.0.93 metric 100
10.0.0.0/24 dev ens192 proto kernel scope link src 10.0.0.144 metric 101
20.0.0.0/24 via 10.0.0.3 dev ens192 proto dhcp src 10.0.0.144 metric 102
`说明：`
临时添加重启服务器，则会失效临时删除路由：
shell
1)查看路由表：
root@studry:~# ip r
default via 10.0.0.2 dev ens160 proto static metric 100
default via 10.0.0.2 dev ens192 proto dhcp src 10.0.0.144 metric 101
10.0.0.0/24 dev ens160 proto kernel scope link src 10.0.0.93 metric 100
10.0.0.0/24 dev ens192 proto kernel scope link src 10.0.0.144 metric 101
2)进行删除：
root@studry:~# ip route del default via 10.0.0.2 dev ens192
3)查看是否删除成功：
root@studry:~# ip r
default via 10.0.0.2 dev ens160 proto static metric 100
10.0.0.0/24 dev ens160 proto kernel scope link src 10.0.0.93 metric 100
10.0.0.0/24 dev ens192 proto kernel scope link src 10.0.0.144 metric 101
`说明：`
服务器重启后则会恢复原先的路由表。- 临时添加/删除ARP缓存记录:
临时添加ARP缓存记录：
shell
1)查看原先的arp缓存记录：
root@studry:~# ip neigh show
10.0.0.2 dev ens160 lladdr 00:50:56:e1:2e:a7 REACHABLE
2)新增加一条ARP缓存记录：
方式一：
root@studry:~# ip neigh add 10.0.0.135 lladdr 00:0c:29:22:bb:32 dev ens160
root@studry:~# ip neigh add 10.0.0.135 lladdr 00:0c:29:22:bb:32 dev ens160 nud permanent
root@studry:~# ip neigh
10.0.0.254 dev ens192 lladdr 00:50:56:e5:59:cc REACHABLE
10.0.0.135 dev ens160 lladdr 00:0c:29:22:bb:32 PERMANENT
10.0.0.2 dev ens160 lladdr 00:50:56:e1:2e:a7 REACHABLE
方式二：
root@studry:~# ip neigh add 10.0.0.135 lladdr 00:0c:29:22:bb:32 dev ens160 nud permanent
root@studry:~# ip neigh
10.0.0.254 dev ens192 lladdr 00:50:56:e5:59:cc REACHABLE
10.0.0.135 dev ens160 lladdr 00:0c:29:22:bb:32 PERMANENT
10.0.0.2 dev ens160 lladdr 00:50:56:e1:2e:a7 REACHABLE
`说明：`
只是临时添加，重启服务器就没有了。
nud permanent参数：该条目永不超时，适合做静态绑定
如果省略nud permanent，该条目REACHABLE状态，并可能随时间被内核回收。PERMANENT 不会回收。临时删除ARP缓存记录：
shell
1)查看ARP缓存：
root@studry:~# ip neigh show
10.0.0.2 dev ens160 lladdr 00:50:56:e1:2e:a7 STALE
10.0.0.150 dev ens160 lladdr 00:0c:29:b2:8b:8f STALE
2)删除ARP某条记录：
root@studry:~# ip neigh del 10.0.0.150 dev ens160
3)查看是否删除：
root@studry:~# ip neigh show
10.0.0.2 dev ens160 lladdr 00:50:56:e1:2e:a7 REACHABLE 1.3 ping命令(检测网络是否通)
ping命令在rockylinux10中最基础也是最常用的网络连通性测试工具，它可以通过发送ICMP回显请求报文来检测目标主机是否可达，并且测量往返延迟和丢包率。
参数选项：
| 参数 | 说明 |
|---|---|
| -c | 指定发送次数 |
| -i | 指定每次间隔多久发送一次 |
| -s | 设置载荷字节数(默认是56)，用于测试MTU相关问题 |
| -I | 指定从哪个网卡发出探测 |
| -q | 安静模式，只显示最终的统计 |
| -f | 以快速发包，仅用于隔离环境压测测试 |
案例：
指定发送4次探测:
shell
root@studry:~# ping -c 4 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=128 time=286 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=128 time=689 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=128 time=587 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=128 time=249 ms
--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3001ms
rtt min/avg/max/mdev = 249.420/452.933/689.283/189.057 ms指定从哪个网口发出去:
shell
root@studry:~# ping -I ens160 10.0.0.135
PING 10.0.0.135 (10.0.0.135) from 10.0.0.93 ens160: 56(84) bytes of data.
