LPI Linux Certification in a Nutshell Part 38

-F Display the kernel routing table (the default behavior without add add or or delete delete keywords). keywords).

-host Specify that target target is a single host. Mutually exclusive with is a single host. Mutually exclusive with -net -net.

-net Specify that target target is a network. Mutually exclusive with is a network. Mutually exclusive with -host -host.

gw gateway gateway IP packets for target target are routed through the gateway, which must be reachable. are routed through the gateway, which must be reachable.

netmask mask mask Specify the mask mask of the route to be added. Often, the netmask is not required, because it can be determined to be cla.s.s A, B, or C, depending on the of the route to be added. Often, the netmask is not required, because it can be determined to be cla.s.s A, B, or C, depending on the target target address. address.

When used to display routes, the following routing table columns are printed: Destination The destination network or host.

Gateway The gateway address. If no gateway is set for the route, an asterisk (*) is displayed by default.

Genmask The netmask for the destination. 255.255.255.255 is used for a host, and 0.0.0.0 is used for the default route.

Route status flags !Rejectroute.

DDynamicallyinstalledbydaemonorredirect.

GUsegateway.

HTargetisahost.

MModifiedfromroutingdaemonorredirect.

RReinstateroutefordynamicrouting.

URouteisup.

Metric The distance in hops to the target.

Ref Number of references to this route. This is displayed for compatibility with other route commands, but is not used in the Linux kernel.

Use A count of lookups for the route. Depending on the use of -F -F and and -C -C, the Use Use is either route cache misses ( is either route cache misses (-F) or hits (-C).

Iface The interface to which packets for this route are sent.

Example 1 Display the current routing table for a workstation: #route KernelIProutingtable DestinationGatewayGenmaskFlagsMetRefUseIface 192.168.1.30*255.255.255.255UH000eth0 192.168.1.0*255.255.255.0U000eth0 10.0.0.0-255.0.0.0!0-0- 127.0.0.0*255.0.0.0U000lo defaultgate0.0.0.0UG000eth0 In this example, the route to the local host 192.168.1.30 uses interface eth0 eth0. Note the mask 255.255.255.255 is used for host routes. The route to the local subnet 192.168.1.0 (with corresponding cla.s.s C mask 255.255.255.0) is also through eth0 eth0. The route to 10.0.0.0 is rejected, as indicated by the ! ! flag. The cla.s.s A loopback network route uses device flag. The cla.s.s A loopback network route uses device lo lo. The last route shows the default gateway default gateway route, which is used when no others match. This default uses route, which is used when no others match. This default uses eth0 eth0 to send data to router to send data to router gate gate. The mask 0.0.0.0 is used for the default route.

Example 2 Display the current routing cache; the Metric (M) and Reference (R) columns are abbreviated here: #route-C KernelIProutingcache SourceDestinationGatewayFlgMRUseIface smp192.168.1.255192.168.1.255bl001eth0 192.168.1.102192.168.1.255192.168.1.255ibl000lo 192.168.1.102smpsmpil001lo 192.168.1.50smpsmpil00224lo smp192.168.1.102192.168.1.102010eth0 smpns1.mynet.comgate002eth0 smp192.168.1.50192.168.1.50010eth0 localhostlocalhostlocalhostl0015lo ns1.mynet.comsmpsmpl006lo smpns1.mynet.comgate006eth0 Example 3 Add the default gateway 192.168.1.1 via eth0 eth0: #routeadddefaultgw192.168.1.1eth0

Name dhcpd Syntax dhcpd[options][interface[...]]

Description Launch the DHCP server daemon. dhcpd dhcpd requires that both its configuration file ( requires that both its configuration file (/etc/dhcpd.conf) and its lease logfile (which by default is /var/state/dhcp/dhcpd.leases /var/state/dhcp/dhcpd.leases, although many distributions use /var/lib/dhcp/dhcpd.leases /var/lib/dhcp/dhcpd.leases) exist. The daemon puts itself in the background and returns control to the calling sh.e.l.l.

Frequently used options -cf config-file config-file Use config-file config-file instead of the default instead of the default /etc/dhcpd.conf /etc/dhcpd.conf.

-lf lease-file lease-file Use lease-file lease-file instead of the default to store lease information. instead of the default to store lease information.

