tencent cloud

TencentOS Server

DocumentaçãoTencentOS ServerUser GuideNetwork ConfigurationNetwork Diagnosis Guide

Network Diagnosis Guide

Baixar
Modo Foco
Tamanho da Fonte
Última atualização: 2026-10-19 17:22:50
Traduzido por IA

Testing Network Connectivity with the ping Command

In Linux, you can use the ping command to test network connectivity. This command sends ICMP requests to a specified IP address or domain name and displays information such as response time and packet loss rate. For example, to test network connectivity with www.example.com:
ping www.tencent.com
When the network connection is normal, the output example is as follows:
PING www.tencent.com.eo.dnse5.com (61.170.66.121) 56(84) bytes of data.
64 bytes from 61.170.66.121 (61.170.66.121): icmp_seq=1 ttl=50 time=10.3 ms
64 bytes from 61.170.66.121 (61.170.66.121): icmp_seq=2 ttl=50 time=10.1 ms
64 bytes from 61.170.66.121 (61.170.66.121): icmp_seq=3 ttl=50 time=9.77 ms
64 bytes from 61.170.66.121 (61.170.66.121): icmp_seq=4 ttl=50 time=10.1 ms
...
When the network connection is abnormal, the output example is as follows:
ping: www.example.com: Name or service not known
Or:
ping: connect: Network is unreachable

Tracing Network Paths with the traceroute Command

In Linux, you can use the traceroute command to trace the network path. This command displays the network path from the local host to the destination host, as well as information such as the IP address and response time of each router. For example, to trace the network path to www.example.com:
traceroute www.example.com
When the network connection is normal, the output example is as follows:
traceroute to www.example.com (172.217.6.196), 30 hops max, 60 byte packets
 1  gateway (192.168.1.1)  1.000 ms  1.000 ms  1.000 ms
 2  10.10.10.1 (10.10.10.1)  10.000 ms  10.000 ms  10.000 ms
 3  172.16.1.1 (172.16.1.1)  20.000 ms  20.000 ms  20.000 ms
 4  172.16.2.1 (172.16.2.1)  30.000 ms  30.000 ms  30.000 ms
 5  172.16.3.1 (172.16.3.1)  40.000 ms  40.000 ms  40.000 ms
 6  172.16.4.1 (172.16.4.1)  50.000 ms  50.000 ms  50.000 ms
......
When the network connection is abnormal, the output example is as follows:
traceroute to www.example.com (172.217.6.196), 30 hops max, 60 byte packets
1  gateway (192.168.1.1)  1.000 ms  1.000 ms  1.000 ms
2  * * *
3  * * *
4  * * *
5  * * *

Viewing Network Connection Status with the netstat Command

In Linux, you can use the netstat command to view network connection status. This command displays network connection information in the current system, including local IP addresses, remote IP addresses, and connection status. For example, to display network connection information in the current system:
netstat -a
When the network connection is normal, the output example is as follows:
Active Internet connections (servers and established) 
Proto Recv-Q Send-Q Local Address Foreign Address State 
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 
tcp 0 0 192.168.1.100:22 192.168.1.101:12345 ESTABLISHED 
tcp 0 0 192.168.1.100:22 192.168.1.102:54321 ESTABLISHED 
...
When the network connection is abnormal, the output example is as follows:
Active Internet connections (servers and established) 
Proto Recv-Q Send-Q Local Address Foreign Address State 
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 
tcp 0 1 192.168.1.100:22 192.168.1.101:12345 SYN_SENT 
tcp 0 0 192.168.1.100:22 192.168.1.102:54321 CLOSE_WAIT 
...
Note:
SYN_SENT: Indicates that a connection request has been sent but no response has been received from the peer, which usually means that the target is unreachable or the peer service is not started.
CLOSE_WAIT: A large accumulation usually indicates that the peer has closed the connection, while the local application has not closed the corresponding socket in time.
TIME_WAIT: A transitional state after a connection is closed normally. A small number of TIME_WAIT connections is a normal phenomenon and does not indicate a network abnormality.