64 bytes from 10.0.0.135: icmp_seq=1 ttl=64 time=0.342 ms
64 bytes from 10.0.0.135: icmp_seq=2 ttl=64 time=51.2 ms
64 bytes from 10.0.0.135: icmp_seq=3 ttl=64 time=66.4 ms
64 bytes from 10.0.0.135: icmp_seq=4 ttl=64 time=0.387 ms
^C
--- 10.0.0.135 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3016ms
rtt min/avg/max/mdev = 0.342/29.590/66.434/29.718 ms调整数据包大小：
shell
root@studry:~# ping -s 1000 -c 4 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 1000(1028) bytes of data.
1008 bytes from 8.8.8.8: icmp_seq=1 ttl=128 time=410 ms
1008 bytes from 8.8.8.8: icmp_seq=2 ttl=128 time=260 ms
1008 bytes from 8.8.8.8: icmp_seq=3 ttl=128 time=247 ms
1008 bytes from 8.8.8.8: icmp_seq=4 ttl=128 time=250 ms
--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 247.398/292.030/410.469/68.547 ms设置发送间隔:
shell
root@studry:~# ping -i 4 -c 4 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=128 time=248 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=128 time=250 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=128 time=248 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=128 time=249 ms
--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 12013ms
rtt min/avg/max/mdev = 248.114/248.759/249.922/0.691 ms仅输出汇总:
shell
root@studry:~# ping -q -c 4 223.5.5.5
PING 223.5.5.5 (223.5.5.5) 56(84) bytes of data.
--- 223.5.5.5 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3006ms
rtt min/avg/max/mdev = 13.627/20.740/40.225/11.255 ms快速发包：
shell
root@studry:~# ping -f -c 1000 223.5.5.5
PING 223.5.5.5 (223.5.5.5) 56(84) bytes of data.
--- 223.5.5.5 ping statistics ---
1000 packets transmitted, 1000 received, 0% packet loss, time 12052ms
rtt min/avg/max/mdev = 11.482/46.238/348.876/69.324 ms, pipe 32, ipg/ewma 12.063/79.781 ms1.4 curl命令
curl是一个功能很强大的命令行工具，用于通过URL进行传输数据。在rockyLinux10中，它常用于测试API、下载文件和排查网络问题。
常用参数：
| 选项参数 | 说明 |
|---|---|
| -I | 显示HTTP头部信息 |
| -L | 访问http时，自动跳转到HTTPS，显示网站内容 |
| -o | 把访问到网站内容保存到指定的文件中 |
| -O | 下载网站中文件，使用网站文件名作为文件名 |
| -C - -O | 断点重传，当下载的文件中断，在重新下载会从中断的地方进行下载 |
| -X | 以什么形式进行访问，如-X post ：以post请求方式进行访问 |
| -H | 添加访问头部 |
| -D | 访问json数据体 |
| -u | 发送用户名和密码进行认证访问。 |
示例:
默认将HTML内容输出到终端:
shell
root@studry:~# curl 10.0.0.135
wmn....只获取HTTP头部信息：
shell
root@studry:~# curl -I 10.0.0.135
HTTP/1.1 200 OK
Server: nginx/1.26.3
Date: Thu, 01 Oct 2026 06:18:33 GMT
Content-Type: text/html
Content-Length: 8
Last-Modified: Thu, 01 Oct 2026 06:14:10 GMT
Connection: keep-alive
ETag: "6abdfa32-8"
Accept-Ranges: bytes
`说明：`
只获取HTTP头部信息，快速检查状态码和服务类型。跟随重定向：访问的网站从HTTP条状到HTTPS:
shell
root@studry:~# curl -L www.deepseek.com
<!DOCTYPE html><html lang="zh-CN"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="preload" as="image" href="/images/app-qrcode.png"/><自定义文件名保存：用于访问的内容保存到指定文件中：
shell
root@studry:~# curl -o deepseek.html -L www.deepseek.com
2)查看文件内容：
root@studry:~# head -1 deepseek.html
<!DOCTYPE html><html lang="zh-CN"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="preload" as="image" href="/images/app-qrcode.png"/>下载网站上文件：
shell
ot@studry:~/jenkins# curl -O https://mirrors.aliyun.com/jenkins/war/2.584/jenkins.war
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 50.1M 100 50.1M 0 0 14.2M 0 0:00:03 0:00:03 --:--:-- 14.2M
