16hot 的博客

16hot 的博客 http://16hot.blog.isyi.com 16hot 一心想要建设一个公共平台给所有有需要的朋友使用。但是，在这里留给自己一块空间，抒发自己的心情。 16hot 2008-11-19T19:59:46Z Linux IPv6 HOWTO (4) http://16hot.blog.isyi.com/post/1/920 <pre>14.1 Red Hat Linux and "clones"(小紅帽和它的弟兄娣妹) 自從我開始寫 [33]IPv6 & Linux - HowTo.我打算設定一個持久的IPv6配置,包 含: host-only, router-only, dual-homed-host, router with second stub network, normal tunnels, 6to4 tunnels 和其它.現在我寫了一 個configuration and script files 這個script有自己的HOWTO: [34]IPv6-HOWTO/scripts/current. 夠運的是, Red Hat Linux 從 7.1 開始就 包含了這個script.多虧了Pekka Savola的幫助. 14.2 Mandrake(曼德萊克)Linux 從8.0後也包含了 IPv6-enabled initscript package但是有點小問 題("ifconfig" misses "inet6" before "add"). 支持IPv6的網路設定 scripts 測試 script library應該存在: ______________________________________________________________ /etc/sysconfig/network-scripts/network-functions-ipv6 ______________________________________________________________ 自動測試: ______________________________________________________________ # test -f /etc/sysconfig/network-scripts/network-functions -ipv6 && echo "Main ? IPv6 script library exists" ______________________________________________________________ library的版本很重要, 更高的版本包含了更多的功能.您可以通過這個檢視它: ______________________________________________________________ # source /etc/sysconfig/network-scripts/network-functions- ipv6 && ? getversion_ipv6_functions 20011124 ______________________________________________________________ Short hint for enabling IPv6 on current RHL 7.1, 7.2, 7.3, ...(一些小提示) * 檢視IPv6模組是否已經掛進系統. ______________________________________________________________ # modprobe -c | grep net-pf-10 alias net-pf-10 off ______________________________________________________________ * 如果是"off" 在 /etc/sysconfig/network 中加入IPv6的支持. ______________________________________________________________ NETWORKING_IPV6=yes ______________________________________________________________ * 重新初始網路: ______________________________________________________________ # service network restart ______________________________________________________________ * IPv6模組應該掛進來了: ______________________________________________________________ # modprobe -c | grep ipv6 alias net-pf-10 ipv6 ______________________________________________________________ 如果您提供路由廣告autoconfiguration 會自動為您設定, 更多的資訊請看 /usr/share/doc/initscripts-$version/sysconfig.txt. 14.3 SuSE(蘇澤斯)Linux 7.x 以上, 支持IPv6. 在/etc/rc.config 裡有更多的資訊. 因為不同的設定方 法和scripts結構, 所以不能將Red Hat Linux 當中的方法照搬過來. 更詳盡的資訊請看: [35]How to setup 6to4 IPv6 with SuSE 7.3 14.4 Debian(迪比安)Linux 參照: [36]IPv6 on Debian Linux 15. 防火牆 15.1 使用 netfilter6防火牆 netfilter6防火牆只支持2.4以上的核心.早期的2.2核心您只能用41號協議過 濾IPv6-in-IPv4. 警告: 按照例子那樣設定並不能真正地保護您的作業系統. 15.2 更多的資訊: * [37]Netfilter project * [38]maillist archive of netfilter users * [39]maillist archive of netfilter developers * [40]Unofficial status informations 15.3 準備 下載最新的核心: [41]http://www.kernel.org/ 下載最新的iptables: tar: [42]http://www.netfilter.org/ Source RPM for rebuild of binary (for RedHat systems): [43]ftp://ftp.redhat.com/redhat/linux/rawhide/SRPMS/SRPMS/ 解開源代碼 解開源代碼與更名 ______________________________________________________________ # tar z|jxf kernel-version.tar.gz|bz2 # mv linux linux-version-iptables-version+IPv6 ______________________________________________________________ 解開 iptables 源代碼 ______________________________________________________________ # tar z|jxf iptables-version.tar.gz|bz2 ______________________________________________________________ Apply pending patches ______________________________________________________________ # make pending-patches KERNEL_DIR=/path/to/src/linux-version-iptables- version/ ______________________________________________________________ Apply additional IPv6 related patches (still not in the vanilla kernel included) ______________________________________________________________ # make patch-o-matic KERNEL_DIR=/path/to/src/linux-version-iptables-ve rsion/ ______________________________________________________________ 在下面的選單中回答yes: * ah-esp.patch * masq-dynaddr.patch (only needed for systems with dynamic IP assigned WAN connections like PPP or PPPoE) * ipv6-agr.patch.ipv6 * ipv6-ports.patch.ipv6 * LOG.patch.ipv6 * REJECT.patch.ipv6 檢視IPv6括展: ______________________________________________________________ # make print-extensions Extensions found: IPv6:owner IPv6:limit IPv6:mac IPv6:multiport ______________________________________________________________ Configure, build and install new kernel(設定,編譯,安裝新的核心) 進入代碼目錄: ______________________________________________________________ # cd /path/to/src/linux-version-iptables-version/ ______________________________________________________________ 改變Makefile ______________________________________________________________ - EXTRAVERSION = + EXTRAVERSION = -iptables-version+IPv6-try ______________________________________________________________ 運行相關的設定:Run configure, enable IPv6 related ______________________________________________________________ Code maturity level options Prompt for development and/or incomplete code/drivers : yes Networking options Network packet filtering: yes The IPv6 protocol: module IPv6: Netfilter Configuration IP6 tables support: module All new options like following: limit match support: module MAC address match support: module Multiple port match support: module Owner match support: module netfilter MARK match support: module Aggregated address check: module Packet filtering: module REJECT target support: module LOG target support: module Packet mangling: module MARK target support: module ______________________________________________________________ 在系統的其它方面進行相應的修改. Rebuild and install binaries of iptables (打造一個新的iptables) 確定您的核心源代碼存在於: /usr/src/linux/ Rename older directory ______________________________________________________________ # mv /usr/src/linux /usr/src/linux.old ______________________________________________________________ Create a new softlink ______________________________________________________________ # ln /path/to/src/linux-version-iptables-version /usr/src/linux ______________________________________________________________ Rebuild SRPMS ______________________________________________________________ # rpm --rebuild /path/to/SRPMS/iptables-version-release.src.rpm ______________________________________________________________ Install new iptables packages (iptables + iptables-ipv6) 安裝新 的iptables * On RH 7.1 systems, 通常已經有一個更早的版本, therefore use "freshen" ______________________________________________________________ # rpm -Fhv /path/to/RPMS/cpu/iptables*-version-release.cpu.rpm ______________________________________________________________ * 如果沒有安裝,您就親自來吧: ______________________________________________________________ # rpm -ihv /path/to/RPMS/cpu/iptables*-version-release.cpu.rpm ______________________________________________________________ * 如果在RH6.2上安裝,要加上"--nodep": ______________________________________________________________ # rpm -ihv --nodep /path/to/RPMS/cpu/iptables*-version-release.cpu.rpm ______________________________________________________________ * 可能要為iptables加上一個softlink: ______________________________________________________________ # ln -s /lib/iptables/ /usr/lib/iptables ______________________________________________________________ 15.4 使用方法 檢視 將模組掛進來: ______________________________________________________________ # modprobe ip6_tables ______________________________________________________________ 檢視 ______________________________________________________________ # [ ! -f /proc/net/ip6_tables_names ] && echo "Current kernel doesn't support ? 