Ðóêîâîäñòâî àäìèíèñòðàòîðà Linux ïî óñòðàíåíèþ íåïîëàäîê è îòëàäêå

Îáû÷íûå çàäà÷è ñèñòåìíîãî àäìèíèñòðàòîðà âêëþ÷àþò íàñòðîéêó, îáñëóæèâàíèå, óñòðàíåíèå íåïîëàäîê è óïðàâëåíèå ñåðâåðàìè è ñåòÿìè â öåíòðàõ îáðàáîòêè äàííûõ.  Linux ñóùåñòâóåò ìíîæåñòâî èíñòðóìåíòîâ è óòèëèò, ïðåäíàçíà÷åííûõ äëÿ àäìèíèñòðàòèâíûõ öåëåé.

 ýòîé ñòàòüå ìû ðàññìîòðèì íåêîòîðûå èç íàèáîëåå ÷àñòî èñïîëüçóåìûõ èíñòðóìåíòîâ è óòèëèò êîìàíäíîé ñòðîêè äëÿ óïðàâëåíèÿ ñåòÿìè â Linux â ðàçëè÷íûõ êàòåãîðèÿõ. Ìû îáúÿñíèì íåêîòîðûå ðàñïðîñòðàíåííûå ïðèìåðû èñïîëüçîâàíèÿ, êîòîðûå çíà÷èòåëüíî óïðîñòÿò óïðàâëåíèå ñåòüþ â Linux.

---

Èíñòðóìåíòû íàñòðîéêè, ïîèñêà, óñòðàíåíèÿ íåïîëàäîê è îòëàäêè ñåòè

1. Êîìàíäà ifconfig

ifconfig - ýòî èíñòðóìåíò êîìàíäíîé ñòðîêè (CLI) äëÿ íàñòðîéêè ñåòåâîãî èíòåðôåéñà, êîòîðûé òàêæå èñïîëüçóåòñÿ äëÿ èíèöèàëèçàöèè èíòåðôåéñîâ âî âðåìÿ çàãðóçêè ñèñòåìû. Êîãäà ñåðâåð çàïóùåí è ðàáîòàåò, ifconfig ìîæíî èñïîëüçîâàòü äëÿ íàçíà÷åíèÿ IP-àäðåñà èíòåðôåéñó è âêëþ÷åíèÿ èëè îòêëþ÷åíèÿ èíòåðôåéñà ïî òðåáîâàíèþ.

Ifconfig òàêæå èñïîëüçóåòñÿ äëÿ ïðîñìîòðà ñòàòóñà IP-àäðåñà, MAC-àäðåñà, à òàêæå ðàçìåðà MTU (ìàêñèìàëüíàÿ åäèíèöà ïåðåäà÷è - Maximum Transmission Unit) òåêóùèõ àêòèâíûõ èíòåðôåéñîâ. Òàêèì îáðàçîì, ifconfig ïîëåçåí äëÿ îòëàäêè èëè íàñòðîéêè ñèñòåìû.

Âîò ïðèìåð äëÿ îòîáðàæåíèÿ ñòàòóñà âñåõ àêòèâíûõ ñåòåâûõ èíòåðôåéñîâ.

$ ifconfig

enp1s0    Link encap:Ethernet  HWaddr 28:d2:44:eb:bd:98  
          inet addr:192.168.0.103  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::8f0c:7825:8057:5eec/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:169854 errors:0 dropped:0 overruns:0 frame:0
          TX packets:125995 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:174146270 (174.1 MB)  TX bytes:21062129 (21.0 MB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:15793 errors:0 dropped:0 overruns:0 frame:0
          TX packets:15793 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:2898946 (2.8 MB)  TX bytes:2898946 (2.8 MB)

×òîáû âûâåñòè ñïèñîê âñåõ äîñòóïíûõ íà äàííûé ìîìåíò èíòåðôåéñîâ, âêëþ÷åííûõ èëè âûêëþ÷åííûõ, èñïîëüçóéòå ôëàã -a.

$ ifconfig -a 	

Äëÿ òîãî ÷òîáû íàçíà÷èòü IP-àäðåñ èíòåðôåéñó, èñïîëüçóéòå ñëåäóþùóþ êîìàíäó:

$ sudo ifconfig eth0 192.168.56.5 netmask 255.255.255.0

×òîáû àêòèâèðîâàòü ñåòåâîé èíòåðôåéñ, ââåäèòå:

$ sudo ifconfig up eth0

×òîáû äåàêòèâèðîâàòü èëè îòêëþ÷èòü ñåòåâîé èíòåðôåéñ, ââåäèòå:

$ sudo ifconfig down eth0

Âíèìàíèå: Õîòÿ ifconfig - îòëè÷íûé èíñòðóìåíò, òåïåðü îí óñòàðåë (deprecated), è åãî çàìåíîé ÿâëÿåòñÿ êîìàíäà ip, î êîòîðîé ìû ðàññêàæåì íèæå.

2. Êîìàíäà IP

Êîìàíäà IP - åùå îäíà ïîëåçíàÿ óòèëèòà êîìàíäíîé ñòðîêè äëÿ îòîáðàæåíèÿ è óïðàâëåíèÿ ìàðøðóòèçàöèåé, ñåòåâûìè óñòðîéñòâàìè, èíòåðôåéñàìè. Ýòî çàìåíà äëÿ ifconfig è ìíîãèõ äðóãèõ ñåòåâûõ êîìàíä.

Ñëåäóþùàÿ êîìàíäà ïîêàæåò IP-àäðåñ è äðóãóþ èíôîðìàöèþ î ñåòåâîì èíòåðôåéñå.

$ ip addr show

1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp1s0:  mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 28:d2:44:eb:bd:98 brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.103/24 brd 192.168.0.255 scope global dynamic enp1s0
       valid_lft 5772sec preferred_lft 5772sec
    inet6 fe80::8f0c:7825:8057:5eec/64 scope link 
       valid_lft forever preferred_lft forever
3: wlp2s0:  mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 38:b1:db:7c:78:c7 brd ff:ff:ff:ff:ff:ff
...