2)查看是否下载成功:
root@studry:~/jenkins# ls
jenkins.war断点续传，当中断会继续下载大文件：
shell
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 50.1M 100 50.1M 0 0 13.1M 0 0:00:03 0:00:03 --:--:-- 13.1M发送GET请求(带参数)：
shell
curl "https://api.example.com/search?q=keyword"发送JSON格式的POST请求：
shell
curl -X POST https://api.example.com/v1/items \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <你的Token>" \
-d '{"name":"widget","qty":12}'使用HTTP基本认证：
shell
curl -u user:pass https://example.com
发送用户名和密码进行认证。网站健康检查：
shell
root@studry:~/jenkins# curl -sS -I https://www.guoshengxd.com
HTTP/1.1 200 OK
Date: Thu, 01 Oct 2026 06:46:31 GMT
Content-Type: text/html
Content-Length: 2852
Connection: keep-alive
Set-Cookie: HWWAFSESID=8a866737d0c1203647; path=/
Set-Cookie: HWWAFSESTIME=1790837191473; path=/
Last-Modified: Fri, 31 Jul 2026 06:56:34 GMT
ETag: "6a6c4722-b24"
Accept-Ranges: bytes
Server: CW1.5 Linux常用的抓包工具---tcpdump
tcpdump是Linux系统中经典的命令行抓包分析工具，当需要排查网络问题时，它几乎是首先工具。
常用参数：
| 选项参数 | 说明 |
|---|---|
| -i | 指定抓包网口 |
| -nn | 不把IP地址解析成主机名，不把端口号解析成服务名 |
| -c | 设定抓包的数量 |
| -w | 把抓包信息保存到本地文件中 |
| -r | 读取保存抓包的文件 |
过滤语法：
根据主机进行过滤：
| 过滤参数 | 说明 |
|---|---|
| host | 双向主机IP地址进行过滤，例如：host 10.0.0.2 ,过滤源地址是10.0.0.2或过滤目标地址是10.0.0.2 |
| src | 过滤源地址请求。src 10.0.0.3:仅过滤源地址是10.0.0.3包 |
| dst | 仅过滤目标地址请求。dst 10.0.0.4：仅过滤目标地址是10.0.0.4请求。 |
端口过滤：
| 过滤参数 | 说明 |
|---|---|
| port 80 | 双向过滤80端口 |
| src port 22 | 只过滤源端口是22 |
| dst port 80 | 只过滤目的端口是80 |
| portrange21-25 | 双向过滤端口范围21-25端口 |
根据协议进行过滤：
| 协议参数 | 说明 |
|---|---|
| tcp | 过滤tcp协议 |
| udp | 过滤udp协议 |
| icmp | 过滤icmp |
| arp | 过滤arp |
根据网络进行过滤：
| 过滤参数 | 说明 |
|---|---|
| net 10.0.0.0/24 | 过滤10.0.0.0/24网段 |
逻辑组合：
| 组合参数 | 说明 |
|---|---|
| and | 并列，and两边必须都成立 |
| or | 或者，or两边只有一边成立即可行 |
| not | 不是，不是这个都显示出来 |
示例：
排查web服务请求并且保存到文件中：
shell
root@studry:~/jenkins# tcpdump -nn -i ens160 port 80 -w http.pcap
2)查看文件内容：
root@studry:~/jenkins# tcpdump -r http.pcap
reading from file http.pcap, link-type EN10MB (Ethernet), snapshot length 262144
dropped privs to tcpdump
15:32:05.053387 IP 10.0.0.135.48220 > studry.http: Flags [S], seq 1808604886, win 64240, options [mss 1460,sackOK,TS val 1188491515 ecr 0,nop,wscale 7], length 0
15:32:05.053426 IP studry.http > 10.0.0.135.48220: Flags [S.], seq 578449306, ack 1808604887, win 65160, options [mss 1460,sackOK,TS val 971335435 ecr 1188491515,nop,wscale 7], length 0
15:32:05.053717 IP 10.0.0.135.48220 > studry.http: Flags [.], ack 1, win 502, options [nop,nop,TS val 1188491515 ecr 971335435], length 0
15:32:05.053798 IP 10.0.0.135.48220 > studry.http: Flags [P.], seq 1:75, ack 1, win 502, options [nop,nop,TS val 1188491516 ecr 971335435], length 74: HTTP: HEAD / HTTP/1.1
15:32:05.053810 IP studry.http > 10.0.0.135.48220: Flags [.], ack 75, win 509, options [nop,nop,TS val 971335435 ecr 1188491516], length 0
15:32:05.054289 IP studry.http > 10.0.0.135.48220: Flags [P.], seq 1:241, ack 75, win 509, options [nop,nop,TS val 971335435 ecr 1188491516], length 240: HTTP: HTTP/1.1 200 OK
15:32:05.054624 IP 10.0.0.135.48220 > studry.http: Flags [.], ack 241, win 501, options [nop,nop,TS val 1188491516 ecr 971335435], length 0