Viewing Network Connection Status with the ss Command

ss (socket statistics) is a network connection monitoring and debugging tool in Linux. Compared with the traditional netstat command, ss offers better performance and information display.
Common commands are as follows:
Display all current connections:
ss
Netid  State    Recv-Q   Send-Q                    Local Address:Port           Peer Address:Port          Process
u_str  ESTAB    0        0           /run/systemd/journal/stdout 25077                     * 24218
u_str  ESTAB    0        0                                     * 20557                     * 592
u_dgr  ESTAB    0        0                                     * 23602                     * 13633
......
Display all TCP connections:
ss -t
Display all UDP connections:
ss -u
Display all listening sockets:
ss -l
Display all ESTABLISHED connections:
ss -t state established
Filter by multiple states (for example, connections that are established and closing):
ss -t state established state closing
Display process information. To view the corresponding process using a socket, use the -p option:
ss -t -p
Display more detailed information. Use the -e option to display extended information (such as sliding window size and packet loss statistics):
ss -t -e
Display socket summary statistics. Use the -s option to display socket summary statistics, such as TCP/UDP/RAW and connection counts:
ss -s
To view connections on a specific port, you can filter the output by using the grep command together with common filters. For example, to view all connections on port 80:
ss -t -a | grep ':80'
In daily network monitoring and troubleshooting, you can flexibly combine options based on actual needs. To view the complete list of options and detailed descriptions, see the man page for the ss command.

Querying and Controlling Network Device Drivers and Hardware Settings with ethtool

ethtool is a utility for querying and controlling network device drivers and hardware settings. If ethtool is not installed on the system, run the following command to install the software package.
dnf install ethtool
The following describes advanced ethtool features and hardware settings that are uncommon or irreplaceable in other network tools.

Querying and Configuring Network Device Speed, Duplex Mode, and Auto-Negotiation

Query and configure the network device speed, duplex mode, and auto-negotiation (using NIC ens18 as an example):
ethtool ens18 #Use NIC ens18 as an example
Output example:
Settings for ens18:   
    ......
	Speed: 1000Mb/s
	Duplex: Full
	Auto-negotiation: on
    ......
Modify the network device speed, duplex mode, and auto-negotiation settings:
ethtool -s ens18 speed 100 duplex full autoneg off

Traffic Control Settings

View the flow control settings of the network device.
ethtool -a ens18
Pause parameters for eno1:
Autonegotiate:	on
RX:		off
TX:		off
Modify the flow control settings of the network:
ethtool -A ens18 rx on tx off

Wake-on-LAN Feature Settings

Query the Wake-on-LAN feature of the network device:
ethtool ens18
Output example:
Settings for ens18:
	......
	Wake-on: g
	.....
Enable the Wake-on-LAN feature of the network device:
ethtool -s ens18 wol g
Disable the Wake-on-LAN feature of the network device:
ethtool -s ens18 wol d

Hardware Features of Network Devices

View the hardware features of the network device:
ethtool -k ens18
Output example:
Features for ens18:
rx-checksumming: on
tx-checksumming: on
	tx-checksum-ipv4: off [fixed]
	tx-checksum-ip-generic: on
	tx-checksum-ipv6: off [fixed]
......
Change the hardware features of the network device, such as enabling generic receive offload and generic segmentation offload:
ethtool -K ens18 tso on gso on

Statistics of Network Devices

View the statistics of the network device:
ethtool -S ens18
Output example:
NIC statistics:
     rx_packets: 399566
     tx_packets: 257685
     rx_bytes: 215936573
     tx_bytes: 55115699
     rx_broadcast: 9854
     tx_broadcast: 92
     ......

Network Device Self-Test

Run a self-test on the network device:
ethtool -t ens18
Output example:
The test result is PASS
The test extra info:
Register test  (offline)	 0
Eeprom test    (offline)	 0
Interrupt test (offline)	 0
Loopback test  (offline)	 0
Link test   (on/offline)	 0
If a fault occurs during the self-test, check the corresponding driver, firmware, and hardware based on the displayed error information to resolve the issue.

