📄 tyt07fi.htm
字号:
<HTML><HEAD><TITLE>tyt07fi.htm</TITLE><LINK REL=ToC HREF=index-1.htm><LINK REL=Index HREF=tppmsgs/msgs0.htm#37><LINK REL=Next HREF=tyt08fi.htm><LINK REL=Previous HREF=tyt06fi.htm></HEAD><BODY BGCOLOR=#FFFFFF TEXT=#000000 LINK=#0000FF VLINK=#800080><A ID=I0 NAME=I0></A><P><P ALIGN=CENTER><A HREF=tyt06fi.htm TARGET=_self><IMG SRC=blanprev.gif WIDTH = 37 HEIGHT = 37 BORDER = 0 ALT="Previous Page"></A><A HREF=index-1.htm TARGET=_self><IMG SRC=blantoc.gif WIDTH = 37 HEIGHT = 37 BORDER = 0 ALT=TOC></A><A HREF=tyt08fi.htm TARGET=_self><IMG SRC=blannext.gif WIDTH = 37 HEIGHT = 37 BORDER = 0 ALT="Next Page"></A><HR ALIGN=CENTER><P><UL><UL><UL><LI><A HREF=#E68E68>Configuration Files</A></LI><UL><LI><A HREF=#E69E100>Symbolic Machine Names: /etc/hosts</A></LI><LI><A HREF=#E69E101>Network Names: /etc/networks</A></LI><LI><A HREF=#E69E102>Network Protocols: /etc/protocols</A></LI><LI><A HREF=#E69E103>Network Services: /etc/services</A></LI></UL><LI><A HREF=#E68E69>Setting the Host Name</A></LI><LI><A HREF=#E68E70>The Loopback Driver</A></LI><LI><A HREF=#E68E71>Managing ARP</A></LI><LI><A HREF=#E68E72>Using ifconfig</A></LI><LI><A HREF=#E68E73>The inetd Daemon</A></LI><LI><A HREF=#E68E74>The netstat Command</A></LI><UL><LI><A HREF=#E69E104>Communications End Points</A></LI><LI><A HREF=#E69E105>Network Interface Statistics</A></LI><LI><A HREF=#E69E106>Data Buffers</A></LI><LI><A HREF=#E69E107>Routing Table Information</A></LI><LI><A HREF=#E69E108>Protocol Statistics</A></LI></UL><LI><A HREF=#E68E75>The ping Utility</A></LI><LI><A HREF=#E68E76>Tracing a Connection</A></LI><LI><A HREF=#E68E77>Summary</A></LI><LI><A HREF=#E68E78>Q&A</A></LI></UL></UL></UL><HR ALIGN=CENTER><A ID=E66E7 NAME=E66E7></A><H1 ALIGN=CENTER><CENTER><FONT SIZE=6 COLOR=#FF0000><B>— 7 —</B><BR><B>TCP/IP Configuration and Administration Basics</B></FONT></CENTER></H1><BR><P>Although TCP/IP works transparently for the user, occasionally communications seem to be slow and TCP/IP is suspected as the cause. Most users are impatient and expect things to happen right away, so delays for any reason lead to frustration. Rather than sit and wait, most users like to be able to verify that a connection to a remote machine is active and a delay is caused by network traffic instead of a system failure. At the least, most users would like to understand why a session is progressing slowly.<BR><P>TCP/IP has several utility programs that provide status information and performance statistics. Also available are several debugging programs and options to enable a developer or knowledgeable user to trace a problem. This chapter examines the basic set of these tools. Although TCP/IP is a standard, there are many different implementations of the protocol family. Most versions have the basic toolset discussed today, although some might alter names and output to their own liking.<BR><BLOCKQUOTE><BLOCKQUOTE><HR ALIGN=CENTER><BR><NOTE><IMG SRC=caution.gif WIDTH = 37 HEIGHT = 35>All network addresses and machine names in this chapter are chosen at random and do not represent any particular network. Because the network addresses used might correspond to a real network, you should not use them in any experimentation, or you might incur the wrath of a system administrator!</NOTE><BR><HR ALIGN=CENTER></BLOCKQUOTE></BLOCKQUOTE><P>Not all the commands shown in this chapter are available to regular users (as opposed to system administrators) on all systems, although some system administrators do enable some access to the utilities for checking connection and TCP/IP status. The commands are presented here to show the debugging and diagnostic capabilities available to the TCP/IP user and administrator. The commands are not covered in exhaustive detail but are intended to complete the TCP/IP picture for you. Many of these programs and utilities are seen again later in this book when I set up a sample TCP/IP network.<BR><BR><A ID=E68E68 NAME=E68E68></A><H3 ALIGN=CENTER><CENTER><FONT SIZE=5 COLOR=#FF0000><B>Configuration Files</B></FONT></CENTER></H3><BR><P>Several files are involved in the complete specification of network addresses and configuration for TCP/IP. For illustrative purposes, a UNIX system is used as the standard here, although a few other operating systems are mentioned as appropriate. Other operating systems use different filenames, but the purpose of the files is usually the same. You might have to check with your operating system documentation to identify the files used for each purpose.