15:32:05.066578 IP 10.0.0.135.48220 > studry.http: Flags [F.], seq 75, ack 241, win 501, options [nop,nop,TS val 1188491528 ecr 971335435], length 0
15:32:05.066644 IP studry.http > 10.0.0.135.48220: Flags [F.], seq 241, ack 76, win 509, options [nop,nop,TS val 971335448 ecr 1188491528], length 0
15:32:05.066844 IP 10.0.0.135.48220 > studry.http: Flags [.], ack 242, win 501, options [nop,nop,TS val 1188491529 ecr 971335448], length 0抓取ping和arp报文数据：
shell
root@studry:~/jenkins# tcpdump -i ens160 -nn icmp or arp -w ping_arp.icmp
dropped privs to tcpdump
tcpdump: listening on ens160, link-type EN10MB (Ethernet), snapshot length 262144 bytes
^C8 packets captured
8 packets received by filter
0 packets dropped by kernel
root@studry:~/jenkins# tcpdump -r ping_arp.icmp
reading from file ping_arp.icmp, link-type EN10MB (Ethernet), snapshot length 262144
dropped privs to tcpdump
15:35:05.106607 IP 10.0.0.135 > studry: ICMP echo request, id 3, seq 1, length 64
15:35:05.106673 IP studry > 10.0.0.135: ICMP echo reply, id 3, seq 1, length 64
15:35:06.108868 IP 10.0.0.135 > studry: ICMP echo request, id 3, seq 2, length 64
15:35:06.108896 IP studry > 10.0.0.135: ICMP echo reply, id 3, seq 2, length 64
15:35:10.326709 ARP, Request who-has 10.0.0.135 tell studry, length 28
15:35:10.327357 ARP, Reply 10.0.0.135 is-at 00:0c:29:22:bb:32 (oui Unknown), length 46
15:35:10.390181 ARP, Request who-has studry tell 10.0.0.135, length 46
15:35:10.390200 ARP, Reply studry is-at 00:0c:29:89:35:b7 (oui Unknown), length 28抓取sshd包：
shell
root@studry:~/jenkins# tcpdump -i ens160 -nn port 22 -w sshd.pcap
dropped privs to tcpdump
tcpdump: listening on ens160, link-type EN10MB (Ethernet), snapshot length 262144 bytes
^C46 packets captured
46 packets received by filter
0 packets dropped by kernel
root@studry:~/jenkins# tcpdump -A -r sshd.pcap
15:39:45.131483 IP 10.0.0.135.54074 > studry.ssh: Flags [S], seq 1898878506, win 64240, options [mss 1460,sackOK,TS val 1188951594 ecr 0,nop,wscale 7], length 0
EH.<.k@.@.F%
...
..].:..q..*........ z.........
F..*........抓取dns报文：
shell
root@studry:~/jenkins# tcpdump -nn -i ens160 -nn udp port 53 -w dns.pcap
root@studry:~/jenkins# tcpdump -nn -r dns.pcap
reading from file dns.pcap, link-type EN10MB (Ethernet), snapshot length 262144
dropped privs to tcpdump
15:48:58.621023 IP 10.0.0.93.40487 > 10.0.0.150.53: 54470+ A? www.magedu.com. (32)
15:48:58.621895 IP 10.0.0.150.53 > 10.0.0.93.40487: 54470 1/0/0 A 43.226.56.46 (48)
15:48:58.622391 IP 10.0.0.93.58293 > 10.0.0.150.53: 42449+ AAAA? www.magedu.com. (32)
15:48:58.623045 IP 10.0.0.150.53 > 10.0.0.93.58293: 42449 0/1/0 (95)
15:48:58.623277 IP 10.0.0.93.50208 > 10.0.0.150.53: 45508+ MX? www.magedu.com. (32)
15:48:58.623826 IP 10.0.0.150.53 > 10.0.0.93.50208: 45508 0/1/0 (95)1.6 DNS命令集合
1.6.0 验证DNS命令
1.6.0.0 dig命令
命令示例：
解析www.baidu.com域名：
shell
[root@studry ~]# dig www.baidu.com
; <<>> DiG 9.18.33 <<>> www.baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9527
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: e87c1ac02f7997c9010000006abe11f53311ca2570cacb75 (good)
;; QUESTION SECTION:
;www.baidu.com. IN A
;; ANSWER SECTION:
www.baidu.com. 463 IN CNAME www.a.shifen.com.