×òîáû âðåìåííî íàçíà÷èòü IP-àäðåñ îïðåäåëåííîìó ñåòåâîìó èíòåðôåéñó (eth0), ââåäèòå:

$ sudo ip addr add 192.168.56.1 dev eth0

×òîáû óäàëèòü íàçíà÷åííûé IP-àäðåñ c ñåòåâîãî èíòåðôåéñà (eth0), ââåäèòå:

$ sudo ip addr del 192.168.56.15/24 dev eth0

×òîáû ïîêàçàòü òåêóùóþ òàáëèöó ñîñåäåé â ÿäðå, ââåäèòå:

$ ip neigh
192.168.0.1 dev enp1s0 lladdr 10:fe:ed:3d:f3:82 REACHABLE

3. Êîìàíäû ifup, ifdown, è ifquery

Êîìàíäà ifup àêòèâèðóåò ñåòåâîé èíòåðôåéñ, äåëàÿ åãî äîñòóïíûì äëÿ ïåðåäà÷è è ïîëó÷åíèÿ äàííûõ.

$ sudo ifup eth0

Êîìàíäà ifdow îòêëþ÷àåò ñåòåâîé èíòåðôåéñ, ñîõðàíÿÿ åãî â ñîñòîÿíèè, êîãäà îí íå ìîæåò ïåðåäàâàòü èëè ïîëó÷àòü äàííûå.

$ sudo ifdown eth0

Êîìàíäà ifquery èñïîëüçóåòñÿ äëÿ àíàëèçà êîíôèãóðàöèè ñåòåâîãî èíòåðôåéñà, ÷òî ïîçâîëÿåò ïîëó÷àòü îòâåòû íà çàïðîñû î òîì, êàê îí íàñòðîåí â äàííûé ìîìåíò.

$ sudo ifquery eth0

4. Êîìàíäà Ethtool

ethtool - ýòî óòèëèòà çàïðîñà è èçìåíåíèÿ ïàðàìåòðîâ êîíòðîëëåðà ñåòåâîãî èíòåðôåéñà è äðàéâåðîâ óñòðîéñòâ. Â ïðèâåäåííîì íèæå ïðèìåðå ïîêàçàíî èñïîëüçîâàíèå ethtool è êîìàíäû äëÿ ïðîñìîòðà ïàðàìåòðîâ ñåòåâîãî èíòåðôåéñà.

$ sudo ethtool enp0s3

Settings for enp0s3:
	Supported ports: [ TP ]
	Supported link modes:   10baseT/Half 10baseT/Full 
	                        100baseT/Half 100baseT/Full 
	                        1000baseT/Full 
	Supported pause frame use: No
	Supports auto-negotiation: Yes
	Advertised link modes:  10baseT/Half 10baseT/Full 
	                        100baseT/Half 100baseT/Full 
	                        1000baseT/Full 
	Advertised pause frame use: No
	Advertised auto-negotiation: Yes
	Speed: 1000Mb/s
	Duplex: Full
	Port: Twisted Pair
	PHYAD: 0
	Transceiver: internal
	Auto-negotiation: on
	MDI-X: off (auto)
	Supports Wake-on: umbg
	Wake-on: d
	Current message level: 0x00000007 (7)
			       drv probe link
	Link detected: yes

5. Êîìàíäà Ping

ping (Packet INternet Groper) – ýòî âñåìè èçâåñòíàÿ óòèëèòà, îáû÷íî èñïîëüçóåìàÿ äëÿ òåñòèðîâàíèÿ ñîåäèíåíèÿ ìåæäó äâóìÿ ñèñòåìàìè â ñåòè (LAN èëè WAN). Ping èñïîëüçóåò ïðîòîêîë ICMP (Internet Control Message Protocol) äëÿ ñâÿçè ñ óçëàìè â ñåòè.

×òîáû ïðîâåðèòü ïîäêëþ÷åíèå ê äðóãîìó óçëó, ïðîñòî óêàæèòå åãî IP èëè èìÿ õîñòà, íàïðèìåð:

$ ping 192.168.0.103

PING 192.168.0.103 (192.168.0.103) 56(84) bytes of data.
64 bytes from 192.168.0.103: icmp_seq=1 ttl=64 time=0.191 ms
64 bytes from 192.168.0.103: icmp_seq=2 ttl=64 time=0.156 ms
64 bytes from 192.168.0.103: icmp_seq=3 ttl=64 time=0.179 ms
64 bytes from 192.168.0.103: icmp_seq=4 ttl=64 time=0.182 ms
64 bytes from 192.168.0.103: icmp_seq=5 ttl=64 time=0.207 ms
64 bytes from 192.168.0.103: icmp_seq=6 ttl=64 time=0.157 ms
^C
--- 192.168.0.103 ping statistics ---
6 packets transmitted, 6 received, 0% packet loss, time 5099ms
rtt min/avg/max/mdev = 0.156/0.178/0.207/0.023 ms

Âû òàêæå ìîæåòå óêàçàòü ping âûõîäèòü ïîñëå óêàçàííîãî êîëè÷åñòâà ïàêåòîâ ECHO_REQUEST, èñïîëüçóÿ ôëàã -c, êàê ïîêàçàíî íèæå:

$ ping -c 4 192.168.0.103

PING 192.168.0.103 (192.168.0.103) 56(84) bytes of data.
64 bytes from 192.168.0.103: icmp_seq=1 ttl=64 time=1.09 ms
64 bytes from 192.168.0.103: icmp_seq=2 ttl=64 time=0.157 ms
64 bytes from 192.168.0.103: icmp_seq=3 ttl=64 time=0.163 ms
64 bytes from 192.168.0.103: icmp_seq=4 ttl=64 time=0.190 ms

--- 192.168.0.103 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3029ms
rtt min/avg/max/mdev = 0.157/0.402/1.098/0.402 ms

6. Êîìàíäà Traceroute

Traceroute - ýòî óòèëèòà êîìàíäíîé ñòðîêè äëÿ îòñëåæèâàíèÿ ïîëíîãî ïóòè îò âàøåé ëîêàëüíîé ñèñòåìû äî äðóãîé ñåòåâîé ñèñòåìû. Traceroute îòîáðàæàåò êîëè÷åñòâî õîïîâ (IP-àäðåñîâ ìàðøðóòèçàòîðà) ïî òîìó ïóòè, ïî êîòîðîìó âû èäåòå, ÷òîáû äîáðàòüñÿ äî êîíå÷íîãî ñåðâåðà. Ýòî ïðîñòàÿ â èñïîëüçîâàíèè óòèëèòà äëÿ óñòðàíåíèÿ íåïîëàäîê â ñåòè ïîñëå êîìàíäû ping.