-q Use quiet mode. This option suppresses the default copyright message, keeping logfiles a little cleaner.

interface By default, dhcpd dhcpd will attempt to listen for requests on every network interface that is configured up. It can be limited to specific network interfaces by including one or more interface names on the command line. will attempt to listen for requests on every network interface that is configured up. It can be limited to specific network interfaces by including one or more interface names on the command line.

A full and detailed description of the configuration file syntax can be found in the dhcpd.conf dhcpd.conf manpage. When manpage. When dhcpd dhcpd runs, it sends output, including information on each transaction, to runs, it sends output, including information on each transaction, to syslogd syslogd. For example, this series of four log entries in /var/log/messages /var/log/messages shows a successful exchange between shows a successful exchange between dhcpd dhcpd and a requesting DHCP client: and a requesting DHCP client: Apr2402:27:00rh62dhcpd:DHCPDISCOVER from00:60:97:93:f6:8aviaeth0 Apr2402:27:00rh62dhcpd:DHCPOFFER on192.168.1.200to00:60:97:93:f6:8aviaeth0 Apr2402:27:01rh62dhcpd:DHCPREQUEST for192.168.1.200from00:60:97:93:f6:8aviaeth0 Apr2402:27:01rh62dhcpd:DHCPACK on192.168.1.200to00:60:97:93:f6:8aviaeth0On the ExamFor the LPI Level 1 Exams, you should be familiar with both the manual and automatic network interface configuration, and how interfaces can be started, stopped, and configured.

Chapter21.Basic Network Troubleshooting (Topic 109.3)

Even the simplest of network installations will at times require troubleshooting. Every Linux system administrator needs to understand not only where to start the troubleshooting process but also what tools are available to aid in this endeavor. This chapter covers the following Objective: Objective 3: Basic Network Troubleshooting Candidates should be able to perform basic troubleshooting steps in diagnosing network connectivity issues and configuration. This Objective includes tools that show information about local computer configuration and the testing communication with computers on local network and remote connections. Some of these tools may also be used for network configuration, as discussed in the previous Objective. Candidates should be able to view, change, and verify configuration settings and operational status for various network interfaces. Weight: 4.

Objective 3: Basic Network Troubleshooting One important part of an administrator's role is troubleshooting connectivity issues and tracking down sources of problems. Many of the tools introduced earlier in this book may also be used as troubleshooting tools to a.s.sist in this process. This objective revisits some of these commands and discusses how they may be used as diagnostic resources in addition to configuration resources.

Name ping Syntax ping[options]destination Description Send an ICMP ECHO_REQUEST ECHO_REQUEST datagram to datagram to destination destination, expecting an ICMP ECHO_RESPONSE ECHO_RESPONSE. ping ping is frequently used to test basic network connectivity. See is frequently used to test basic network connectivity. See Objective 1: Fundamentals of Internet Protocols Objective 1: Fundamentals of Internet Protocols for a more complete description. for a more complete description.

Name host Syntax host[options]name[server]

Description Look up the system with IP address or name name on the DNS on the DNS server server.

Frequently used options -l List the entire domain, dumping all hosts registered on the DNS server (this can be very long).

-v Set verbose mode to view output.

Example 1 $hostoreilly.com oreilly.comhasaddress208.201.239.37 oreilly.comhasaddress208.201.239.36 Example 2 $host-voreilly.com Trying"oreilly.com"

;;->>HEADER<-opcode:query,status:noerror,id:60189 ;;flags:qrrdra;query:1,answer:2,authority:0,additional:0="">

;;QUESTIONSECTION: ;oreilly.com.INA

;;ANSWERSECTION: oreilly.com.877INA208.201.239.100 oreilly.com.877INA208.201.239.101

Received61bytesfrom192.168.1.220#53in0ms Trying"oreilly.com"

;;->>HEADER<-opcode:query,status:noerror,id:1045 ;;flags:qrrdra;query:1,answer:0,authority:1,additional:0="">

;;QUESTIONSECTION: ;oreilly.com.INAAAA

;;AUTHORITYSECTION: oreilly.com.3577INSOAnsautha.oreilly.com. nic-tc.oreilly.com.866001800604800

Received80bytesfrom192.168.1.220#53in0ms Trying"oreilly.com"

;;->>HEADER<-opcode:query,status:noerror,id:18547 ;;flags:qrrdra;query:1,answer:2,authority:0,additional:2="">

;;QUESTIONSECTION: ;oreilly.com.INMX

;;ANSWERSECTION: oreilly.com.3577INMX20smtp1.oreilly.com.

oreilly.com.3577INMX20smtp2.oreilly.com.