www.a.shifen.com. 38 IN A 110.242.69.21
www.a.shifen.com. 38 IN A 110.242.70.57
;; Query time: 1 msec
;; SERVER: 10.0.0.150#53(10.0.0.150) (UDP)
;; WHEN: Thu Oct 01 15:55:33 CST 2026
;; MSG SIZE rcvd: 132只显示dns解析的IP地址：
shell
[root@studry ~]# dig www.baidu.com +short
www.a.shifen.com.
110.242.70.57
110.242.69.21指定dns进行解析：
shell
[root@studry ~]# dig @223.5.5.5 www.magedu.com
; <<>> DiG 9.18.33 <<>> @223.5.5.5 www.magedu.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28941
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;www.magedu.com. IN A
;; ANSWER SECTION:
www.magedu.com. 577 IN A 43.226.56.46
;; Query time: 19 msec
;; SERVER: 223.5.5.5#53(223.5.5.5) (UDP)
;; WHEN: Thu Oct 01 15:58:50 CST 2026
;; MSG SIZE rcvd: 59指定查询记录：
shell
1)只查询A记录：
[root@studry ~]# dig jd.com A +short
106.39.171.134
111.13.149.108
211.144.24.218
211.144.27.126
2)只查询权威DNS
[root@studry ~]# dig jd.com SOA +short
ns1.jdcache.com. apollo.jd.com. 2015280403 10800 3600 604800 38400
3)查询服务器的域名：
[root@studry ~]# dig jd.com NS +short
ns1.jd.com.
ns4.jdcache.com.
ns3.jd.com.
ns2.jdcache.com.
ns3.jdcache.com.
ns5.jd.com.
ns1.jdcache.com.
ns4.jd.com.
ns2.jd.com.
ns5.jdcache.com.
3)查询邮件服务器
[root@studry ~]# dig jd.com MX +short
30 mx1.jd.com.
5 mx.jd.com.
4)查询CNaME解析
[root@studry ~]# dig jd.com CNAME +short
5)查询TXT记录
[root@studry ~]# dig jd.com TXT +short
"globalsign-domain-verification=FtLF6A52URFV2IMTamnviNHHyQDZCyAnIHhoxdb_YF"
"v=spf1 include:a.spf.jd.com include:b.spf.jd.com include:c.spf.jd.com include:servers.mcsv.net -all"1.6.0.1 nslookup命令
nslookup命令实例：
查看www.baidu.com域名解析：
shell
[root@studry ~]# nslookup www.baidu.com
Server: 10.0.0.150
Address: 10.0.0.150#53
Non-authoritative answer:
www.baidu.com canonical name = www.a.shifen.com.
Name: www.a.shifen.com
Address: 110.242.70.57
Name: www.a.shifen.com
Address: 110.242.69.21
Name: www.a.shifen.com
Address: 2408:871a:2100:186c:0:ff:b07e:3fbc
Name: www.a.shifen.com
Address: 2408:871a:2100:1b23:0:ff:b07a:7ebc
`说明：`
默认使用/etc/resolve文件配置的DNS指定dns服务器进行解析：
shell
[root@studry ~]# nslookup www.jd.com 8.8.8.8
Server: 8.8.8.8
Address: 8.8.8.8#53
Non-authoritative answer:
www.jd.com canonical name = www.jd.com.gslb.qianxun.com.
www.jd.com.gslb.qianxun.com canonical name = jd-abroad.cdn20.com.
