N天学习一个linux命令之ip

用途

show / manipulate routing, devices, policy routing and tunnels

用法

通用格式

ip [ OPTIONS ] OBJECT { COMMAND | help }

OBJECT := { link | addr | addrlabel | route | rule | neigh | tunnel | maddr | mroute | monitor }

OPTIONS := { -V[ersion] | -s[tatistics] | -r[esolve] | -f[amily] { inet | inet6 | ipx | dnet | link } | -o[neline] }

link格式(网卡)

ip link set DEVICE { up | down | arp { on | off } |
                    promisc { on | off } |
                    allmulticast { on | off } |
                    dynamic { on | off } |
                    multicast { on | off } |
                    txqueuelen PACKETS |
                    name NEWNAME |
                    address LLADDR | broadcast LLADDR |
                    mtu MTU |
                    netns PID |
                    alias NAME |
                    vf NUM [ mac LLADDR ] [ vlan VLANID [ qos VLAN-QOS ] ] [ rate TXRATE ] [ spoofchk { on | off } ] |
                }
ip link show [ DEVICE ]

addr格式(IP地址)

ip addr { add | del } IFADDR dev STRING

ip addr { show | flush } [ dev STRING ] [ scope SCOPE-ID ] [ to PREFIX ] [ FLAG-LIST ] [ label PATTERN ]

IFADDR := PREFIX | ADDR peer PREFIX [ broadcast ADDR ] [ anycast ADDR ] [ label STRING ] [ scope SCOPE-ID ]

SCOPE-ID := [ host | link | global | NUMBER ]

FLAG-LIST := [ FLAG-LIST ] FLAG

FLAG := [ permanent | dynamic | secondary | primary | tentative | deprecated ]

addrlabel格式

ip addrlabel { add | del } prefix PREFIX [ dev DEV ] [ label NUMBER ]

ip addrlabel { list | flush }

route格式

ip route { list | flush } SELECTOR

ip route get ADDRESS [ from ADDRESS iif STRING  ] [ oif STRING ] [ tos TOS ]

ip route { add | del | change | append | replace | monitor } ROUTE

SELECTOR := [ root PREFIX ] [ match PREFIX ] [ exact PREFIX ] [ table TABLE_ID ] [ proto RTPROTO ] [ type TYPE ] [ scope SCOPE ]

ROUTE := NODE_SPEC [ INFO_SPEC ]

NODE_SPEC := [ TYPE ] PREFIX [ tos TOS ] [ table TABLE_ID ] [ proto RTPROTO ] [ scope SCOPE ] [ metric METRIC ]

INFO_SPEC := NH OPTIONS FLAGS [ nexthop NH ] ...

NH := [ via ADDRESS ] [ dev STRING ] [ weight NUMBER ] NHFLAGS

OPTIONS := FLAGS [ mtu NUMBER ] [ advmss NUMBER ] [ rtt TIME ] [ rttvar TIME ] [ window NUMBER ] [ cwnd NUMBER ] [ initcwnd NUMBER ] [ ssthresh REALM ] [ realms REALM ] [ rto_min TIME ] [ initrwnd NUMBER ]

TYPE := [ unicast | local | broadcast | multicast | throw | unreachable | prohibit | blackhole | nat ]

TABLE_ID := [ local| main | default | all | NUMBER ]

SCOPE := [ host | link | global | NUMBER ]

FLAGS := [ equalize ]

NHFLAGS := [ onlink | pervasive ]

RTPROTO := [ kernel | boot | static | NUMBER ]

rule格式

ip rule  [ list | add | del | flush ] SELECTOR ACTION

SELECTOR := [ from PREFIX ] [ to PREFIX ] [ tos TOS ] [ fwmark FWMARK[/MASK] ] [ dev STRING ] [ pref NUMBER ]

ACTION := [ table TABLE_ID ] [ nat ADDRESS ] [ realms [SRCREALM/]DSTREALM ]