<BR><P>UNIX allows comments on every line of these configuration files, as long as they are prefaced by a pound sign (#). If you see this character in your own system's configuration files, you should note that it is not part of an entry. With many operating systems, the default configuration files have many entries, most of which are commented out until the system administrator removes the comments.<BR><P>You might not be able to examine the files or run the utilities mentioned in this chapter because of security restrictions. If you edit the configuration files, make sure you do not make any unintentional changes! Make backups of all the files before you make any changes to your systems.<BR><A ID=E69E100 NAME=E69E100></A><H4 ALIGN=CENTER><CENTER><FONT SIZE=4 COLOR=#FF0000><B>Symbolic Machine Names: </B><B><I>/etc/hosts</I></B></FONT></CENTER></H4><BR><P>Whenever a symbolic name is used as a target address by an application, there must be some method to resolve that name into a network address. An ASCII file is commonly used with the symbolic names matched to network addresses. This does not apply when the Yellow Pages (YP), Network Information Services (NIS), or the Domain Name Server (DNS) is used; they use their own configuration files.<BR><P>On UNIX systems, the file /etc/hosts is used to hold the network addresses, as well as one special connection called the <I>loopback</I> (which is examined later in this chapter in the section titled "The Loopback Driver"). The loopback connection address is usually listed as the machine name loopback or localhost.<BR><P>The file /etc/hosts consists of the network address in one column separated from the symbolic name in another. The network addresses can be specified in decimal, octal, or hexadecimal format (although decimal is the most common). More than one symbolic name can be specified on a line by separating the names with either space characters or tabs. The /etc/hosts file can be as long as necessary to contain all the symbolic names used on the local machine; they do not need to be presented in any order. A sample UNIX /etc/hosts file is as follows:<BR><PRE><FONT COLOR=#000080># network host addresses127.0.0.1 localhost local tpci_server157.40.40.1 tpci_sco1157.40.40.2 tpci_sco2157.40.40.3 tpci_hpws1157.40.40.0 tpci_server tpci_main tpci47.80.157.36 bnr.ca BNR bnr191.13.123.4 kitty_cat205.150.89.1 roy_maclean big_roy210.24.47.128 bobs_machine</FONT></PRE><P>As you can see, the file is made up of two columns. The first column gives the IP address of a machine, and the second (separated by one or more whitespace characters) gives the machine's name. If several names can be used to identify the remote machine, they are listed on the same line, separated by whitespace. For example, the remote machine with IP address 205.150.89.1 can be addressed as either roy_maclean or big_roy. Whenever either of those names is used in a command (such as an FTP or Telnet application), this file is used to match to the proper IP address.<BR><P>A system or network administrator can update the /etc/hosts file at any time, and changes are effective immediately (so the machine doesn't have to be rebooted to effect the changes). Whenever a symbolic name is specified by a user or an application, the /etc/hosts file is always searched first for a matching name, and the proper address is read from the same line.<BR><P>Most TCP/IP implementations on other platforms have a similar type of file to resolve IP addresses from symbolic names. NetManage ChameleonNFS running on a Windows 3.<I>x</I> machine, for example, uses a Host Table to match names and IP addresses. The Host Table, shown in Figure 7.1, is a graphical front-end to a file equivalent to /etc/hosts on a UNIX machine.<BR><P><B><A HREF=07tyt01.gif>Figure 7.1. ChameleonNFS uses a Host Table to match </B><B>symbolic names and IP addresses.</A></B><BR><BR><A ID=E69E101 NAME=E69E101></A><H4 ALIGN=CENTER><CENTER><FONT SIZE=4 COLOR=#FF0000><B>Network Names: </B><B><I>/etc/networks</I></B></FONT></CENTER></H4><BR><P>Networks can be addressed by a symbolic name, just as machines are. To resolve the network names, another file is used that contains the corresponding network address. Typically, this file isn't accessed often, because few users want to address an entire network within their application. The network name resolution file's most common use is to specify the local network's name.