Diagnosing Network Issues with the tcpdump Command

tcpdump is a powerful network packet capture tool that can be used to capture network packets and display their contents. The following are common usage examples of tcpdump:

Capturing Packets by Destination Host

Use the following command to capture packets from a specific target host:
tcpdump -i eth0 host www.example.com
The -i parameter specifies the network interface to capture, and the host parameter specifies the target host to capture.
When the network connection is normal, the output example is as follows:
tcpdump -i eth0 src host 192.168.1.100 and dst host www.example.com
Output example:
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
14:23:45.678901 IP 192.168.1.100.12345 > 93.184.216.34.80: Flags [S], seq 123456789, win 65535, options [mss 1460,nop,nop,sackOK], length 0
14:23:45.789012 IP 93.184.216.34.80 > 192.168.1.100.12345: Flags [S.], seq 987654321, ack 123456790, win 65535, options [mss 1460,nop,nop,sackOK], length 0
14:23:45.890123 IP 192.168.1.100.12345 > 93.184.216.34.80: Flags [.], ack 1, win 65535, length 0
14:23:45.901234 IP 192.168.1.100.12345 > 93.184.216.34.80: Flags [P.], seq 1:101, ack 1, win 65535, length 100
14:23:46.012345 IP 93.184.216.34.80 > 192.168.1.100.12345: Flags [.], ack 101, win 65535, length 0
...
When the network connection is abnormal, the output example is as follows:
tcpdump -i eth0 src host 192.168.1.100 and dst host www.example.com
Output example:
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
14:23:45.678901 IP 192.168.1.100.12345 > 93.184.216.34.80: Flags [S], seq 123456789, win 65535, options [mss 1460,nop,nop,sackOK], length 0
14:23:45.789012 IP 93.184.216.34.80 > 192.168.1.100.12345: Flags [R.], seq 0, ack 123456790, win 0, length 0
The R flag indicates that the connection has been reset, which means there is a problem with the network connection.

Capturing Packets by Network Segment

Use the following command to capture packets from a specified network segment:
tcpdump -i eth0 net 192.168.1.0/24
This command captures only packets from the 192.168.1.0/24 network that pass through eth0.

Capturing Packets by Port

Use the following command to capture HTTP (port 80) traffic passing through eth0:
tcpdump -i eth0 port 80
You can replace 80 with another port number to monitor.

Capturing Packets by Protocol

Use the following command to capture icmp traffic:
tcpdump -i eth0 'icmp'
You can replace icmp with other protocols to monitor, such as tcp or udp.

Capturing DNS or DHCP Packets by Protocol and Port

DNS typically uses port 53 of the UDP protocol for requests. To capture DNS packets, run the following command:
tcpdump -i eth0 'udp port 53'
DHCP requests and responses typically use ports 67 and 68 of the UDP protocol for communication. To capture DHCP-related packets, run the following command:
tcpdump -i eth0 'udp port 67 or udp port 68'

Capturing Packets of the TCP Three-Way Handshake

You can use the following command to capture packets during the TCP three-way handshake (SYN, SYN-ACK, ACK):
tcpdump -i eth0 'tcp[tcpflags] & (tcp-syn|tcp-ack) != 0'
The -i parameter of this command specifies eth0 as the network interface to capture from, and the filter 'tcp[tcpflags] & (tcp-syn|tcp-ack) != 0' detects TCP packets with the SYN and ACK flags.

Limiting the Number of Captured Packets

Use the -c parameter to specify the number of packets to capture:
tcpdump -i eth0 -c 10
This command captures only the first 10 packets that pass through eth0.