TABLE_ID := [ local | main | default | NUMBER ]

neigh格式

ip neigh { add | del | change | replace } { ADDR [ lladdr LLADDR ] [ nud { permanent | noarp | stale | reachable} ] | proxy ADDR } [ dev DEV ]

ip neigh { show | flush } [ to PREFIX ] [ dev DEV ] [ nud STATE ]

tunnel格式

ip tunnel { add | change | del | show | prl } [ NAME ]
               [ mode MODE ] [ remote ADDR ] [ local ADDR ]
               [ [i|o]seq ] [ [i|o]key KEY ] [ [i|o]csum ] ]
               [ encaplimit ELIM ] [ ttl TTL ]
               [ tos TOS ] [ flowlabel FLOWLABEL ]
               [ prl-default ADDR ] [ prl-nodefault ADDR ] [ prl-delete ADDR ]
               [ [no]pmtudisc ] [ dev PHYS_DEV ] [ dscp inherit ]

MODE :=  { ipip | gre | sit | isatap | ip6ip6 | ipip6 | any }

ADDR := { IP_ADDRESS | any }

TOS := { NUMBER | inherit }

ELIM := { none | 0..255 }

TTL := { 1..255 | inherit }

KEY := { DOTTED_QUAD | NUMBER }

TIME := NUMBER[s|ms]

maddr格式

ip maddr [ add | del ] MULTIADDR dev NAME

ip maddr show [ dev NAME ]

mroute格式

ip mroute show [ PREFIX ] [ from PREFIX ] [ iif DEVICE ]

monitor格式

ip monitor [ all | OBJECT-LIST ]

xfrm格式

ip xfrm XFRM_OBJECT { COMMAND }

XFRM_OBJECT := { state | policy | monitor }

ip xfrm state { add | update } ID [ XFRM_OPT ]  [ mode MODE ]
                [ reqid REQID ]  [ seq SEQ ]  [ replay-window SIZE ]
                [ flag FLAG-LIST ]  [ encap ENCAP ]  [ sel SELECTOR ]
                [ LIMIT-LIST ]

ip xfrm state allocspi ID  [ mode MODE ]  [ reqid REQID ]  [ seq SEQ ]  [ min SPI max SPI ]

ip xfrm state { delete | get } ID

ip xfrm state { deleteall | list } [ ID ]  [ mode MODE ]
                [ reqid REQID ]  [ flag FLAG_LIST ]

ip xfrm state flush [ proto XFRM_PROTO ]

ip xfrm state count

ID :=  [ src ADDR ]  [ dst ADDR ]  [ proto XFRM_PROTO ]  [ spi SPI ]

XFRM_PROTO :=  [ esp | ah | comp | route2 | hao ]

MODE :=  [ transport | tunnel | ro | beet ] (default=transport)

FLAG-LIST :=  [ FLAG-LIST ] FLAG

FLAG :=  [ noecn | decap-dscp | wildrecv ]

ENCAP := ENCAP-TYPE SPORT DPORT OADDR

ENCAP-TYPE := espinudp  | espinudp-nonike

ALGO-LIST := [ ALGO-LIST ] | [ ALGO ]

ALGO := ALGO_TYPE ALGO_NAME ALGO_KEY

ALGO_TYPE :=  [ enc | auth | comp ]

SELECTOR := src ADDR[/PLEN] dst ADDR[/PLEN]  [ UPSPEC ]  [ dev DEV ]

UPSPEC := proto PROTO [[ sport PORT ]  [ dport PORT ] |
                [ type NUMBER ]  [ code NUMBER ]]

LIMIT-LIST := [ LIMIT-LIST ] |  [ limit LIMIT ]