 ýòîì ïðèìåðå ìû îòñëåæèâàåì ìàðøðóò, ïî êîòîðîìó ïàêåòû îòïðàâëÿþòñÿ èç ëîêàëüíîé ñèñòåìû íà îäèí èç ñåðâåðîâ Google ñ IP-àäðåñîì 216.58.204.46:

$ traceroute 216.58.204.46

traceroute to 216.58.204.46 (216.58.204.46), 30 hops max, 60 byte packets
 1  gateway (192.168.0.1)  0.487 ms  0.277 ms  0.269 ms
 2  5.5.5.215 (5.5.5.215)  1.846 ms  1.631 ms  1.553 ms
 3  * * *
 4  72.14.194.226 (72.14.194.226)  3.762 ms  3.683 ms  3.577 ms
 5  108.170.248.179 (108.170.248.179)  4.666 ms 108.170.248.162 (108.170.248.162)  4.869 ms 108.170.248.194 (108.170.248.194)  4.245 ms
 6  72.14.235.133 (72.14.235.133)  72.443 ms 209.85.241.175 (209.85.241.175)  62.738 ms 72.14.235.133 (72.14.235.133)  65.809 ms
 7  66.249.94.140 (66.249.94.140)  128.726 ms  127.506 ms 209.85.248.5 (209.85.248.5)  127.330 ms
 8  74.125.251.181 (74.125.251.181)  127.219 ms 108.170.236.124 (108.170.236.124)  212.544 ms 74.125.251.181 (74.125.251.181)  127.249 ms
 9  216.239.49.134 (216.239.49.134)  236.906 ms 209.85.242.80 (209.85.242.80)  254.810 ms  254.735 ms
10  209.85.251.138 (209.85.251.138)  252.002 ms 216.239.43.227 (216.239.43.227)  251.975 ms 209.85.242.80 (209.85.242.80)  236.343 ms
11  216.239.43.227 (216.239.43.227)  251.452 ms 72.14.234.8 (72.14.234.8)  279.650 ms  277.492 ms
12  209.85.250.9 (209.85.250.9)  274.521 ms  274.450 ms 209.85.253.249 (209.85.253.249)  270.558 ms
13  209.85.250.9 (209.85.250.9)  269.147 ms 209.85.254.244 (209.85.254.244)  347.046 ms 209.85.250.9 (209.85.250.9)  285.265 ms
14  64.233.175.112 (64.233.175.112)  344.852 ms 216.239.57.236 (216.239.57.236)  343.786 ms 64.233.175.112 (64.233.175.112)  345.273 ms
15  108.170.246.129 (108.170.246.129)  345.054 ms  345.342 ms 64.233.175.112 (64.233.175.112)  343.706 ms
16  108.170.238.119 (108.170.238.119)  345.610 ms 108.170.246.161 (108.170.246.161)  344.726 ms 108.170.238.117 (108.170.238.117)  345.536 ms
17  lhr25s12-in-f46.1e100.net (216.58.204.46)  345.382 ms  345.031 ms  344.884 ms

7. MTR Network Diagnostic Tool

MTR - ýòî ñîâðåìåííûé èíñòðóìåíò äëÿ äèàãíîñòèêè ñåòè èç êîìàíäíîé ñòðîêè, êîòîðûé îáúåäèíÿåò ôóíêöèè ping è traceroute â îäíîì äèàãíîñòè÷åñêîì èíñòðóìåíòå. Åãî âûâîä îáíîâëÿåòñÿ â ðåæèìå ðåàëüíîãî âðåìåíè, ïî óìîë÷àíèþ, ïîêà âû íå âûéäåòå èç ïðîãðàììû, íàæàâ q.

Ñàìûé ïðîñòîé ñïîñîá çàïóñòèòü mtr - óêàçàòü â êà÷åñòâå àðãóìåíòà èìÿ õîñòà èëè IP-àäðåñ ñëåäóþùèì îáðàçîì:

$ mtr google.com
ÈËÈ
$ mtr 216.58.223.78

Ïðèìåð âûâîäà:

wiki.merionet.ru (0.0.0.0)                                   Thu Jul 12 08:58:27 2018
First TTL: 1

 Host                                                   Loss%   Snt   Last   Avg  Best  Wrst StDev
 1. 192.168.0.1                                         0.0%    41    0.5   0.6   0.4   1.7   0.2
 2. 5.5.5.215                                           0.0%    40    1.9   1.5   0.8   7.3   1.0
 3. 209.snat-111-91-120.hns.net.in                      23.1%    40    1.9   2.7   1.7  10.5   1.6
 4. 72.14.194.226                                       0.0%    40   89.1   5.2   2.2  89.1  13.7
 5. 108.170.248.193                                     0.0%    40    3.0   4.1   2.4  52.4   7.8
 6. 108.170.237.43                                      0.0%    40    2.9   5.3   2.5  94.1  14.4
 7. bom07s10-in-f174.1e100.net                          0.0%    40    2.6   6.7   2.3  79.7  16.