Saving or Reading Packets

Save the captured packets to a .pcap file:
tcpdump -i eth0 -w output.pcap
Read packets from a .pcap file:
tcpdump -r output.pcap

Detecting IP Address and MAC Address Conflicts

An IP address conflict occurs when two or more devices on the same LAN are assigned the same IP address. This issue is typically caused by the following:
Incorrect static IP address configuration: An IP address conflict occurs when one or more devices are statically assigned the same IP address.
Dynamic Host Configuration Protocol (DHCP) issues: for example, multiple DHCP servers assign the same address.
An IP address conflict can cause the following issues:
It affects communication between devices, causing connection issues and packet loss.
Two devices on the same LAN cannot access the network at the same time.
The network speed decreases and performance degrades.
Use the arping command to check whether the IP addresses of other servers on the LAN have address conflicts:
arping -c 2 192.168.1.110
Output example:
ARPING 192.168.1.110
42 bytes from 02:99:96:xx:xx:xx (192.168.1.110): index=0 time=128.403 usec
42 bytes from 62:10:6d:xx:xx:xx (192.168.1.110): index=1 time=168.765 usec
This command sends two ARP requests to the specified IP address (-c 2 specifies sending twice). If a reply is received, the MAC address of the target device is displayed. By observing the response, you can determine whether multiple MAC addresses correspond to the same IP address. As shown above, 192.168.1.110 corresponds to two different MAC addresses, indicating an IP address conflict.
To check whether the IP address of a network interface on the current server has an address conflict, use the following command:
arping -I ens18 -D 192.168.1.110
Output example:
ARPING 192.168.1.110 from 0.0.0.0 ens18
Unicast reply from 192.168.1.110 [02:99:96:xx:xx:xx]  0.803ms
Sent 1 probes (1 broadcast(s))
Received 1 response(s)
In this example, ens18 is the network interface to check, and 192.168.1.110 is the IP address to check. If 1 response(s) is displayed in the response, it indicates that one device conflicts with this IP address, and the MAC address of the conflicting device is 02:99:96:xx:xx:xx. If 0 response(s) is returned, it indicates that there is no IP address conflict.

ARP Aging and Permanent Entries

The ARP aging time determines how long the mappings between IP addresses and MAC addresses are retained in the ARP cache. When an ARP entry has existed longer than the aging time, the system automatically removes the entry from the ARP cache to clear invalid or inactive address mappings and maintain the effectiveness and stability of the ARP cache. The default ARP aging time is 60 seconds.
sysctl net.ipv4.neigh.default.gc_stale_time
Output example:
net.ipv4.neigh.default.gc_stale_time = 60
Permanent ARP entries are created manually and are not affected by the ARP aging mechanism or automatically removed. This mechanism provides persistent address mappings for devices with stable IP addresses and MAC addresses, avoiding repeated ARP requests to obtain the same mapping.
In most scenarios, the default ARP aging settings are sufficient to meet network requirements. Permanent ARP entries should be used with caution in specific scenarios, and you must ensure that the IP addresses and MAC addresses of the corresponding devices do not change.
You can use the following command to view the current ARP cache:
arp -n
Output example:
Address                  HWtype  HWaddress           Flags Mask            Iface
192.168.1.111            ether   02:99:96:a7:27:43   CM                     ens18
192.168.2.1              ether   c2:fd:0b:bb:a6:9c   C                     ens19
192.168.1.1              ether   86:7a:1c:87:a8:35   C                     ens18
192.168.2.111            ether   02:1e:16:7d:cc:50   C                     ens19
The command output displays the mappings between IP addresses and MAC addresses and the status of ARP entries. In the Flags Mask field, C indicates that the entry is fully available, and M indicates a permanent entry in use.
If you find that an ARP entry has an incorrect mapping because it was mistakenly configured as a permanent entry, or if you need to obtain the mapping between an IP address and a MAC address again, use the following command to delete the ARP entry:
sudo arp -d 192.168.1.111
Here, 192.168.1.111 is the IP address of the device removed from the ARP cache.
To create a permanent entry, use the following command:
arp -s 192.168.1.111 02:99:96:xx:xx:xx
The preceding example creates a permanent ARP entry for IP address 192.168.1.111 and MAC address 02:99:96:xx:xx:xx.
After the creation is complete, you can use the arp -n command to view the ARP cache. The entry for this device is marked with M, indicating a permanent entry.

Anterior: NIC Bonding ConfigurationPróximo: Disk and Partition Management

Ajuda e Suporte

Esta página foi útil?

comentários

Search
    Enter keywords to search documentation