LIMIT :=  [ [time-soft|time-hard|time-use-soft|time-use-hard] SECONDS ] | [ [byte-soft|byte-hard] SIZE ] | [ [packet-soft|packet-hard] COUNT ]

ip xfrm policy { add | update }  dir DIR SELECTOR [ index INDEX ]
                [ ptype PTYPE ]  [ action ACTION ]  [ priority PRIORITY ]
                [ LIMIT-LIST ] [ TMPL-LIST ]

ip xfrm policy { delete | get }  dir DIR [ SELECTOR | index INDEX  ]
                [ ptype PTYPE ]

ip xfrm policy { deleteall | list }  [ dir DIR ] [ SELECTOR ]
                [ index INDEX ]  [ action ACTION ]  [ priority PRIORITY ]

ip xfrm policy flush  [ ptype PTYPE ]

ip xfrm count

PTYPE :=  [ main | sub ] (default=main)

DIR :=  [ in | out | fwd ]

SELECTOR := src ADDR[/PLEN] dst ADDR[/PLEN] [ UPSPEC  ] [ dev DEV ]

UPSPEC := proto PROTO [  [ sport PORT ]  [ dport PORT ] |
                [ type NUMBER ]  [ code NUMBER ] ]

ACTION :=  [ allow | block ] (default=allow)

LIMIT-LIST :=  [ LIMIT-LIST ] |  [ limit LIMIT ]

LIMIT :=  [ [time-soft|time-hard|time-use-soft|time-use-hard] SECONDS ] |  [ [byte-soft|byte-hard] SIZE ] | [packet-soft|packet-hard] NUMBER ]

TMPL-LIST :=  [ TMPL-LIST ] |  [ tmpl TMPL ]

TMPL := ID [ mode MODE ]  [ reqid REQID ]  [ level LEVEL ]

ID :=  [ src ADDR ]  [ dst ADDR ]  [ proto XFRM_PROTO ]  [ spi SPI ]

XFRM_PROTO :=  [ esp | ah | comp | route2 | hao ]

MODE :=  [ transport | tunnel | beet ] (default=transport)

LEVEL :=  [ required | use ] (default=required)

ip xfrm monitor [ all | OBJECT-LIST ]

token格式

ip token { COMMAND | help }

ip token { set } TOKEN dev DEV

ip token { get } dev DEV

ip token { list }

常用选项

-V, -Version
打印程序版本

-s, -stats, -statistics
输出更多信息，出现多次，输出信息越多

-h, -human, -human-readable
以适合人类阅读的方式输出信息

-iec
和-h选项类似，基本单位是1024

-f, -family
指定使用的协议族，值列表：inet, inet6, ipx, dnet or link，如果没有指定会根据上下文猜测或者使用默认的协议族，一般是inet。link is a special family identifier meaning that no networking protocol is involved.
简写形式 -4 = -f inet, -6 = -f inet6, -0 = -f link

-o, -oneline
一行显示

-r, -resolve
use the system’s name resolver to print DNS names instead of host addresses.

操作对象说明

1 link
- network device.

2 address
- protocol (IP or IPv6) address on a device.

3 addrlabel
- label configuration for protocol address selection.

4 neighbour
- ARP or NDISC cache entry.

5 route
- routing table entry.

6 rule
- rule in routing policy database.

7 maddress
- multicast address.

8 mroute
- multicast routing cache entry.

9 tunnel
- tunnel over IP.

10 xfrm
- framework for IPsec protocol.

实践

操作物理网卡

1 显示网卡设备信息

[[email protected] asia_ucenter]# ip -s link show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    RX: bytes  packets  errors  dropped overrun mcast
    2188533266 2199032  0       0       0       0
    TX: bytes  packets  errors  dropped carrier collsns
    2188533266 2199032  0       0       0       0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 08:00:27:40:a8:72 brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast
    12012726   64662    0       0       0       0
    TX: bytes  packets  errors  dropped carrier collsns
    35491390   77118    0       0       0       0

2 关闭或者启用eth0网卡

# 关闭
[[email protected] apk]# ip link set dev eth0 down

#开启
[[email protected] apk]# ip link set dev eth0 up

3 启用或者关闭arp

# 关闭
[[email protected] apk]# ip link set dev eth0 arp off

#开启
[[email protected] apk]# ip link set dev eth0 arp on

4 启用或者关闭组播

# 关闭
[[email protected] apk]# ip link set dev eth0 multicast off

#开启
[[email protected] apk]# ip link set dev eth0 multicast on

5 启用或者关闭动态获取ip(不知道是不是这个意思？>_<)
dynamic on or dynamic off
( change the DYNAMIC flag on the device. )

6 修改网卡名字
name NAME
(网卡正在运行中或者其它配置有使用到老名字，不建议更改)

7 设置发送队列长度
方式一:txqueuelen NUMBER
方式二:txqlen NUMBER

8 设置网卡设备最大传输单元
mtu NUMBER

9 设置网卡物理地址
address LLADDRESS

10 设置广播地址相关（不知道是不是这个意思？>_<）
broadcast LLADDRESS

brd LLADDRESS

peer LLADDRESS
(change the link layer broadcast address or the peer address when the interface is POINTOPOINT.)

11 设置虚拟路由转发
netns PID
(move the device to the network namespace associated with the process PID.)

12 设置设备别名
alias NAME

ip地址操作

1 eth0设备增加本地ip:10.0.2.5，标签名为eth0:0，广播地址一样

[[email protected] apk]# ip addr add dev eth0:0 local 10.0.2.5/24 brd + label eth0:0

2 删除之前添加的ip，参数需要跟之前一样

[[email protected] apk]# ip addr delete dev eth0:0 local 10.0.2.5/24 brd - label eth0:0

3 显示ip地址信息

ip address show - look at protocol addresses
       dev NAME (default)
              name of device.

       scope SCOPE_VAL
              only list addresses with this scope.

       to PREFIX
              only list addresses matching this prefix.

       label PATTERN
              only list addresses with labels matching the PATTERN.  PATTERN is a usual shell style pattern.

       primary and secondary
              only list primary (or secondary) addresses.

4 删除ip地址，过滤条件跟显示一样，谨慎操作

ip addr flush arg1 arg2

邻居(neighbour)/arp表管理

1 添加一个邻居节点信息

[[email protected] apk]# ip neighbour add to 10.0.2.6 dev eth0 lladdr 22:33:aa:33:44:dd nud stale

# 邻居节点状态说明
permanent
    - the neighbour entry is valid forever and can be only be removed administratively.

noarp
    - the neighbour entry is valid. No attempts to validate this entry will be made but  it  can be removed when its lifetime expires.

reachable
    - the neighbour entry is valid until the reachability timeout expires.

stale
    - the neighbour entry is valid but suspicious.  This option to ip neigh does not change the neighbour state if it was valid and the address is not changed by this command.

2 邻居节点失效：ip为10.0.2.6，设备名为eth0的节点

[[email protected] apk]# ip neighbour delete to 10.0.2.6 dev eth0

3 显示邻居节点列表，过滤参数和添加一样

[[email protected] apk]# ip neighbour list
10.0.2.6 dev eth0  FAILED
10.0.2.1 dev eth0 lladdr 52:54:00:12:35:00 STALE
10.0.2.3 dev eth0 lladdr 08:00:27:4e:35:c1 STALE
10.0.2.2 dev eth0 lladdr 52:54:00:12:35:00 REACHABLE

4 删除邻居节点，过滤参数和add一样，没有过滤参数，不做处理
备注：a 失效状态不能删除 b 执行了这个操作后，还是能看到（不知道是什么原因？>_<）

[[email protected] apk]# ip -s neighbour flush to 10.0.2.6 dev eth0

*** Round 1, deleting 1 entries ***
*** Flush is complete after 1 round ***

5 更改已存在的邻居节点ip:10.0.2.6，物理网卡地址为：22:33:aa:33:44:dd，设备名为：eth0的状态为stale

[[email protected] apk]# ip -s neighbour change to 10.0.2.6 dev eth0 lladdr 22:33:aa:33:44:dd nud stale

路由表管理

1 说明
路由类型

unicast
    - the route entry describes real paths to the destinations covered by the route prefix.

unreachable
    -  these  destinations  are  unreachable.  Packets  are  discarded and the ICMP message host unreachable is generated.  The local senders get an EHOSTUNREACH error.

blackhole
    - these destinations are unreachable. Packets are discarded silently.  The local senders get an EINVAL error.

prohibit
    -  these destinations are unreachable. Packets are discarded and the ICMP message communication administratively prohibited is generated. The local senders get an EACCES error.

local
    - the destinations are assigned to this host. The packets are looped back and delivered locally.

broadcast
    - the destinations are broadcast addresses. The packets are sent as link broadcasts.

throw
    - a special control route used together with policy rules. If such a route is selected,  lookup  in this  table  is terminated pretending that no route was found. Without policy routing it is equivalent to the absence of the route in the routing table. The packets are dropped and the ICMP message net  unreachable is generated. The local senders get an ENETUNREACH error.

nat
    -  a  special NAT route. Destinations covered by the prefix are considered to be dummy (or external)addresses which require translation to real (or internal) ones before forwarding. The addresses to translate to are selected with the attribute via.  Warning: Route NAT is no longer supported in Linux 2.6.

anycast
    -  not implemented the destinations are anycast addresses assigned to this host. They are mainly equivalent to local with one difference: such addresses are invalid when used as the  source  address  of any packet.

multicast
    - a special type used for multicast routing. It is not present in normal routing tables.

2 其它，这里偷个懒，参数列表实在太多了，相关说明直接看命令帮助文档吧 :)

其它类管理

路由策略，xfrm网络安全框架，token，监控对象状态等等

参考资料

【0】man ip
【1】linux network namespace 学习
https://segmentfault.com/a/1190000004059167
【2】linux IP 命令使用举例（转）
http://www.cnblogs.com/bamboo-talking/archive/2013/01/10/2855306.html
【3】linux XFRM整体框架简单分析
https://blog.csdn.net/scottgly/article/details/6978229
【4】一个网卡绑定多个IP和多个网卡用一个ip的设置
http://www.cnblogs.com/dkblog/archive/2011/07/26/2117383.html
【5】邻居表(Neighbour Table)问题
https://wenku.baidu.com/view/39fc2d0c581b6bd97f19ea19.html
【6】一道路由器的路由表填写习题,答案看不懂
https://segmentfault.com/q/1010000002234926
【7】Windows路由表详解
https://www.cnblogs.com/croso/p/5309553.html

原文地址：https://www.cnblogs.com/wadeyu/p/8858101.html

时间： 2024-10-03 20:05:26

N天学习一个linux命令之ip的相关文章

N天学习一个Linux命令之帮助命令：man

前言工作中每天都在使用常用的命令和非常用的命令,忘记了用法或者参数,都会bing一下,然后如此循环.一直没有真正的系统的深入的去了解命令的用法,我决定打破它.以前看到有人,每天学习一个linux命令,我现在没有这么充足时间,我恐怕一周学习一个linux命令我都做不到,想想我还是N天学习一个linux命令吧,从现在开始算起. 用途显示命令帮助文档以及用法用法 man [options] [section] cmd 命令文档部分说明 The table below shows the sect

每天学习一个LINUX命令：ls 目录列表（list 清单目录名单）

ls命令用于显示文件目录列表.当不加参数时,默认列出当前目录的列表信息. 语法参数: ls [参数] [目录或文件名] 参数(注意区分大小写) -a:显示所有档案及目录(ls内定将档案名或目录名称为"."的视为影藏,不会列出):-A:显示除影藏文件"."和".."以外的所有文件列表:-C:多列显示输出结果.这是默认选项:-l :与"-C"选项功能相反,所有输出信息用单列格式输出,不输出为多列:-b:将文件中的不可输出的字符以反

N天学习一个linux命令之du

用途统计文件或者目录占用硬盘空间大小用法 du [OPTION] [FILE]du [OPTION] --files0-from=F 常用参数 -a, --all统计所有文件,不仅仅是目录 -b, --bytes 字节为单位统计 -c, --total输出总大小 -D, --dereference-args对命令行列出的链接文件,按照链接文件指向的真实文件大小统计,默认是链接文件的大小 --files0-from=F从指定的文件F中读取需要统计的文件列表,多个文件名使用空字符(\0)分隔(N

N天学习一个linux命令之ping

用途检测主机是否可到达,也就是说,目标主机是否可以联网,还可以用于检测网速.通过发送ICMP ECHO_REQUEST数据包检测. 用法 ping [options] destination 常用选项 -A 根据round-trip time自适应调整每次发包的间隔时间 -b 允许ping广播地址 -c count 设置发送包数量,默认会一直发 -d 设置socket SO_DEBUG选项 -f 极限检测,尽最大可能发送最多的包 -i interval 发送下一个包需要等待的时间(单位:秒),

N天学习一个Linux命令之free

用途查看系统内存(物理/虚拟/缓存/共享)使用情况用法 free [-b | -k | -m | -g | -h] [-o] [-s delay ] [-c count ] [-a] [-t] [-l] [-V] 常用选项选项含义说明 -b 单位byte switch displays the amount of memory in bytes; -k 单位k switch (set by default) displays it in kilobytes; -m 单位m switch

N天学习一个Linux命令之帮助命令：grep

前言任何系统都会出问题,出了问题一般怎么排查BUG?这个时候程序中记录的异常日志以及关键节点的日志就非常重要了,面对一大堆的日志文件,怎么找出我们需要的有用信息呢?linux中可以使用grep命令查找,这个命令的功能非常强大,也是我平时中排查线上错误时使用最多的命令之一. 命令名称grep 用途查找指定文件内包含指定关键字(正则表达式)的内容,按行为单位匹配使用格式grep [OPTIONS] PATTERN [FILE...] 常用选项-V (显示命令版本) 正则模式匹配版本-E, --ex

每天学习一个LINUX命令：cd 切换目录（change directory 更改目录）

cd命令用来切换工作目录至dirname. 其中dirName表示法可为绝对路径或相对路径.若目录名称省略,则变换至使用者的home directory(也就是刚login时所在的目录).另外,~也表示为home directory的意思,.则是表示目前所在的目录,..则表示目前目录位置的上一层目录. 语法参数: cd [dirName] 用法实例: cd 进入用户主目录:cd ~ 进入用户主目录:cd - 返回进入此目录之前所在的目录:cd .. 返回上级目录(若当前目录为"/",则

每天学习一个LINUX命令：mkdir 创建目录文件夹（make directory 做活动目录）

linux mkdir 命令用来创建指定的名称的目录,要求创建目录的用户在当前目录中具有写权限,并且指定的目录名不能是当前目录中已有的目录. 语法参数: mkdir [参数] [目录名] 参数: -m --mode=模式,设定权限<模式> (类似 chmod),而不是 rwxrwxrwx 减 umask-p --parents 递归创建目录-v, --verbose 每次创建新目录都显示信息用法实例: 创建一个空目录 mkdir abc1 创建多个空目录 mkdir 11 22 33 44

N天学习一个Linux命令之ln

前言有时候同一个文件想创建多个别名,这个时候可以使用链接文件代替用途对文件或者目录创建链接,默认创建的是硬链接硬链接Linux底层文件系统由超级数据块,目录树对象,inode索引节点对象,文件对象组成.硬链接指向同一个inode节点,可以理解为文件的别名,目录不能创建硬链接,不能跨文件系统创建硬链接. 软链接软链接就是一个普通的文件,有自己的inode索引节点,只不过存储的内容比较特殊,存储的内容是指向的真实文件内容的访问路径,目标源不存在时也可以创建软链接. 常用参数1.已存在链接备份-b