Name: jd-abroad.cdn20.com
Address: 27.222.17.238
Name: jd-abroad.cdn20.com
Address: 222.132.143.16查看域名指定的记录：
shell
1)查看A记录：
[root@studry ~]# nslookup -type=A jd.com
Server: 10.0.0.150
Address: 10.0.0.150#53
Non-authoritative answer:
Name: jd.com
Address: 111.13.149.108
Name: jd.com
Address: 211.144.24.218
Name: jd.com
Address: 211.144.27.126
Name: jd.com
Address: 106.39.171.134
2)查看NS记录：
[root@studry ~]# nslookup -type=NS jd.com
Server: 10.0.0.150
Address: 10.0.0.150#53
Non-authoritative answer:
jd.com nameserver = ns2.jd.com.
jd.com nameserver = ns5.jd.com.
jd.com nameserver = ns1.jdcache.com.
jd.com nameserver = ns4.jdcache.com.
jd.com nameserver = ns2.jdcache.com.
jd.com nameserver = ns3.jdcache.com.
jd.com nameserver = ns4.jd.com.
jd.com nameserver = ns3.jd.com.
jd.com nameserver = ns5.jdcache.com.
jd.com nameserver = ns1.jd.com.
Authoritative answers can be found from:
3)查看MX记录：
[root@studry ~]# nslookup -type=MX jd.com
Server: 10.0.0.150
Address: 10.0.0.150#53
Non-authoritative answer:
jd.com mail exchanger = 5 mx.jd.com.
jd.com mail exchanger = 30 mx1.jd.com.
Authoritative answers can be found from:
4)查看TXT记录：
[root@studry ~]# nslookup -type=TXT jd.com
Server: 10.0.0.150
Address: 10.0.0.150#53
Non-authoritative answer:
jd.com text = "globalsign-domain-verification=FtLF6A52URFV2IMTamnviNHHyQDZCyAnIHhoxdb_YF"
jd.com text = "v=spf1 include:a.spf.jd.com include:b.spf.jd.com include:c.spf.jd.com include:servers.mcsv.net -all"
Authoritative answers can be found from:
4)查看SOA记录：
[root@studry ~]# nslookup -type=SOA jd.com
Server: 10.0.0.150
Address: 10.0.0.150#53
Non-authoritative answer:
jd.com
origin = ns1.jdcache.com
mail addr = apollo.jd.com
serial = 2015280403
refresh = 10800
retry = 3600
expire = 604800
minimum = 38400
Authoritative answers can be found from:
5)查看MAX记录：
[root@studry ~]# nslookup -type=MX jd.com
Server: 10.0.0.150
Address: 10.0.0.150#53
Non-authoritative answer:
jd.com mail exchanger = 5 mx.jd.com.
jd.com mail exchanger = 30 mx1.jd.com.
Authoritative answers can be found from:1.6.0.2 host命令
例子：
查询magedu.com域名：
shell
[root@studry ~]# host magedu.com
magedu.com has address 43.226.56.46
magedu.com mail is handled by 10 mxbiz2.qq.com.
magedu.com mail is handled by 5 mxbiz1.qq.com.查询www.magedu.com子域名：
shell
[root@studry ~]# host www.magedu.com
www.magedu.com has address 43.226.56.46指定DNS进行查询域名：
shell
[root@studry ~]# host www.magedu.com 8.8.8.8
Using domain server:
Name: 8.8.8.8
Address: 8.8.8.8#53
Aliases:
www.magedu.com has address 43.226.56.46指定查询记录：
shell
1)查询所有记录：
[root@studry ~]# host -a magedu.com
Trying "magedu.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38578
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;magedu.com. IN ANY
;; ANSWER SECTION:
magedu.com. 442 IN MX 5 mxbiz1.qq.com.
magedu.com. 442 IN MX 10 mxbiz2.qq.com.
magedu.com. 589 IN A 43.226.56.46
magedu.com. 2117 IN NS dns9.hichina.com.
magedu.com. 2117 IN NS dns10.hichina.com.
Received 146 bytes from 10.0.0.150#53 in 4 ms
2)查询NS记录：
[root@studry ~]# host -t NS magedu.com
magedu.com name server dns9.hichina.com.
magedu.com name server dns10.hichina.com.
3)查询SOA记录：
[root@studry ~]# host -t SOA magedu.com
magedu.com has SOA record dns9.hichina.com. hostmaster.hichina.com. 2026082509 3600 1200 86400 600
4)查询TXT记录：
[root@studry ~]# host -t TXT jd.com
jd.com descriptive text "v=spf1 include:a.spf.jd.com include:b.spf.jd.com include:c.spf.jd.com include:servers.mcsv.net -all"
jd.com descriptive text "globalsign-domain-verification=FtLF6A52URFV2IMTamnviNHHyQDZCyAnIHhoxdb_YF"
5)查询MX记录。
[root@studry ~]# host -t MX jd.com
jd.com mail is handled by 30 mx1.jd.com.
jd.com mail is handled by 5 mx.jd.com.