Âû ìîæåòå îãðàíè÷èòü êîëè÷åñòâî ïèíãîâ îïðåäåëåííûì çíà÷åíèåì è âûéòè èç mtr ïîñëå ýòèõ ïèíãîâ, èñïîëüçóÿ ôëàã -c.

$ mtr -c 4 google.com

8. Êîìàíäà Route

route - ýòî óòèëèòà äëÿ îòîáðàæåíèÿ èëè ìàíèïóëèðîâàíèÿ òàáëèöåé IP-ìàðøðóòèçàöèè ñèñòåìû Linux. Route â îñíîâíîì èñïîëüçóåòñÿ äëÿ íàñòðîéêè ñòàòè÷åñêèõ ìàðøðóòîâ ê êîíêðåòíûì õîñòàì èëè ñåòÿì ÷åðåç èíòåðôåéñ.

Âû ìîæåòå ïðîñìîòðåòü òàáëèöó ìàðøðóòèçàöèè IP ÿäðà, íàáðàâ:

$ route

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         gateway         0.0.0.0         UG    100    0        0 enp0s3
192.168.0.0     0.0.0.0         255.255.255.0   U     100    0        0 enp0s3
192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr0

Ñóùåñòâóåò ìíîæåñòâî êîìàíä, êîòîðûå âû ìîæåòå èñïîëüçîâàòü äëÿ íàñòðîéêè ìàðøðóòèçàöèè. Âîò íåñêîëüêî ïîëåçíûõ.

Äîáàâèòü øëþç ïî óìîë÷àíèþ â òàáëèöó ìàðøðóòèçàöèè:

$ sudo route add default gw 

Äîáàâèòü ñåòåâîé ìàðøðóò â òàáëèöó ìàðøðóòèçàöèè:

$ sudo route add -net  gw  

Óäàëèòü êîíêðåòíóþ çàïèñü ìàðøðóòà èç òàáëèöû ìàðøðóòèçàöèè:

$ sudo route del -net 

9. Êîìàíäà Nmcli

Nmcli - ýòî ïðîñòîé â èñïîëüçîâàíèè èíñòðóìåíò ñ ïîääåðæêîé ñöåíàðèåâ, ïîçâîëÿþùèé ñîîáùàòü î ñîñòîÿíèè ñåòè, óïðàâëÿòü ñåòåâûìè ïîäêëþ÷åíèÿìè è óïðàâëÿòü NetworkManager.

×òîáû ïðîñìîòðåòü âñå âàøè ñåòåâûå óñòðîéñòâà, ââåäèòå:

$ nmcli dev status

DEVICE      TYPE      STATE      CONNECTION         
virbr0      bridge    connected  virbr0             
enp0s3      ethernet  connected  Wired connection 1

×òîáû ïðîâåðèòü ñåòåâûå ïîäêëþ÷åíèÿ â âàøåé ñèñòåìå, ââåäèòå:

$ nmcli con show

Wired connection 1  bc3638ff-205a-3bbb-8845-5a4b0f7eef91  802-3-ethernet  enp0s3 
virbr0              00f5d53e-fd51-41d3-b069-bdfd2dde062b  bridge          virbr0

×òîáû óâèäåòü òîëüêî àêòèâíûå ñîåäèíåíèÿ, äîáàâüòå ôëàã -a.

$ nmcli con show -a

---

Èíñòðóìåíòû ñåòåâîãî ñêàíèðîâàíèÿ è àíàëèçà ïðîèçâîäèòåëüíîñòè

10.Êîìàíäà Netstat

netstat - ýòî èíñòðóìåíò êîìàíäíîé ñòðîêè, êîòîðûé îòîáðàæàåò ïîëåçíóþ èíôîðìàöèþ, òàêóþ êàê ñåòåâûå ñîåäèíåíèÿ, òàáëèöû ìàðøðóòèçàöèè, ñòàòèñòèêó èíòåðôåéñà è ìíîãîå äðóãîå, êàñàþùååñÿ ñåòåâîé ïîäñèñòåìû Linux. Ýòî ïîëåçíî äëÿ óñòðàíåíèÿ íåïîëàäîê â ñåòè è àíàëèçà ïðîèçâîäèòåëüíîñòè.

Êðîìå òîãî, ýòî òàêæå îñíîâíîé èíñòðóìåíò îòëàäêè ñåòåâûõ ñëóæá, èñïîëüçóåìûé äëÿ ïðîâåðêè òîãî, êàêèå ïðîãðàììû ïðîñëóøèâàþò êàêèå ïîðòû. Íàïðèìåð, ñëåäóþùàÿ êîìàíäà ïîêàæåò âñå ïîðòû TCP â ðåæèìå ïðîñëóøèâàíèÿ è êàêèå ïðîãðàììû ïðîñëóøèâàþò èõ.

$ sudo netstat -tnlp

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:587             0.0.0.0:*               LISTEN      1257/master         
tcp        0      0 127.0.0.1:5003          0.0.0.0:*               LISTEN      1/systemd           
tcp        0      0 0.0.0.0:110             0.0.0.0:*               LISTEN      1015/dovecot        
tcp        0      0 0.0.0.0:143             0.0.0.0:*               LISTEN      1015/dovecot        
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      1/systemd           
tcp        0      0 0.0.0.0:465             0.0.0.0:*               LISTEN      1257/master         
tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN      1404/pdns_server    
tcp        0      0 0.0.0.0:21              0.0.0.0:*               LISTEN      1064/pure-ftpd (SER 
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      972/sshd            
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      975/cupsd           
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      1257/master         
tcp        0      0 0.0.0.0:8090            0.0.0.0:*               LISTEN      636/lscpd (lscpd -  
tcp        0      0 0.0.0.0:993             0.0.0.0:*               LISTEN      1015/dovecot        
tcp        0      0 0.0.0.0:995             0.0.0.0:*               LISTEN      1015/dovecot        
tcp6       0      0 :::3306                 :::*                    LISTEN      1053/mysqld         
tcp6       0      0 :::3307                 :::*                    LISTEN      1211/mysqld         
tcp6       0      0 :::587                  :::*                    LISTEN      1257/master         
tcp6       0      0 :::110                  :::*                    LISTEN      1015/dovecot        
tcp6       0      0 :::143                  :::*                    LISTEN      1015/dovecot        
tcp6       0      0 :::111                  :::*                    LISTEN      1/systemd           
tcp6       0      0 :::80                   :::*                    LISTEN      990/httpd           
tcp6       0      0 :::465                  :::*                    LISTEN      1257/master         
tcp6       0      0 :::53                   :::*                    LISTEN      1404/pdns_server    
tcp6       0      0 :::21                   :::*                    LISTEN      1064/pure-ftpd (SER 
tcp6       0      0 :::22                   :::*                    LISTEN      972/sshd            
tcp6       0      0 ::1:631                 :::*                    LISTEN      975/cupsd           
tcp6       0      0 :::25                   :::*                    LISTEN      1257/master         
tcp6       0      0 :::993                  :::*                    LISTEN      1015/dovecot        
tcp6       0      0 :::995                  :::*                    LISTEN      1015/dovecot   