<BR><P>UNIX systems usually use the file /etc/networks to specify symbolic network names. The format of the file provides a network symbolic name, its network address, and any alias that might be used, in much the same format as the /etc/hosts table is used for specific machines. A sample /etc/networks file is shown here:<BR><PRE><FONT COLOR=#000080># local network namestpci 146.1 tpci_network tpci_localbnr 47.80 BNR bnr.catmn 123.2.21unique 89.123.23 UNIQUEsco 132.147 SCOloopback 127 localhost</FONT></PRE><P>The /etc/networks file layout is a little different from /etc/hosts in that the usual network name is given in the first column, followed by the IP network address, then any aliases.<BR><P>The last entry in this example file gives the loopback name. The first entry specifies the local machine name, its network address, and any name variants. Using this file, an application that wanted to reach the network called UNIQUE could use that name and let the operating system resolve it to the IP network address 89.123.23.<BR><P>Many implementations of TCP/IP on other platforms don't bother with a network name resolution file like this. Part of the reason is that the /etc/networks file has little use on a UNIX platform, and many single-user operating systems don't require the type of versatility a multiuser operating system like UNIX must supply to an entire network.<BR><BR><A ID=E69E102 NAME=E69E102></A><H4 ALIGN=CENTER><CENTER><FONT SIZE=4 COLOR=#FF0000><B>Network Protocols: </B><B><I>/etc/protocols</I></B></FONT></CENTER></H4><BR><P>Protocol numbers are used to identify the transport protocol to the receiving machine to enable proper decoding of the information within the datagram. With TCP/IP, the protocol number is embedded in the Internet Protocol header. A configuration file is usually used to identify all the transport protocols available on the system and their respective protocol numbers.<BR><P>UNIX systems use the /etc/protocols file for this purpose. Usually, this file is not modified by the administrator but is maintained by the system and updated automatically as part of the installation procedure when new TCP/IP software or services are added. The /etc/protocols file contains the protocol name, its number, and any alias that might be used for that protocol. A sample /etc/protocols file is shown here:<BR><PRE><FONT COLOR=#000080>## Internet (IP) protocols#ip 0 IP # internet protocol, pseudo protocol numbericmp 1 ICMP # internet control message protocoligmp 2 IGMP # internet group management protocolggp 3 GGP # gateway-gateway protocoltcp 6 TCP # transmission control protocolegp 8 EGP # Exterior-Gateway Protocolpup 12 PUP # PARC universal packet protocoludp 17 UDP # user datagram protocolhello 63 HELLO # HELLO Routing Protocolospf 89 OSPF # Open Shortest Path First Routing Protocol</FONT></PRE><P>In this /etc/protocols file, the IP protocol is assigned protocol 0, and TCP is protocol 6. The values in this table should not be changed from their default values except when special network conditions mandate a change. If new TCP/IP services are added to the UNIX system this file resides on, new entries are made to this file by the application installation routine.<BR><P>There are usually no equivalents of the /etc/protocols file on other operating systems because they assume that the standard transport number is used for each protocol.<BR><BR><A ID=E69E103 NAME=E69E103></A><H4 ALIGN=CENTER><CENTER><FONT SIZE=4 COLOR=#FF0000><B>Network Services: </B><B><I>/etc/services</I></B></FONT></CENTER></H4><BR><P>The final common configuration file used on most UNIX systems identifies the existing network services. As with the /etc/protocols file, this file is not usually modified by an administrator but is maintained by software as it is installed or configured.