;;ADDITIONALSECTION: smtp1.oreilly.com.3577INA209.204.146.22 smtp2.oreilly.com.3577INA216.204.211.22

Received105bytesfrom192.168.1.220#53in0ms

Name traceroute Syntax traceroute[options]destination Description Display the route that packets take to reach destination destination, showing intermediate gateways (routers). There is no direct way to make this determination, so traceroute traceroute uses a trick to obtain as much information as it can. By using the time-to-live (TTL) field in the IP header, uses a trick to obtain as much information as it can. By using the time-to-live (TTL) field in the IP header, traceroute traceroute stimulates error responses from gateways. The time-to-live field specifies the maximum number of gateway hops until the packet should expire. That number is decremented at each gateway hop, with the result that all packets will die at some point and stop roaming the Internet. To get the first gateway in the route, stimulates error responses from gateways. The time-to-live field specifies the maximum number of gateway hops until the packet should expire. That number is decremented at each gateway hop, with the result that all packets will die at some point and stop roaming the Internet. To get the first gateway in the route, traceroute traceroute sets the time-to-live parameter to 1. The first gateway in the route to sets the time-to-live parameter to 1. The first gateway in the route to destination destination decrements the counter, and finding a zero result, reports an ICMP decrements the counter, and finding a zero result, reports an ICMP TIME_EXCEEDED TIME_EXCEEDED message back to the sending host. The second gateway is identified by setting the initial time-to-live value to 2, and so on. This continues until a message back to the sending host. The second gateway is identified by setting the initial time-to-live value to 2, and so on. This continues until a PORT_UNREACHABLE PORT_UNREACHABLE message is returned, indicating that the host has been contacted. To account for the potential for multiple gateways at any one hop count, each probe is sent three times. message is returned, indicating that the host has been contacted. To account for the potential for multiple gateways at any one hop count, each probe is sent three times.

The display consists of lines showing each gateway, numbered for the initial time-to-live value. If no response is seen from a particular gateway, an asterisk is printed. This happens for gateways that don't return "time exceeded" messages, or do return them but set a very low time-to-live on the response. Transit times for each probe are also printed.

Frequently used options -f ttl ttl Set the initial probe's time-to-live value to ttl ttl, instead of 1.

-n Display numeric addresses instead of names.

-v Use verbose mode.

-w secs secs Set the timeout on returned ICMP packets to secs secs, instead of 5.

Example $traceroutelpi.org traceroutetolpi.org(24.215.7.162),30hopsmax,40bytepackets 196.64.11.1(96.64.11.1)12.689ms5.018ms9.861ms 2ge-1-28-ur01.east.tn.knox.comcast.net(68.85.206.181) 8.712ms*10.868ms 3te-8-1-ar01.bluelight.tn.knox.comcast.net(68.86.136.30) 15.109ms6.932ms24.996ms 4*te-0-8-0-4-crs01.b0atlanta.ga.atlanta.comcast.net(68.85.232.97) 41.966ms51.914ms 5pos-1-4-0-0-cr01.atlanta.ga.ibone.comcast.net(68.86.90.121) 38.775ms26.511ms32.650ms 668.86.86.86(68.86.86.86)41.428ms40.369ms46.387ms 775.149.230.74(75.149.230.74)56.789ms29.051ms28.835ms 8xe-5-3-0.chi10.ip4.tinet.net(89.149.185.37)84.556ms 123.707ms123.579ms 9peer1-gw.ip4.tinet.net(77.67.71.22)70.550ms39.203ms39.795ms 10oc48-po1-0.tor-1yg-cor-1.peer1.net(216.187.114.142) 52.049ms80.272ms68.667ms 1110ge.xe-0-0-0.tor-151f-cor-1.peer1.net(216.187.114.134) 67.809ms45.667ms45.157ms 12oc48-po7-0.tor-151f-dis-1.peer1.net(216.187.114.149) 97.586ms48.451ms45.559ms 13peer1-tor-gw.colosseum(66.199.142.250) 56.156ms93.090ms78.800ms 14core-main.mountaincable.net(24.215.3.185) 59.369ms52.889ms111.326ms 1524.215.7.110(24.215.7.110)50.487ms114.975ms44.655ms 16clark.lpi.org(24.215.7.162)54.705ms84.838ms46.562ms In this example, there are 15 hops to http://www.lpi.org, reached with a time-to-live value of 16. All three probes of all time-to-live counts are successful.