×òîáû ïðîñìîòðåòü òàáëèöó ìàðøðóòèçàöèè ÿäðà, èñïîëüçóéòå ôëàã -r (êîòîðûé ýêâèâàëåíòåí ïðèâåäåííîé âûøå êîìàíäå route).

$ netstat -r

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
default         gateway         0.0.0.0         UG        0 0          0 enp0s3
192.168.0.0     0.0.0.0         255.255.255.0   U         0 0          0 enp0s3
192.168.122.0   0.0.0.0         255.255.255.0   U         0 0          0 virbr0

Âíèìàíèå: êîìàíäà Netstat ÿâëÿåòñÿ óñòàðåâøåé (deprecated) è áûëà çàìåíåíà êîìàíäîé ss, êîòîðóþ ðàññìîòðèì íèæå.

11. Êîìàíäà ss

ss (socket statistics - ñòàòèñòèêà ñîêåòîâ) - ìîùíàÿ óòèëèòà êîìàíäíîé ñòðîêè äëÿ èçó÷åíèÿ ñîêåòîâ. Îí âûâîäèò ñòàòèñòèêó ñîêåòîâ è îòîáðàæàåò èíôîðìàöèþ, àíàëîãè÷íóþ netstat. Êðîìå òîãî, ss ïîêàçûâàåò áîëüøå èíôîðìàöèè î TCP è ñîñòîÿíèè ïî ñðàâíåíèþ ñ äðóãèìè ïîäîáíûìè óòèëèòàìè.

 ñëåäóþùåì ïðèìåðå ïîêàçàíî, êàê ñîñòàâèòü ñïèñîê âñåõ TCP-ïîðòîâ (ñîêåòîâ), îòêðûòûõ íà ñåðâåðå.

$ ss -ta

State      Recv-Q Send-Q                                        Local Address:Port                                                         Peer Address:Port                
LISTEN     0      100                                                       *:submission                                                              *:*                    
LISTEN     0      128                                               127.0.0.1:fmpro-internal                                                          *:*                    
LISTEN     0      100                                                       *:pop3                                                                    *:*                    
LISTEN     0      100                                                       *:imap                                                                    *:*                    
LISTEN     0      128                                                       *:sunrpc                                                                  *:*                    
LISTEN     0      100                                                       *:urd                                                                     *:*                    
LISTEN     0      128                                                       *:domain                                                                  *:*                    
LISTEN     0      9                                                         *:ftp                                                                     *:*                    
LISTEN     0      128                                                       *:ssh                                                                     *:*                    
LISTEN     0      128                                               127.0.0.1:ipp                                                                     *:*                    
LISTEN     0      100                                                       *:smtp                                                                    *:*                    
LISTEN     0      128                                                       *:8090                                                                    *:*                    
LISTEN     0      100                                                       *:imaps                                                                   *:*                    
LISTEN     0      100                                                       *:pop3s                                                                   *:*                    
ESTAB      0      0                                             192.168.0.104:ssh                                                         192.168.0.103:36398                
ESTAB      0      0                                                 127.0.0.1:34642                                                           127.0.0.1:opsession-prxy       
ESTAB      0      0                                                 127.0.0.1:34638                                                           127.0.0.1:opsession-prxy       
ESTAB      0      0                                                 127.0.0.1:34644                                                           127.0.0.1:opsession-prxy       
ESTAB      0      0                                                 127.0.0.1:34640                                                           127.0.0.1:opsession-prxy       
LISTEN     0      80                                                       :::mysql                                                                  :::*             
...

×òîáû îòîáðàçèòü âñå àêòèâíûå TCP-ñîåäèíåíèÿ âìåñòå ñ èõ òàéìåðàìè, âûïîëíèòå ñëåäóþùóþ êîìàíäó.

$ ss -to

12. Êîìàíäà NC

NC (NetCat), òàêæå íàçûâàåìàÿ «Ñåòåâûì øâåéöàðñêèì àðìåéñêèì íîæîì», ÿâëÿåòñÿ ìîùíîé óòèëèòîé, èñïîëüçóåìîé ïî÷òè äëÿ ëþáîé çàäà÷è, ñâÿçàííîé ñ ñîêåòàìè äîìåíà TCP, UDP èëè UNIX. NC èñïîëüçóåòñÿ äëÿ îòêðûòèÿ TCP-ñîåäèíåíèé, ïðîñëóøèâàíèÿ ïðîèçâîëüíûõ ïîðòîâ TCP è UDP, âûïîëíåíèÿ ñêàíèðîâàíèÿ ïîðòîâ è ìíîãîãî äðóãîãî.

Âû òàêæå ìîæåòå èñïîëüçîâàòü åãî â êà÷åñòâå ïðîñòûõ ïðîêñè-ñåðâåðîâ TCP äëÿ òåñòèðîâàíèÿ ñåòåâûõ äåìîíîâ, ïðîâåðêè äîñòóïíîñòè óäàëåííûõ ïîðòîâ è ìíîãîãî äðóãîãî. Êðîìå òîãî, âû ìîæåòå èñïîëüçîâàòü nc âìåñòå ñ êîìàíäîé pv äëÿ ïåðåäà÷è ôàéëîâ ìåæäó äâóìÿ êîìïüþòåðàìè.

 ñëåäóþùåì ïðèìåðå áóäåò ïîêàçàíî, êàê ñêàíèðîâàòü ñïèñîê ïîðòîâ.

$ nc -zv server2.merionet.lan 21 22 80 443 3000

Âû òàêæå ìîæåòå óêàçàòü äèàïàçîí ïîðòîâ.

$ nc -zv server2.merionet.lan 20-90

 ñëåäóþùåì ïðèìåðå ïîêàçàíî, êàê èñïîëüçîâàòü nc äëÿ îòêðûòèÿ TCP-ñîåäèíåíèÿ ñ ïîðòîì 5000 íà server2.merionet.lan, èñïîëüçóÿ ïîðò 3000 â êà÷åñòâå ïîðòà èñòî÷íèêà ñ òàéì-àóòîì 10 ñåêóíä.

$ nc -p 3000 -w 10 server2.merionet.lan 5000

13.Êîìàíäà Nmap

Nmap (Network Mapper) - ýòî ìîùíûé è ÷ðåçâû÷àéíî óíèâåðñàëüíûé èíñòðóìåíò äëÿ ñèñòåìíûõ è ñåòåâûõ àäìèíèñòðàòîðîâ Linux. Îí èñïîëüçóåòñÿ äëÿ ñáîðà èíôîðìàöèè îá îäíîì õîñòå èëè äëÿ èçó÷åíèÿ ñåòåé ïî âñåé ñåòè. Nmap òàêæå èñïîëüçóåòñÿ äëÿ ñêàíèðîâàíèÿ áåçîïàñíîñòè, àóäèòà ñåòè, ïîèñêà îòêðûòûõ ïîðòîâ íà óäàëåííûõ õîñòàõ è ìíîãîãî äðóãîãî.

Íàïðèìåð, âû ìîæåòå ñêàíèðîâàòü õîñò, èñïîëüçóÿ åãî èìÿ èëè IP-àäðåñ.

$ nmap google.com 

Starting Nmap 6.40 ( http://nmap.org ) at 2018-07-12 09:23 BST
Nmap scan report for google.com (172.217.166.78)
Host is up (0.0036s latency).
rDNS record for 172.217.166.78: bom05s15-in-f14.1e100.net
Not shown: 998 filtered ports
PORT    STATE SERVICE
80/tcp  open  http
443/tcp open  https

Nmap done: 1 IP address (1 host up) scanned in 4.92 seconds

 êà÷åñòâå àëüòåðíàòèâû ìîæíî èñïîëüçîâàòü IP-àäðåñ.

$ nmap 192.168.0.103

Starting Nmap 6.40 ( http://nmap.org ) at 2018-07-12 09:24 BST
Nmap scan report for 192.168.0.103
Host is up (0.000051s latency).
Not shown: 994 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
25/tcp   open  smtp
902/tcp  open  iss-realsecure
4242/tcp open  vrml-multi-use
5900/tcp open  vnc
8080/tcp open  http-proxy
MAC Address: 28:D2:44:EB:BD:98 (Lcfc(hefei) Electronics Technology Co.)

Nmap done: 1 IP address (1 host up) scanned in 0.13 seconds

---

Óòèëèòû DNS Lookup

14. Êîìàíäà host

Êîìàíäà hos - ýòî ïðîñòàÿ óòèëèòà äëÿ DNS Lookup, îíà ïåðåâîäèò èìåíà õîñòîâ â IP-àäðåñà è íàîáîðîò.

$ host google.com

google.com has address 172.217.166.78
google.com mail is handled by 20 alt1.aspmx.l.google.com.
google.com mail is handled by 30 alt2.aspmx.l.google.com.
google.com mail is handled by 40 alt3.aspmx.l.google.com.
google.com mail is handled by 50 alt4.aspmx.l.google.com.
google.com mail is handled by 10 aspmx.l.google.com.

15. Êîìàíäà dig

dig (domain information groper - ñáîðùèê èíôîðìàöèè î äîìåíå) - ýòî åùå îäíà ïðîñòàÿ óòèëèòà DNS Lookup, êîòîðàÿ èñïîëüçóåòñÿ äëÿ çàïðîñà èíôîðìàöèè, ñâÿçàííîé ñ DNS, òàêîé êàê A Record, CNAME, MX Record è ò. ä., íàïðèìåð:

$ dig google.com

; <<>> DiG 9.9.4-RedHat-9.9.4-51.el7 <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23083
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 14

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;google.com.			IN	A

;; ANSWER SECTION:
google.com.		72	IN	A	172.217.166.78

;; AUTHORITY SECTION:
com.			13482	IN	NS	c.gtld-servers.net.
com.			13482	IN	NS	d.gtld-servers.net.
com.			13482	IN	NS	e.gtld-servers.net.
com.			13482	IN	NS	f.gtld-servers.net.
com.			13482	IN	NS	g.gtld-servers.net.
com.			13482	IN	NS	h.gtld-servers.net.
com.			13482	IN	NS	i.gtld-servers.net.
com.			13482	IN	NS	j.gtld-servers.net.
com.			13482	IN	NS	k.gtld-servers.net.
com.			13482	IN	NS	l.gtld-servers.net.
com.			13482	IN	NS	m.gtld-servers.net.
com.			13482	IN	NS	a.gtld-servers.net.
com.			13482	IN	NS	b.gtld-servers.net.