<BR><P>The UNIX network services file is /etc/services. The file is in ASCII format consisting of the service name, a port number, and the protocol type. The port number and protocol type are separated by a slash. The port numbers for TCP/IP usually follow the conventions mentioned in the previous chapters. Any optional service alias names follow after the port numbers. A short extract from a sample /etc/services file (the file is usually quite lengthy) is shown here:<BR><PRE><FONT COLOR=#000080># network servicesecho 7/tcpecho 7/udpdiscard 9/tcp sink nulldiscard 9/udp sink nullftp 21/tcptelnet 23/tcpsmtp 25/tcp mail mailxtftp 69/udp# specific serviceslogin 513/tcpwho 513/udp whod</FONT></PRE><BR><A ID=E68E69 NAME=E68E69></A><H3 ALIGN=CENTER><CENTER><FONT SIZE=5 COLOR=#FF0000><B>Setting the Host Name</B></FONT></CENTER></H3><BR><P>TCP/IP requires that each machine on the network have an IP address. Usually, each machine also has a unique symbolic name; otherwise, the IP address must be used for all connections to that machine. Most operating systems have a simple program that identifies the name of the local machine. UNIX systems have the utility hostname for this purpose, as well as the uname program, which can give the node name with the command uname -n. The uname utility is usually supported in System V and compatible operating systems only.<BR><P>The host name is sometimes saved in a separate file that is read when the operating system starts up, or it can be read from one of the configuration files mentioned previously. The hostname is used by most protocols on the system and by many TCP/IP applications, so it is important for proper system operation. The host name can sometimes be changed by editing the system file that contains the name and then rebooting the machine, although many operating systems provide a utility program to ensure that this process is performed correctly.<BR><P>On many UNIX systems, the hostname and uname commands echo back the local machine name, as the following sample session shows:<BR><PRE><FONT COLOR=#000080>$ hostnametpci_sco4.tpci.com$ uname -ntpci_sco4</FONT></PRE><P>On the SCO UNIX system used in this example, the hostname command returns the fully qualified domain name, whereas the uname command provides the local machine name only. On a Hewlett-Packard workstation running HP-UX, both commands return only the local machine name. The exact behavior of the hostname and uname commands is therefore quite dependent on the implementation.<BR><P>On a Linux system, for example, the hostname command can be used to not only show the current host name setting but also to change it when used with the -S (for set) option. For example, the command<BR><BR><PRE><FONT COLOR=#000080>hostname -S willow.tree.com</FONT></PRE><P>changes the local fully qualified domain name to willow.tree.com. Not all versions of Linux support the -S option of the hostname command.<BR><P>Most TCP/IP suites for other operating systems use a simpler method of setting the host name. For example, on a Windows 3.<I>x</I> machine the NetManage ChameleonNFS package uses the dialog shown in Figure 7.2 to quickly set the host name.<BR><P><B><A HREF=07tyt02.gif>Figure 7.2. ChameleonNFS uses this dialog to set </B><B>the host name.</A></B><BR><P>Windows NT has TCP/IP services built into the basic distribution. On a Windows NT system, the host name is specified through the Network dialog opened from the Control Panel, as shown in Figure 7.3. Both the Windows NT and Windows 3.<I>x</I> systems enable a change in the host name to be made effective immediately, although a system reboot is recommended to clear all configuration information held in memory.<BR><P><B><A HREF=07tyt03.gif>Figure 7.3. Setting the host name through the </B><B>Windows NT Network Control Panel.</A></B><BR><P>A potential problem can occur when the local machine is <I>multihomed,</I> or based in several networks with a different name and IP address for each network. The single name in the configuration file in such an installation might not provide enough information to permit proper routing over all the connected networks. This problem is seldom encountered, but it does require the system administrator to set the hostname for each network carefully.<BR><P>Aside from the simple machine name query shown, the hostname system is a full protocol that enables access to the Network Information Center (NIC) tables to verify addresses and obtain information about the network, gateways, and hosts. It uses TCP port number 101 to connect to the NIC. This type of access is usually restricted to the network administrator.