linux网络故障拍错,Linux环境下排除网络故障常用命令

1. 网络模型回顾

先来回顾一下OSI和TCP/IP网络模型，TCP/IP网络模型更符合现实中的网络。TCP/IP网络模型依次为：

第五层：应用层(Application)

第四层：传输层(Transport)

第三层：网络层(Network/Internet)

第二层：数据链路层(Data Link)

第一层：物理层(Physical)

下面我们依次来看看在各层，有什么方法可以检测网络故障。

TCPIP_OSI_0.png

2. 物理层

2.1 查看网卡状态

# ip link show

1: lo: mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

2: enp0s3: mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000

link/ether 08:00:27:0c:b9:17 brd ff:ff:ff:ff:ff:ff

2.2 简化输出信息

# ip -br link show

lo UNKNOWN 00:00:00:00:00:00

enp0s3 UP 08:00:27:0c:b9:17

2.3 启用/禁用网卡

# ip link set enp0s3 up/down

2.4 打印网卡的统计信息，查看是否有丢包情况

# ip -s link show enp0s3

2: enp0s3: mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000

link/ether 08:00:27:0c:b9:17 brd ff:ff:ff:ff:ff:ff

RX: bytes packets errors dropped overrun mcast

13546687 9535 0 0 0 22

TX: bytes packets errors dropped carrier collsns

625270 7339 0 0 0 0

2.5 检测网卡速率是否正确配置

# ethtool enp0s3

Settings for enp0s3:

Supported ports: [ TP ]

Supported link modes: 10baseT/Half 10baseT/Full

100baseT/Half 100baseT/Full

1000baseT/Full

Supported pause frame use: No

Supports auto-negotiation: Yes

Supported FEC modes: Not reported

Advertised link modes: 10baseT/Half 10baseT/Full

100baseT/Half 100baseT/Full

1000baseT/Full

Advertised pause frame use: No

Advertised auto-negotiation: Yes

Advertised FEC modes: Not reported

Speed: 1000Mb/s

Duplex: Full

Port: Twisted Pair

PHYAD: 0

Transceiver: internal

Auto-negotiation: on

MDI-X: off (auto)

Cannot get wake-on-lan settings: Operation not permitted

Current message level: 0x00000007 (7)

drv probe link

Link detected: yes

3. 数据链路层

ARP(Address Resolution Protocol)在数据链路层工作，用于三层IP地址到二层MAC地址的映射。

3.1 查看本地ARP表

# ip neighbor show

192.168.1.109 dev enp0s3 lladdr 20:54:fa:c4:66:2b STALE

192.168.1.1 dev enp0s3 lladdr d4:ee:07:45:a7:1a STALE

192.168.1.232 dev enp0s3 lladdr 9c:5c:8e:78:85:76 REACHABLE

3.2 修改本地ARP表

ARP表会在本地缓存一段时间，缓存到期，ARP会重新发现建立新的ARP表。

在一些极端情况，比如Keepalived的虚拟IP地址漂移，需要让缓存立即失效，重新建立虚拟IP到新MAC地址的映射。这时可以删除ARP表中的映射项，ARP会立即开始重建。

# ip neighbor delete 192.168.1.1 dev enp0s3

4. 网络层

IP协议和ICMP协议(Internet Control Message Protocol)工作在这一层。

4.1 查看IP地址

# ip -br address show

lo UNKNOWN 127.0.0.1/8 ::1/128

enp0s3 UP 192.168.1.175/24 fe80::a00:27ff:fe0c:b917/64

4.2 检测网络联通

# ping -c 3 www.baidu.com

PING www.a.shifen.com (180.101.49.12) 56(84) bytes of data.

64 bytes from 180.101.49.12 (180.101.49.12): icmp_seq=1 ttl=48 time=8.02 ms

64 bytes from 180.101.49.12 (180.101.49.12): icmp_seq=2 ttl=48 time=8.08 ms

64 bytes from 180.101.49.12 (180.101.49.12): icmp_seq=3 ttl=48 time=8.06 ms

--- www.a.shifen.com ping statistics ---

3 packets transmitted, 3 received, 0% packet loss, time 2003ms

rtt min/avg/max/mdev = 8.024/8.056/8.082/0.077 ms

4.3 利用TTL查询网络路径

# windows 用 tracert

# tracert www.baidu.com

通过最多 30 个跃点跟踪

到 www.a.shifen.com [112.80.248.75] 的路由:

1 <1 毫秒 <1 毫秒 <1 毫秒 Hiwifi.lan [192.168.1.1]

2 2 ms 1 ms 1 ms 100.64.224.1

3 2 ms 1 ms 2 ms 139.226.230.113

4 2 ms 2 ms 2 ms 139.226.210.97

5 18 ms 4 ms 4 ms 219.158.11.2

6 11 ms 11 ms 11 ms 221.6.1.250

7 7 ms 9 ms 7 ms 112.86.192.154

8 * * * 请求超时。

9 9 ms 8 ms 8 ms 112.80.248.75

跟踪完成。

# linux 最好加上 -I

# traceroute -I www.baidu.com

traceroute to www.baidu.com (180.101.49.12), 30 hops max, 60 byte packets

1 * * *

2 * * *

3 * * *

4 * * *

5 * * *

6 * * *

7 * * *

8 * * *

9 * * *

10 * * *

11 * * *

12 * * *

13 * * *

14 * * *

15 * * *

16 * * *

17 180.101.49.12 (180.101.49.12) 8.110 ms 8.157 ms 8.158 ms

4.4 查看IP路由表

# ip route show

default via 192.168.1.1 dev enp0s3 proto static

192.168.1.0/24 dev enp0s3 proto kernel scope link src 192.168.1.175

4.5 检测DNS

# nslook www.google.com

Server: 127.0.0.53

Address: 127.0.0.53#53

Non-authoritative answer:

Name: www.google.com

Address: 31.13.83.16

5. 传输层

TCP协议和UDP协议工作在这一层。

5.1 查看本地连接

# ss -tunlp4

Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port

udp UNCONN 0 0 127.0.0.53%lo:53 0.0.0.0:*

tcp LISTEN 0 128 127.0.0.53%lo:53 0.0.0.0:*

tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:*

tcp LISTEN 0 128 127.0.0.1:6010 0.0.0.0:*

ss命令可以传递的参数：

-t - 显示TCP端口

-u - 显示UDP端口

-n - 不解析主机名

-l - 显示监听端口

-p - 显示进程

-4 - 仅显示IPv4的socket连接

5.2 测试TCP连接

# telnet 192.168.1.100 3306

5.3 测试UDP连接

# nc 192.168.122.1 -u 80