'ip6tables' firewalling (IPv6)!" ______________________________________________________________ 15.5 使用ip6tables 16.3.2.1. List all IPv6 netfilter entries Short # ip6tables -L Extended # ip6tables -n -v --line-numbers -L List specified filter # ip6tables -n -v --line-numbers -L INPUT 加入一個日誌: # ip6tables --table filter --append INPUT -j LOG --log-prefix "INPUT:" ? --log-level 7 加入一個入站丟棄的條件: # ip6tables --table filter --append INPUT -j DROP 移除一個條件: # ip6tables --table filter --delete INPUT 1 允許 ICMPv6: Using older kernels (unpatched kernel 2.4.5 and iptables-1.2.2) no type can be specified 允許入站 ICMPv6 經過 tunnels # ip6tables -A INPUT -i sit+ -p icmpv6 -j ACCEPT 允許出站 ICMPv6 經過 tunnels # ip6tables -A OUTPUT -o sit+ -p icmpv6 -j ACCEPT Newer kernels allow specifying of ICMPv6 types: # ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT 限制Rate-limiting Because it can happen (author already saw it to times) that an ICMPv6 storm wil l raise up, you should use available rate limiting for at least ICMPv6 ruleset. In addition logging rules should also get rate limiting to prevent DoS attacks against syslog and storage of log file partition. An example for a rate limite d ICMPv6 looks like: # ip6tables -A INPUT --protocol icmpv6 --icmpv6-type echo-request -j ACCEPT --m atch limit --limit 30/minute 允許入站的 SSH Here an example is shown for a ruleset which allows incoming SSH connection fro m a specified IPv6 address 允許來自 3ffe:ffff:100::1/128 的 SSH 入站 # ip6tables -A INPUT -i sit+ -p tcp -s 3ffe:ffff:100::1/128 --sport 512:65535 ? --dport 22 -j ACCEPT 允許回應包Allow response packets (此刻 IPv6 連結追蹤不在 mainstream netfilter6 implemented 當中) # ip6tables -A OUTPUT -o sit+ -p tcp -d 3ffe:ffff:100::1/128 --dport 512:65535 ? --sport 22 ! --syn j ACCEPT 充許 tunneled IPv6-in-IPv4 Tto accept tunneled IPv6-in-IPv4 packets, 在IPv4 防火牆做相應的設定 firewall se tup relating to such packets, for example 充許 interface ppp0 的 IPv6-in-IPv4 入站 # iptables -A INPUT -i ppp0 -p ipv6 -j ACCEPT 充許 interface ppp0 的 IPv6-in-IPv4 出站 # iptables -A OUTPUT -o ppp0 -p ipv6 -j ACCEPT If you have only a static tunnel, you can specify the IPv4 addresses, too, like 充許來自 endpoint 1.2.3.4 的 IPv6-in-IPv4 通過 interface ppp0 入站 # iptables -A INPUT -i ppp0 -p ipv6 -s 1.2.3.4 -j ACCEPT 充許來自 endpoint 1.2.3.4 的 IPv6-in-IPv4 通過 interface ppp0 入站 # iptables -A OUTPUT -o ppp0 -p ipv6 -d 1.2.3.4 -j ACCEPT 16.3.2.10. Protection against incoming TCP connection requests 極力推薦! 出於安全考慮您應當加入一個阻止TCP 連結請求入站的條件 . Adapt "-i" op tion, if other interface names are in use! 阻止入站的 TCP 連結請求 # ip6tables -I INPUT -i sit+ -p tcp --syn -j DROP 在路由器後面阻止入站的 TCP 連結請求 # ip6tables -I FORWARD -i sit+ -p tcp --syn -j DROP 可能這些條件以經存在其它地方,但這是您想當然的想法.最好建一個包含很多條件的 scri pt 然後執行. 16.3.2.11.阻止入站的 UDP 連結請求 極力推薦! 提起過我的防火牆資訊可以控制出站 UDP/TCP 會話的端口. 所以如果您的本地 IPv6系統使用本地端口比如:從 32768 至 60999 您也可以像這樣過濾UDP連結 (直到連結 跟蹤正常工作) like: 阻止入站的 UDP 數據包 , 斬斷請求出站的回應數據包 # ip6tables -I INPUT -i sit+ -p udp ! --dport 32768:60999 -j DROP 在路由器上面阻止入站的 UDP 數據包轉寄到路由器後面的主機 ip6tables -I FORWARD -i sit+ -p udp ! --dport 32768:60999 -j DROP 實例: 下面這個實例是一個經典, 由 Happy netfilter6 ruleset 生成: ______________________________________________________________ # ip6tables -n -v -L Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 extIN all sit+ * ::/0 ::/0 4 384 intIN all eth0 * ::/0 ::/0 0 0 ACCEPT all * * ::1/128 ::1/128 0 0 ACCEPT all lo * ::/0 ::/0 0 0 LOG all * * ::/0 ::/0 ? LOG flags 0 level 7 prefix `INPUT-default:' 0 0 DROP all * * ::/0 ::/0 Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination ? 