Name netstat Syntax netstat[options]

Description Depending on options, netstat netstat displays network connections, routing tables, interface statistics, masqueraded connections, and multicast memberships. Much of this is beyond the scope of the LPIC Level 1 Exams, but you must be aware of the command and its basic use. displays network connections, routing tables, interface statistics, masqueraded connections, and multicast memberships. Much of this is beyond the scope of the LPIC Level 1 Exams, but you must be aware of the command and its basic use.

Frequently used options -c Continuous operation. This option yields a netstat netstat display every second until interrupted with Ctrl-C. display every second until interrupted with Ctrl-C.

-i Display a list of interfaces.

-n Numeric mode. Display addresses instead of host, port, and usernames.

-p Programs mode. Display the process ID (PID) and process name.

-r Routing mode. Display the routing table in the format of the route route command. command.

-v Verbose mode.

Examples Display the interfaces table and statistics (the example output is truncated): #netstat-i KernelInterfacetable IfaceMTUMetRX-OKRX-ERRRX-DRPRX-OVRTX-OK eth01500015188013700713297 lo39240365816000365816 To show all current connections without resolving hostnames and protocol names: #netstat-an--tcp ActiveInternetconnections(serversandestablished)

ProtoRecv-QSend-QLocalAddressForeignAddressState tcp000.0.0.0:340310.0.0.0:*LISTEN tcp000.0.0.0:60000.0.0.0:*LISTEN tcp00127.0.0.1:6310.0.0.0:*LISTEN tcp1010.41.81.148:5966710.41.0.47:3268CLOSE_WAIT tcp0010.41.81.148:4544964.4.34.61:1863ESTABLISHED tcp0010.41.81.148:5328410.41.0.32:143ESTABLISHED tcp0010.41.81.148:3372210.41.0.38:22ESTABLISHED tcp0010.41.81.148:4226174.125.77.83:443ESTABLISHED tcp0010.41.81.148:5487983.85.96.153:3490ESTABLISHED tcp0010.41.81.148:4226274.125.77.83:443ESTABLISHED tcp0010.41.81.148:34054195.86.128.44:22ESTABLISHED tcp0010.41.81.148:46150212.100.160.43:5222ESTABLISHED tcp00:::6000:::*LISTEN udp00127.0.0.1:469580.0.0.0:*

udp000.0.0.0:340310.0.0.0:*

udp000.0.0.0:6310.0.0.0:*

To show the PID and name of the process to which each socket belongs, to identify what could be causing a problem: $netstat-p

(Notallprocessescouldbeidentified,non-ownedprocessinfo willnotbeshown,youwouldhavetoberoottoseeitall.)