<BR><BR><A ID=E68E70 NAME=E68E70></A><H3 ALIGN=CENTER><CENTER><FONT SIZE=5 COLOR=#FF0000><B>The Loopback Driver</B></FONT></CENTER></H3><BR><P>The <I>loopback driver</I> is probably the most fundamental and often-used diagnostic available to an administrator. A loopback driver acts as a virtual circuit, enabling outgoing information to be immediately rerouted back to an input. This enables testing of the machine's circuits by eliminating any external influences, such as the network itself, gateways, or remote machines. By convention, each machine uses the IP address 127.0.0.1 for the loopback driver (also called the localhost IP address).<BR><P>Every system should have a loopback driver in place whether the machine is on a network or not. This is because some applications insist on having an IP address they can access to function properly. Many license servers on a UNIX machine have this requirement, for example. Although the need for a loopback driver isn't important for non-networked Windows and similar operating system machines, a loopback driver is always installed with a TCP/IP suite.<BR><BLOCKQUOTE><BLOCKQUOTE><HR ALIGN=CENTER><BR><NOTE><IMG SRC=note.gif WIDTH = 75 HEIGHT = 46>By using a loopback driver, an administrator can be sure that the local machine is working properly and that any failures are from further out. Also, some applications insist on having a loopback driver IP address in order to function properly.</NOTE><BR><HR ALIGN=CENTER></BLOCKQUOTE></BLOCKQUOTE><P>Loopback drivers are usually embedded as part of the operating system kernel, or sometimes as an add-on utility program. Most multiuser systems employ an embedded loopback driver. UNIX is a good example: within the kernel is a device driver specifically designed to act as a loopback driver. The loopback driver is almost always added automatically when the operating system is installed, but a few UNIX-based operating systems, including several versions of Linux, don't perform this function, and the loopback driver must be added manually by the system administrator. As previously mentioned, several configuration files on the system contain the address of the loopback's connection, such as /etc/hosts.<BR><P>Using the loopback driver to reroute the output stream, the network interface card (usually an Ethernet card) is bypassed. The loopback driver is useful for testing TCP/IP software installations, because it immediately shows any problems with the local configuration. This can be done before the machine is physically connected to the network or even before the networking hardware and software are installed. For example, you can use the loopback driver to test your TCP/IP configuration before it is connected to a network by using the ping command with the localhost name or IP address, as the following example shows:<BR><PRE><FONT COLOR=#000080># ping -c5 localhostPING localhost (127.0.0.1): 56 data bytes64 bytes from localhost (127.0.0.1): icmp_seq=0 ttl=64 time=10 ms64 bytes from localhost (127.0.0.1): icmp_seq=1 ttl=64 time=0 ms64 bytes from localhost (127.0.0.1): icmp_seq=2 ttl=64 time=0 ms64 bytes from localhost (127.0.0.1): icmp_seq=3 ttl=64 time=0 ms64 bytes from localhost (127.0.0.1): icmp_seq=4 ttl=64 time=0 ms--- localhost ping statistics ---5 packets transmitted, 5 packets received, 0% packet lossround-trip min/avg/max = 0/2/10 ms# ping -c5 127.0.0.1PING 127.0.0.1 (127.0.0.1): 56 data bytes64 bytes from localhost (127.0.0.1): icmp_seq=0 ttl=64 time=0 ms64 bytes from localhost (127.0.0.1): icmp_seq=1 ttl=64 time=0 ms64 bytes from localhost (127.0.0.1): icmp_seq=2 ttl=64 time=0 ms64 bytes from localhost (127.0.0.1): icmp_seq=3 ttl=64 time=0 ms64 bytes from localhost (127.0.0.1): icmp_seq=4 ttl=64 time=0 ms--- 127.0.0.1 ping statistics ---5 packets transmitted, 5 packets received, 0% packet lossround-trip min/avg/max = 0/0/0 ms</FONT></PRE><P>In the preceding example I used the ping command with the -c option to specify five pings, first with the localhost name (which /etc/hosts resolves to the IP address 127.0.0.1) and then with the IP address itself. If either command had failed, it would indicate a problem with either the /etc/hosts file (if the name localhost could not be resolved) or with the TCP/IP installation (if both commands failed).<BR><BR><A ID=E68E71 NAME=E68E71></A><H3 ALIGN=CENTER><CENTER><FONT SIZE=5 COLOR=#FF0000><B>Managing ARP</B></FONT></CENTER></H3><BR><P>The arp program manages entries in the system's Address Resolution Protocol (ARP) tables. You may recall that ARP provides the link between the IP address and the underlying physical address. For more information, see Day 2, "TCP/IP and the Internet."