0 0 int2ext all eth0 sit+ ::/0 ::/0 0 0 ext2int all sit+ eth0 ::/0 ::/0 0 0 LOG all * * ::/0 ::/0 ? LOG flags 0 level 7 prefix `FORWARD-default:' 0 0 DROP all * * ::/0 ::/0 Chain OUTPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination ? 0 0 extOUT all * sit+ ::/0 ::/0 4 384 intOUT all * eth0 ::/0 ::/0 0 0 ACCEPT all * * ::1/128 ::1/128 0 0 ACCEPT all * lo ::/0 ::/0 0 0 LOG all * * ::/0 ::/0 ? LOG flags 0 level 7 prefix `OUTPUT-default:' 0 0 DROP all * * ::/0 ::/0 Chain ext2int (1 references) pkts bytes target prot opt in out source destination ? 0 0 ACCEPT icmpv6 * * ::/0 ::/0 0 0 ACCEPT tcp * * ::/0 ::/0 ? tcp spts:1:65535 dpts:1024:65535 flags:!0x16/0x02 0 0 LOG all * * ::/0 ::/0 ? LOG flags 0 level 7 prefix `ext2int-default:' 0 0 DROP tcp * * ::/0 ::/0 0 0 DROP udp * * ::/0 ::/0 0 0 DROP all * * ::/0 ::/0 Chain extIN (1 references) pkts bytes target prot opt in out source destination ? 0 0 ACCEPT tcp * * 3ffe:400:100::1/128 ::/0 ? tcp spts:512:65535 dpt:22 0 0 ACCEPT tcp * * 3ffe:400:100::2/128 ::/0 ? tcp spts:512:65535 dpt:22 0 0 ACCEPT icmpv6 * * ::/0 ::/0 0 0 ACCEPT tcp * * ::/0 ::/0 ? tcp spts:1:65535 dpts:1024:65535 flags:!0x16/0x02 0 0 ACCEPT udp * * ::/0 ::/0 ? udp spts:1:65535 dpts:1024:65535 0 0 LOG all * * ::/0 ::/0 ? limit: avg 5/min burst 5 LOG flags 0 level 7 prefix `extIN-default:' 0 0 DROP all * * ::/0 ::/0 Chain extOUT (1 references) pkts bytes target prot opt in out source destination ? 0 0 ACCEPT tcp * * ::/0 ? 3ffe:ffff:100::1/128tcp spt:22 dpts:512:65535 flags:!0x16/0x02 0 0 ACCEPT tcp * * ::/0 ? 3ffe:ffff:100::2/128tcp spt:22 dpts:512:65535 flags:!0x16/0x02 0 0 ACCEPT icmpv6 * * ::/0 ::/0 0 0 ACCEPT tcp * * ::/0 ::/0 ? tcp spts:1024:65535 dpts:1:65535 0 0 ACCEPT udp * * ::/0 ::/0 ? udp spts:1024:65535 dpts:1:65535 0 0 LOG all * * ::/0 ::/0 ? LOG flags 0 level 7 prefix `extOUT-default:' 0 0 DROP all * * ::/0 ::/0 Chain int2ext (1 references) pkts bytes target prot opt in out source destination ? 0 0 ACCEPT icmpv6 * * ::/0 ::/0 0 0 ACCEPT tcp * * ::/0 ::/0 ? tcp spts:1024:65535 dpts:1:65535 0 0 LOG all * * ::/0 ::/0 ? LOG flags 0 level 7 prefix `int2ext:' 0 0 DROP all * * ::/0 ::/0 0 0 LOG all * * ::/0 ::/0 ? LOG flags 0 level 7 prefix `int2ext-default:' 0 0 DROP tcp * * ::/0 ::/0 0 0 DROP udp * * ::/0 ::/0 0 0 DROP all * * ::/0 ::/0 Chain intIN (1 references) pkts bytes target prot opt in out source destination ? 0 0 ACCEPT all * * ::/0 ? fe80::/ffc0:: 4 384 ACCEPT all * * ::/0 ff02::/16 Chain intOUT (1 references) pkts bytes target prot opt in out source destination ? 0 0 ACCEPT all * * ::/0 ? fe80::/ffc0:: 4 384 ACCEPT all * * ::/0 ff02::/16 0 0 LOG all * * ::/0 ::/0 ? LOG flags 0 level 7 prefix `intOUT-default:' 0 0 DROP all * * ::/0 ::/0 ______________________________________________________________ 16. 安全 16.1 Access limitations 有許多服務使用 tcp_wrapper library 控制訪問.Below is described the use of tcp_wrapper 內容有待增加... 16.2 IPv6安全審核 目前沒有什麼較好的商業工具來進行 Legal issues 警告:您只能掃瞄自己的系統,不然,可能會觸及法律.開始之前,請檢察您要掃瞄 的IPv6目標地址兩次!. 16.3 Security auditing using IPv6-enabled netcat(使用適應IPv6的netcat) 關於IPv6-enabled netcat的詳細資訊請參照: [44] IPv6?status-apps/security-auditing 例子: ______________________________________________________________ # nc6 ::1 daytime 13 JUL 2002 11:22:22 CEST ______________________________________________________________ 16.4 Security auditing using IPv6-enabled nmap 全世界最為優秀的掃瞄程式之一.它的首頁: [45] http://www.insecure.org/nmap/ 從 3.10ALPHA1 的版本開始支持IPv6. 例子: ______________________________________________________________ # nmap -6 -sT ::1 Starting nmap V. 3.10ALPHA3 ( www.insecure.org/nmap/ ) Interesting ports on localhost6 (::1): (The 1600 ports scanned but not shown below are in state: closed) Port State Service 22/tcp open ssh 53/tcp open domain 515/tcp open printer 2401/tcp open cvspserver Nmap run completed -- 1 IP address (1 host up) scanned in 0.525 second s ______________________________________________________________ 16.5 Security auditing using IPv6-enabled strobe Strobe 同 NMap相比更不具靈活性,但已經有 IPv6-enabling patch (see IPv6?status-apps/security-auditing for more). Usage example: ______________________________________________________________ # ./strobe ::1 strobe 1.05 (c) 1995-1999 Julian Assange <proff@iq.org> . ::1 2401 unassigned unknown ::1 22 ssh Secure Shell - RSA encrypted rsh ::1 515 printer spooler (lpd) ::1 6010 unassigned unknown ::1 53 domain Domain Name Server ______________________________________________________________ 16.6 審核結果 如果審核結果同您的IPv6安全策略有出入, 請堵上檢測出的漏洞. 17. Encryption and Authentication(加密和認證) Support in kernel Currently missing in 2.4, perhaps in 2.5 (see below). There is an issue about keeping the Linux kernel source free of export/import-control-laws regarding encryption code. This is also one case why [46]FreeS/WAN project (IPv4 only IPsec) isn't still contained in vanilla source. Support in USAGI kernel The USAGI project has taken over in July 2001 the IPv6 enabled FreeS/WAN code from the [47]IABG / IPv6 Project and included in their kernel extensions, but still work in progress, means that not all IABG features are already working in USAGI extension. 17.1 用法 參照: [48]FreeS/WAN / Online documentation 18. 線上測試工具 內容有待增加... 歡迎提建議! * finger, nslookup, ping, traceroute, whois: [49]UK IPv6 Resource Centre / The test page * ping, traceroute, tracepath, 6bone registry, DNS: [50]JOIN / Testtools (German language only, but should be no problem for non German speakers) * traceroute6, whois: [51]IPng.nl 19. 其它資訊 19.1 線上資訊 加入IPv6 backbone骨幹網路 IPv6 test backbone: [52]6bone, [53]How to join 6bone 主要的註冊區域 * America: [54]ARIN [55]Ripe * Asia/Pacific: [56]APNIC * Latin America and Caribbea: [57]LACNIC Also a list of major (prefix length 35) allocations per local registry is available here: [58]Ripe NCC / IPv6 allocations Tunnel brokers * [59]Freenet6 Canada * [60]Hurricane Electric US backbone * [61]Centro Studi e Laboratory Telecomunicazioni Italy * [62]Wanadoo Belgium * [63]CERTNET-Nokia China * [64]Tunnelbroker Leipzig Germany - DialupUsers with dynamic IP's can get a fix IPv6 IP... * [65]Internet Initiative Japan Japan - with IPv6 native line service and IPv6 tunneling Service * [66]XS26 - Access to SixNetherland - with POPs in Slovak Republic, Czech Republic, Netherlands, Germany and Hungary. * [67]IPng Netherland Netherland - Intouch, SurfNet, AMS-IX, UUNet, Cistron, RIPE NCC and AT& T are connected at the AMS-IX. It is possible (there are requirements...) to get an static tunnel. * [68]UNINETT Norway - Pilot IPv6 Service (for Customers): tunnelbroker & address allocation * [69]NTT Europe [70]NTT Euroope United Kingdom - IPv6 Trial. IPv4 Tunnel and native IPv6 leased Line connections. POPs are located in London, UK Dusseldorf, Germany New Jersey, USA (East Coast) Cupertino, USA (West Coast) Tokyo, Japan * [71]ESnet USA - Energy Sciences Network: Tunnel Registry & Address Delegation for directly connected ESnet sites and ESnet collaborators. * [72]6REN USA - The 6ren initiative is being coordinated by the Energy Sciences Network (ESnet), the network for the Energy Research program of the US Dept. of Energy, located at the University of California's Lawrence Berkeley National Laboratory 更多的IPv6資訊: [73]ipv6-net.org 6to4 * [74]NSayer's 6to4 information * [75]RFC 3068 / An Anycast Prefix for 6to4 Relay Routers Latest news * [76]http://hs247.com/ name="hs247 / IPv6 news and information"> also homepage for #ipv6 channel on EFnet * [77]bofh.st / latest IPv6 news but currently Jan 2002 outdated..., also homepage for IPv6 channel on IRCnet * [78]ipv6-net.org German forum 有關協議的參考 * [79]HS247 / IPv6 RFC list Publishing the list of IPv6-related RFCs is beyond the scope of this document, but given URLs will lead you to such lists: * [80]IPng Standardization Status a little bit out-of-sync at the moment * [81]IPv6 Related Specifications on IPv6.org 目前與IPv6有關的草案: * [82]IP Version 6 ipv6 * [83]Next Generation Transitition * [84]Dynamic Host Configuration * [85]Domain Name System Extension * [86]Mobile IP mobileip 其它 * [87]Network Sorcery / IPv6, Internet Protocol version 6 IPv6 protocol header * [88]SWITCH IPv6 Pilot / References big list of IPv6 references maintained by Simon Leinen * [89]Advanced Network Management Laboratory / IPv6 Address Oracle shows you IPv6 addresses in detail 統計 * [90]IPv6 routing table history created by Gert Ding 19.2 更多的資訊 期待加入更多的內容,歡迎提建議! Linux related * [91]IPv6-HowTo for Linux by Peter Bieringer - Germany, and his * [92]Bieringer / IPv6 - software archive * [93]Linux+IPv6 status by Peter Bieringer Germany * [94]USAGI project Japan, and their * [95]USAGI project - software archive * [96]Gav's Linux IPv6 Page * [97]Project6 - IPv6 Networking For Linux Italy, and their * [98]Project6 - software archive 19.3 通信論壇 +------------------------------------------------------------------------------ ------------------------------------------------------------------------------- -------------------------------------------------------------+ | | | Focus Request e-mail address What to subscribe Maillist e-mail address Language Access through WWW | +------------------------------------------------------------------------------ ------------------------------------------------------------------------------- -------------------------------------------------------------+ | Linux kernel majordomo (at) oss.sgi.com netdev netdev (at) oss.sgi.com English http://oss.sgi.com/proj ects/netdev/archive/ | | networking | | including | | IPv6 | +------------------------------------------------------------------------------ ------------------------------------------------------------------------------- -------------------------------------------------------------+ | Linux and majordomo (at) linux-ipv6 linux-ipv6 (at) list.f00f.org English | | list.f00f.org | | IPv6 in (moderated) | | general (1) | +------------------------------------------------------------------------------ ------------------------------------------------------------------------------- -------------------------------------------------------------+ | Mobile IP majordomo (at) mipl (at) list.mipl. English http://www.mipl.mediapo li.com/mailinglist.html | | (v6) for list.mipl.mediapoli.com mipl mediapoli.com http://www.mipl.mediapo li.com/mail-archive/ | | Linux | | | +------------------------------------------------------------------------------ ------------------------------------------------------------------------------- -------------------------------------------------------------+ |Linux IPv6 usagi-users-ctl usagi-users English http://www.mipl.mediapo li.com/mailinglist.html | |users using (at) linux-ipv6.org (at) linux-ipv6.org http://www.mipl.mediapo li.com/mail-archive/ | |USAGI | |extension | +------------------------------------------------------------------------------ ------------------------------------------------------------------------------- -------------------------------------------------------------+ | | |IPv6 on Debian debian-ipv6 (at) English http://lists.debian.org /debian-ipv6/ | |Linux Web-based, see URL lists.debian.org | |Web-based | | | +------------------------------------------------------------------------------ ------------------------------------------------------------------------------- -------------------------------------------------------------+ | | |IPv6/6bone in majordomo (at) ipv6 (at) German/English http://www.join.uni-mue nster.de/JOIN/ipv6/texte-englisch/mailingliste.html | | Germany atlan.uni-muenster.de ipv6 uni-muenster.de http://www.join.uni-mue nster.de/local/majordomo/ipv6/ | | | +------------------------------------------------------------------------------ ------------------------------------------------------------------------------- -------------------------------------------------------------+ | | | 6bone majordomo (at) 6bone 6bone (at) English http://www.6bone.net/6b one_email.html | | isi.edu isi.edu http://ryouko.dgim.crc. ca/ipv6/ | | http://www.wcug.wwu.edu /lists/6bone/ | | | +------------------------------------------------------------------------------ ------------------------------------------------------------------------------- -------------------------------------------------------------+ | | |IPv6 majordomo (at) ipng ipng (at) English http://playground.sun.c om/pub/ipng/html/instructions.html | |discussions sunroof.eng.sun.com sunroof.eng.sun.com ftp://playground.sun.co m/pub/ipng/mail-archive/ | | http://www.wcug.wwu.edu /lists/ipng/ | +------------------------------------------------------------------------------ ------------------------------------------------------------------------------- -------------------------------------------------------------+ | | | IPv6 users majordomo (at) users users (at) ipv6.org English http://www.ipv6.org/mai ling-lists.html | | in general ipv6.org | | | +------------------------------------------------------------------------------ ------------------------------------------------------------------------------- -------------------------------------------------------------+ | | | Bugtracking of bugtraq-subscribe (at) bugtraq (at) English http://online.securityf ocus.com/popups/forums/bugtraq/intro.shtml | | Internet securityfocus.com securityfocus.com (moderated) http://online.securityf ocus.com/archive/1 | | applications (2) | | | +------------------------------------------------------------------------------ ------------------------------------------------------------------------------- -------------------------------------------------------------+ | | | IPv6 in general Web-based, see URL ipv6 (at) ipng.nl English http://mailman.ipng.nl/m ailman/listinfo/ipv6/ | | http://mailman.ipng.nl/p ipermail/ipv6/ | | | +------------------------------------------------------------------------------ ------------------------------------------------------------------------------- -------------------------------------------------------------+ | | | | | | | | | majordomo (at) majordomo (at) ipv6 ipv6 (at) mfa.eti.br Portuguese http://www.mfa.eti.br/li stas.html | | mfa.eti.br mfa.eti.br | | | +------------------------------------------------------------------------------ ------------------------------------------------------------------------------- -------------------------------------------------------------+ (1) recommended for common Linux & IPv6 issues. (2) very recommended if you provide server applications. 是不是有什麼遺漏? 歡迎你的建議! 