;; ADDITIONAL SECTION:
a.gtld-servers.net.	81883	IN	A	192.5.6.30
b.gtld-servers.net.	3999	IN	A	192.33.14.30
c.gtld-servers.net.	14876	IN	A	192.26.92.30
d.gtld-servers.net.	85172	IN	A	192.31.80.30
e.gtld-servers.net.	95861	IN	A	192.12.94.30
f.gtld-servers.net.	78471	IN	A	192.35.51.30
g.gtld-servers.net.	5217	IN	A	192.42.93.30
h.gtld-servers.net.	111531	IN	A	192.54.112.30
i.gtld-servers.net.	93017	IN	A	192.43.172.30
j.gtld-servers.net.	93542	IN	A	192.48.79.30
k.gtld-servers.net.	107218	IN	A	192.52.178.30
l.gtld-servers.net.	6280	IN	A	192.41.162.30
m.gtld-servers.net.	2689	IN	A	192.55.83.30

;; Query time: 4 msec
;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Thu Jul 12 09:30:57 BST 2018
;; MSG SIZE  rcvd: 487

16.Êîìàíäà NSLookup

Nslookup òàêæå ÿâëÿåòñÿ ïîïóëÿðíîé óòèëèòîé êîìàíäíîé ñòðîêè äëÿ çàïðîñîâ DNS-ñåðâåðîâ êàê â èíòåðàêòèâíîì, òàê è íå èíòåðàêòèâíîì ðåæèìå. Nslookup èñïîëüçóåòñÿ äëÿ çàïðîñà çàïèñåé ðåñóðñîâ DNS (RR - resource records). Âû ìîæåòå íàéòè «A» çàïèñü (IP-àäðåñ) äîìåíà, êàê ïîêàçàíî íèæå:

$ nslookup google.com

Server:		192.168.0.1
Address:	192.168.0.1#53

Non-authoritative answer:
Name:	google.com
Address: 172.217.166.78

Âû òàêæå ìîæåòå âûïîëíèòü îáðàòíûé ïîèñê äîìåíà.

$ nslookup 216.58.208.174

Server:		192.168.0.1
Address:	192.168.0.1#53

Non-authoritative answer:
174.208.58.216.in-addr.arpa	name = lhr25s09-in-f14.1e100.net.
174.208.58.216.in-addr.arpa	name = lhr25s09-in-f174.1e100.net.

Authoritative answers can be found from:
in-addr.arpa	nameserver = e.in-addr-servers.arpa.
in-addr.arpa	nameserver = f.in-addr-servers.arpa.
in-addr.arpa	nameserver = a.in-addr-servers.arpa.
in-addr.arpa	nameserver = b.in-addr-servers.arpa.
in-addr.arpa	nameserver = c.in-addr-servers.arpa.
in-addr.arpa	nameserver = d.in-addr-servers.arpa.
a.in-addr-servers.arpa	internet address = 199.180.182.53
b.in-addr-servers.arpa	internet address = 199.253.183.183
c.in-addr-servers.arpa	internet address = 196.216.169.10
d.in-addr-servers.arpa	internet address = 200.10.60.53
e.in-addr-servers.arpa	internet address = 203.119.86.101
f.in-addr-servers.arpa	internet address = 193.0.9.1

---

Àíàëèçàòîðû ñåòåâûõ ïàêåòîâ Linux

17.Êîìàíäà Tcpdump

Tcpdump - î÷åíü ìîùíûé è øèðîêî èñïîëüçóåìûé ñåòåâîé àíàëèçàòîð êîìàíäíîé ñòðîêè. Îí èñïîëüçóåòñÿ äëÿ çàõâàòà è àíàëèçà ïàêåòîâ TCP/IP, ïåðåäàííûõ èëè ïîëó÷åííûõ ïî ñåòè ÷åðåç îïðåäåëåííûé èíòåðôåéñ.

×òîáû çàõâàòûâàòü ïàêåòû ñ çàäàííîãî èíòåðôåéñà, óêàæèòå åãî ñ ïîìîùüþ îïöèè -i.

$ tcpdump -i eth1

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes
09:35:40.287439 IP merionet.com.ssh > 192.168.0.103.36398: Flags [P.], seq 4152360356:4152360552, ack 306922699, win 270, options [nop,nop,TS val 2211778668 ecr 2019055], length 196
09:35:40.287655 IP 192.168.0.103.36398 > merionet.com.ssh: Flags [.], ack 196, win 5202, options [nop,nop,TS val 2019058 ecr 2211778668], length 0
09:35:40.288269 IP merionet.com.54899 > gateway.domain: 43760+ PTR? 103.0.168.192.in-addr.arpa. (44)
09:35:40.333763 IP gateway.domain > merionet.com.54899: 43760 NXDomain* 0/1/0 (94)
09:35:40.335311 IP merionet.com.52036 > gateway.domain: 44289+ PTR? 1.0.168.192.in-addr.arpa. (42)

×òîáû çàõâàòèòü îïðåäåëåííîå êîëè÷åñòâî ïàêåòîâ, èñïîëüçóéòå ïàðàìåòð -c, ÷òîáû ââåñòè æåëàåìîå ÷èñëî.

$ tcpdump -c 5 -i eth1

Âû òàêæå ìîæåòå çàõâàòûâàòü è ñîõðàíÿòü ïàêåòû â ôàéë äëÿ ïîñëåäóþùåãî àíàëèçà, èñïîëüçóéòå ôëàã -w, ÷òîáû óêàçàòü âûõîäíîé ôàéë.

$ tcpdump -w captured.pacs -i eth1

18. Óòèëèòà Wireshark

Wireshark - ýòî ïîïóëÿðíûé, ìîùíûé, óíèâåðñàëüíûé è ïðîñòîé â èñïîëüçîâàíèè èíñòðóìåíò äëÿ çàõâàòà è àíàëèçà ïàêåòîâ â ñåòè ñ êîììóòàöèåé ïàêåòîâ â ðåæèìå ðåàëüíîãî âðåìåíè.