<BR><P>Using arp (or its equivalent in other operating systems), the administrator can create, modify, or delete entries in the ARP table. Typically, this has to be performed whenever a machine's network address changes (either because of a change in the network hardware or because of a physical move).<BR><P>The arp program differs considerably between implementations and is seldom used by users, so examples of its use are left to the operating system's configuration and administration documentation.<BR><BR><A ID=E68E72 NAME=E68E72></A><H3 ALIGN=CENTER><CENTER><FONT SIZE=5 COLOR=#FF0000><B>Using </B><B>ifconfig</B></FONT></CENTER></H3><BR><P>The ifconfig program, or one like it, enables an administrator to activate and deactivate network interfaces, as well as to configure them. Access to the ifconfig program is generally restricted to a superuser or network administrator. Changes to the configuration can usually be made only before the system is fully operational (such as in single-user mode on a UNIX system). When issued, ifconfig essentially instructs the network layer of the kernel to work with the specified network interface by assigning an IP address, then issuing a command to make the interface active on the system. Only when the interface is active can the operating system kernel send and receive data through the interface.<BR><P>The ifconfig program enables a network administrator to perform several useful functions on most operating systems:<BR><UL><UL><P>Activate or deactivate an interface</UL></UL><UL><UL><P>Activate or deactivate ARP on an interface</UL></UL><UL><UL><P>Activate or deactivate debugging mode on an interface</UL></UL><UL><UL><P>Assign a broadcast address</UL></UL><UL><UL><P>Assign a subnetwork mask</UL></UL><BLOCKQUOTE><BLOCKQUOTE><P>Assign a routing method<BR></BLOCKQUOTE></BLOCKQUOTE><P>Examining all the options available to ifconfig would require several dozen pages. Because this material is rarely used and differs with each implementation, administrators are referred to their operating system documentation. As an example, the Linux version of the ifconfig command uses this general format:<BR><BR><PRE><FONT COLOR=#000080>ifconfig <I>interface_type IP_Address</I></FONT></PRE><P><I>interface_type</I> is the interface's device driver name (such as lo for loopback, ppp for PPP, and eth for Ethernet), and <I>IP_Address</I> is the IP address used by that interface.<BR><P>When used with only the name of an interface, ifconfig usually returns information about the current state of the interface, as shown in the following example. In this example, a query of both an Ethernet card (called ec0) and the loopback driver (called lo0) is performed. The status flags of the interface are followed by the Internet address, the broadcast address, and optionally a network mask, which defines the Internet address used for address comparison when routing.<BR><PRE><FONT COLOR=#000080>tpci_sco1-12> ifconfig ec0ec0: flags=807<UP,BROADCAST,DEBUG,ARP> inet 146.8.12.15 netmask fffff00 broadcast146.8.12.15tpci_sco1-13> ifconfig lo0lo0: flags=49<UP,LOOPBACK,RUNNING> inet 127.0.0.1 netmask ff000000</FONT></PRE><P>The preceding example shows that the Ethernet connection ec0 is active (UP), able to transmit broadcasts (BROADCAST), and is in debugging mode (DEBUG). Also, the ARP protocol is active (ARP). You may recall that a broadcast message is sent to all machines on the local network by setting the host ID address to all 1s.<BR><P>Once the ifconfig command has been run and an interface is active, many operating systems require the route command to be issued to add or remove routes in the kernel's routing table. This is needed to enable the local machine to find other machines. The general format of the route command on a UNIX or Linux system is this:<BR><BR><PRE><FONT COLOR=#000080>route add|del IP_Address</FONT></PRE><P>Either add or del is specified to add or remove the route from the kernel's routing table, and IP_Address is the remote route being affected.<BR><P>The current contents of the kernel's routing table can be displayed on some systems by entering the command route by itself on the command line. For example, on a Linux system that is set up only with the loopback driver, you see an output like this:<BR><PRE><FONT COLOR=#000080>$ route⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -