Linux Study Notes (System daily management-2), study notes-2

Linux Study Notes (System daily management-2), study notes-2

Linux packet capture tool

Tcpdump-nn-I nic name host ip port

-Wfilename: place the captured content in a file.

You can view the content in the file through strings.

-C number: Number of captured packets

-S0: All packages can be captured.

 

Tshark: You can also capture packets.

Wireshark can also install yum install-y wireshark in linux

Packet Capture analysis http request:

Tshark-n-t a-R http. request-T fields-e "frame. time "-e" ip. src "-e" http. host "-e" http. request. method "-e" http. request. uri"

-I: Specify the NIC

 

Selinux: Firewall tools

Getenforce: You can view the status.

Setenforce 0/1: 0 indicates disabled, 1 indicates Enabled

 

Netfilter: Firewall

 

Iptables: a firewall Tool

Iptables-nvL: view rules

If t is not added, the filter table is used by default.
Iptables-F:Clear the current rule (policy cannot be cleared) stop can be cleared
Iptables-Z: counters cleared

Iptalbes-A: add rules at the end

-S can specify the source ip address

-P indicates the protocol.

-- Dport Target Port

-- Sport Source Port

-D: Specify the target ip address.

-J indicates the action: ACCEPT (ACCEPT)/DROP (REJECT)/REJECT (select-based REJECT)

Iptables-I: Header insertion rule

Iptables-nvL-line-number: You can view the row number.

Then, you can use the iptable-d input/OUTPUT row number to delete the rule.

Iptables-P: Set the default rule (the default is ACCEPT)

Service iptables save: The Rule file saved by the rule is/etc/sysconfig/iptables.

Both of them can be used.
Service iptables stop can suspend the firewall, but after it is restarted, it will read/etc/sysconfig/iptables to start the firewall. In addition, even if we stop the firewall, once we add any rule, it is also enabled.
Iptables-t: Specifies the table name. If-t is not added by default, the table is a filter table.

Iptables-save> 1.ipt: save the rule
The filter table is mainly used to filter packets.Is a system preset table with three links in itINPUT, OUTPUT, and FORWARD. INPUT acts on the packets entering the local machine; OUTPUT acts on the packets sent from the local machine; FORWARD acts on those packets irrelevant to the local machine.

Nat is mainly used for network address translation and port ing.There are also three chains.PREROUTINGThe function of the chain is to change the destination address of the package when it reaches the firewall, if necessary.OUTPUTLink to change the destination address of the locally generated package.POSTROUTINGThe link changes its source address before the package leaves the firewall.

Mangle is mainly used to modify data packets.Type OfService, TTL (Time ToLive) value, and Mark for data packets to realize Qos (Quality of Service) adjustments, Policy Routing, and other applications require the support of corresponding routing devices, so they are not widely used. Five Links:PREROUTING, POSTROUTING, INPUT, OUTPUT, and FORWARD

Raw sets a flag for the packet to determine whether the packet is processed by the status tracking mechanism.There are only two links:OUTPUT, PREROUTING

 

Nat table application:
The router is implemented using the nat principle of iptables.
Assume that your machine has two NICs, eth0 and eth1. The IP address of eth0 is 192.168.10.11, And the IP address of eth1 is 172.16.10.11. Eth0 is connected to intnet, but eth1 is not connected. Now another machine (172.16.10.12) is interconnected with eth1. How can I set it to allow the machine connected to eth1 to connect to intnet?
Echo "1">/proc/sys/net/ipv4/ip_forward
Iptables-t nat-a postrouting-s 172.16.10.0/24-o eth0-j MASQUERADE

April 17, 2015

By: champly