ActiveInternetconnections(w/oservers) ProtoRecv-QSend-QLocalAddressForeignAddress StatePID/Programname tcp00server01.domain.:60032ew-in-f18.1e100.n:https ESTABLISHED4698/firefox-bin tcp00server01.domain.:40343messaging.n:xmpp-client ESTABLISHED4680/pidgin tcp00server01.domain.:53533srdc-mail-01:imap ESTABLISHED4679/evolution tcp00server01.domain.:40292195.86.25.214:http ESTABLISHED4698/firefox-bin tcp00server01.domain.:60209ew-in-f147.1e100.n:http ESTABLISHED4698/firefox-bin tcp00server01.domain.:60031ew-in-f18.1e100.n:https TIME_WAIT- tcp00server01.domain.:55647ew-in-f83.1e100.n:https ESTABLISHED4698/firefox-bin tcp00server01.domain.:35718ew-in-f102.1e100.n:http ESTABLISHED4698/firefox-bin tcp00server01.domain.:57265sn1msg2010707.phx.:1863 TIME_WAIT-netstat tcp00server01.domain.:58931195.86.25.214:http ESTABLISHED4698/firefox-bin tcp00server01.domain.:47146backup2.:ssh ESTABLISHED5113/ssh tcp00server01.domain.:52707g199040.upc-g.chel:4130 ESTABLISHED4682/skype tcp00server01.domain.:56608bay5-terminal.bay5:1863 ESTABLISHED4680/pidgin tcp10server01.domain.:51980server02:3268 CLOSE_WAIT4709/evolution-data tcp00server01.domain.:36070195.86.25.214:http ESTABLISHED4698/firefox-bin tcp00server01.domain.:60212ew-in-f147.1e100.n:http ESTABLISHED4698/firefox-binOn the ExamWhile the creation of complete network management scripts from scratch is beyond the scope of the LPIC Level 1 Exams, you must be familiar with these commands individually, their functions, how they are used, and when to use them. For example, you must be familiar with route route and its use in establishing routes to the loopback device, the localhost, and the gateway machine, and the creation of the default gateway route. A general understanding of the routing table display is also required. Questions may ask you to determine the cause of a network problem based on the routing configuration (such as a missing default route). and its use in establishing routes to the loopback device, the localhost, and the gateway machine, and the creation of the default gateway route. A general understanding of the routing table display is also required. Questions may ask you to determine the cause of a network problem based on the routing configuration (such as a missing default route).

Common Manual Network Interface Tasks Network interfaces are established in the kernel at boot time by probing Ethernet hardware. As a result, these interfaces always exist unless the hardware or kernel module is removed. The interfaces are transient and exist only when they are in use.

To list interface parameters, use ifconfig ifconfig with the interface name: with the interface name: #ifconfigeth0 eth0Linkencap:EthernetHWaddr00:A0:24:D3:C7:21 inetaddr:192.168.1.30Bcast:192.168.1.255Mask:255.255.255.0 UPBROADCASTMULTICASTMTU:1500Metric:1 RXpackets:1857128errors:46dropped:0overruns:0frame:46 TXpackets:871709errors:0dropped:0overruns:0carrier:0 collisions:2557txqueuelen:100 Interrupt:10Baseaddress:0xef00 If you run ifconfig ifconfig without any parameters, it displays all active interfaces, including the loopback interface without any parameters, it displays all active interfaces, including the loopback interface lo lo and perhaps a PPP interface if a modem is dialed into a service provider or a wireless interface such as and perhaps a PPP interface if a modem is dialed into a service provider or a wireless interface such as ath0 ath0 if you have an active wireless card. if you have an active wireless card.

To shut down a network interface that is currently running, simply use ifconfig ifconfig with the with the down down keyword: keyword: #ifconfigeth0down When the interface goes down, any routes a.s.sociated with it are removed from the routing table. For a typical system with a single Ethernet interface, this means that the routes to both the interface and the default gateway will be lost. Therefore, to start a previously configured network interface, ifconfig ifconfig is used with is used with up up, followed by the necessary route route commands. For example: commands. For example: #ifconfigeth0up #routeadd-host192.168.1.30eth0 #routeadddefaultgw192.168.1.1eth0 To reconfigure interface parameters, follow those same procedures and include the changes. For example, to change to a different IP address, the address is specified when bringing up the interface and adding the interface route: #ifconfigeth0down #ifconfigeth0192.168.1.60up #routeadd-host192.168.1.60eth0 #routeadddefaultgw192.168.1.1eth0 Your distribution probably supplies scripts to handle some of these ch.o.r.es. For example, Red Hat systems come with scripts such as ifup ifup and and ifdown ifdown, which handle all the details necessary to get an interface and its routes up and running, based on configuration files in /etc/sysconfig/network-scripts/ /etc/sysconfig/network-scripts/.

On the ExamBe prepared to answer questions on the use of ifconfig ifconfig and and route route for basic interface manipulation. Also remember that scripts that use these commands, both manually and automatically, are usually available at boot time. for basic interface manipulation. Also remember that scripts that use these commands, both manually and automatically, are usually available at boot time.