Âû òàêæå ìîæåòå ñîõðàíèòü ïîëó÷åííûå äàííûå â ôàéë äëÿ ïîñëåäóþùåé ïðîâåðêè. Îí èñïîëüçóåòñÿ ñèñòåìíûìè àäìèíèñòðàòîðàìè è ñåòåâûìè èíæåíåðàìè äëÿ ìîíèòîðèíãà è ïðîâåðêè ïàêåòîâ â öåëÿõ áåçîïàñíîñòè è óñòðàíåíèÿ íåïîëàäîê.

19.Óòèëèòà Bmon

bmon - ìîùíàÿ óòèëèòà äëÿ ìîíèòîðèíãà è îòëàäêè ñåòè, îñíîâàííàÿ íà êîìàíäíîé ñòðîêå, äëÿ Unix-ïîäîáíûõ ñèñòåì, îíà ñîáèðàåò ñòàòèñòèêó, ñâÿçàííóþ ñ ñåòüþ, è ïå÷àòàåò åå âèçóàëüíî â óäîáíîì äëÿ ÷åëîâåêà ôîðìàòå. Ýòî íàäåæíûé è ýôôåêòèâíûé ìîíèòîð ïîëîñû ïðîïóñêàíèÿ â ðåàëüíîì âðåìåíè è îöåíùèê ñêîðîñòè.

---

Èíñòðóìåíòû óïðàâëåíèÿ ôàåðâîëîì Linux

20. Iptables

iptables - ýòî èíñòðóìåíò êîìàíäíîé ñòðîêè äëÿ íàñòðîéêè, ïîääåðæêè è ïðîâåðêè òàáëèö ôèëüòðàöèè IP-ïàêåòîâ è íàáîðà ïðàâèë NAT. Îí èñïîëüçóåòñÿ äëÿ íàñòðîéêè è óïðàâëåíèÿ áðàíäìàóýðîì Linux (Netfilter). Ýòî ïîçâîëÿåò âàì ïåðå÷èñëèòü ñóùåñòâóþùèå ïðàâèëà ôèëüòðàöèè ïàêåòîâ; äîáàâëÿòü èëè óäàëÿòü èëè èçìåíÿòü ïðàâèëà ôèëüòðàöèè ïàêåòîâ; ñïèñîê ñ÷åò÷èêîâ äëÿ ïðàâèë ïðàâèë ôèëüòðàöèè ïàêåòîâ.

Âû ìîæåòå óçíàòü, êàê èñïîëüçîâàòü Iptables äëÿ ðàçëè÷íûõ öåëåé èç íàøåé ñòàòüè

21. Firewalld

Firewalld - ýòî ìîùíûé è äèíàìè÷íûé äåìîí óïðàâëåíèÿ áðàíäìàóýðîì Linux (Netfilter), êàê è iptables. Îí èñïîëüçóåò «ñåòåâûå çîíû» âìåñòî INPUT, OUTPUT è FORWARD CHAINS â iptables.  ñîâðåìåííûõ äèñòðèáóòèâàõ Linux, òàêèõ êàê RHEL, CentOS 7 è Fedora 21+, iptables àêòèâíî çàìåíÿåòñÿ firewalld.

Âàæíî: Iptables ïî-ïðåæíåìó ïîääåðæèâàåòñÿ è ìîæåò áûòü óñòàíîâëåí ñ ïîìîùüþ ìåíåäæåðà ïàêåòîâ YUM. Îäíàêî âû íå ìîæåòå èñïîëüçîâàòü Firewalld è iptables îäíîâðåìåííî íà îäíîì ñåðâåðå - âû äîëæíû âûáðàòü îäèí.

22. UFW (Uncomplicated Firewall)

UFW - ýòî øèðîêî èçâåñòíûé è èñïîëüçóåìûé ïî óìîë÷àíèþ èíñòðóìåíò íàñòðîéêè áðàíäìàóýðà â äèñòðèáóòèâàõ Debian è Ubuntu Linux. Îí èñïîëüçóåòñÿ äëÿ âêëþ÷åíèÿ è îòêëþ÷åíèÿ ñèñòåìíîãî áðàíäìàóýðà, äîáàâëåíèÿ, óäàëåíèÿ, èçìåíåíèÿ, ñáðîñà ïðàâèë ôèëüòðàöèè ïàêåòîâ è ìíîãîãî äðóãîãî.

×òîáû ïðîâåðèòü ñîñòîÿíèå áðàíäìàóýðà UFW, ââåäèòå:

$ sudo ufw status

Åñëè áðàíäìàóýð UFW íå àêòèâåí, âû ìîæåòå àêòèâèðîâàòü èëè âêëþ÷èòü åãî ñ ïîìîùüþ ñëåäóþùåé êîìàíäû.

$ sudo ufw enable

×òîáû îòêëþ÷èòü áðàíäìàóýð UFW, èñïîëüçóéòå ñëåäóþùóþ êîìàíäó.

$ sudo ufw disable

---

Íà ýòîì ïîêà âñå!  ýòîì ðóêîâîäñòâå ìû ðàññìîòðåëè íåêîòîðûå èç íàèáîëåå ÷àñòî èñïîëüçóåìûõ èíñòðóìåíòîâ è óòèëèò êîìàíäíîé ñòðîêè äëÿ óïðàâëåíèÿ ñåòüþ â Linux, â ðàçíûõ êàòåãîðèÿõ, äëÿ ñèñòåìíûõ àäìèíèñòðàòîðîâ è ñåòåâûõ àäìèíèñòðàòîðîâ è èíæåíåðîâ.

Âû ìîæåòå ïîäåëèòüñÿ ñâîèìè ìûñëÿìè îá ýòîì ðóêîâîäñòâå ñ ïîìîùüþ êîììåíòàðèåâ. Åñëè ìû ïðîïóñòèëè êàêèå-ëèáî ÷àñòî èñïîëüçóåìûå è âàæíûå ñåòåâûå èíñòðóìåíòû è óòèëèòû Linux èëè ëþáóþ ïîëåçíóþ ñâÿçàííóþ èíôîðìàöèþ, òàêæå ñîîáùèòå íàì îá ýòîì.