這裡還有另一份清單: http://www.join.uni-muenster.de/JOIN/ipv6/texte-eng lisch/ipv6.infoquellen.html 有關的發行版 * [99]Polish(ed) Linux Distribution ("market leader" in containing IPv6 enabled packages) * [100]Red Hat Linux * [101]Pekka Savola's IPv6 packages Germany * [102]Debian Linux * [103]Craig Small's IPv6 information and status * [104]SuSE Linux * [105]Linux Mandrake 20. 歷史 x.y版本發佈在Internet上. x.y.z 表示正在進行的版本and only published as LyX file on CVS. Releases 0.x 0.31 2002-09-29/PB: Extend information in proc-filesystem entries 0.30 2002-09-27/PB: Add some maillists 0.29 2002-09-18/PB: Update statement about nmap (triggered by Fyodor) 0.28.1 2002-09-16/PB: Add note about ping6 to multicast addresses, add some labels 0.28 2002-08-17/PB: Fix broken LDP/CVS links, add info about Polish translation, add URL of the IPv6 Address Oracle 0.27 2002-08-10/PB: Some minor updates 0.26.2 2002-07-15/PB: Add information neighbor discovery, split of firewalling (got so me updates) and security into extra chapters 0.26.1 2002-07-13/PB: Update nmap/IPv6 information 0.26 2002-07-13/PB: Fill /proc-filesystem chapter, update DNS information about depr icated A6/DNAME, change P-t-P tunnel setup to use of "ip" only 0.25.2 2002-07-11/PB: Minor spelling fixes 0.25.1 2002-06-23/PB: Minor spelling and other fixes 0.25 2002-05-16/PB: Cosmetic fix for 2^{ }128, thanks to Jos□ Ab□lio Oliveira Mat os for help with LyX 0.24 2002-05-02/PB: Add entries in URL list, minor spelling fixes 0.23 2002-03-27/PB: Add entries in URL list and at maillists, add a label and minor information about IPv6 on RHL 0.22 2002-03-04/PB: Add info about 6to4 support in kernel series 2.2.x and add an en try in URL list and at maillists 0.21 2002-02-26/PB: Migrate next grammar checks submitted by John Ronan 0.20.4 2002-02-21/PB: Migrate more grammar checks submitted by John Ronan, add some ad ditional hints at DNS section 0.20.3 2002-02-12/PB: Migrate a minor grammar check patch submitted by John Ronan 0.20.2 2002-02-05/PB: Add mipl to maillist table 0.20.1 2002-01-31/PB: Add a hint how to generate 6to4 addresses 0.20 2002-01-30/PB: Add a hint about default route problem, some minor updates 0.19.2 2002-01-29/PB: Add many new URLs 0.19.1 2002-01-27/PB: Add some forgotten URLs 0.19 2002-01-25/PB: Add two German books, fix quote entinities in exported SGML code 0.18.2 2002-01-23/PB: Add a FAQ on the program chapter 0.18.1 2002-01-23/PB: Move "the end" to the end, add USAGI to maillists 0.18 2002-01-22/PB: Fix bugs in explanation of multicast address types 0.17.2 2002-01-22/PB: Cosmetic fix double existing text in history (at 0.16), move all credits to the end of the document 0.17.1 2002-01-20/PB: Add a reference, fix URL text in online-test-tools 0.17 2002-01-19/PB: Add some forgotten information and URLs about global IPv6 addres ses 0.16 2002-01-19/PB: Minor fixes, remove "bold" and "emphasize" formats on code lines , fix "too long unwrapped code lines" using selfmade utility, extend list of UR Ls. 0.15 2002-01-15/PB: Fix bug in addresstype/anycast, move content related credits to end of document 0.14 2002-01-14/PB: Minor review at all, new chapter "debugging", review "addresses" , spell checking, grammar checking (from beginning to 3.4.1) by Martin Krafft, add tcpdump examples, copy firewalling/netfilter6 from IPv6+Linux-HowTo, minor enhancements 0.13 2002-01-05/PB: Add example BIND9/host, move revision history to end of document , minor extensions 0.12 2002-01-03/PB: Merge review of David Ranch 0.11 2002-01-02/PB: Spell checking and merge review of Pekka Savola 0.10 2002-01-02/PB: First public release of chapter 1 References 1. http://www.bieringer.de/pb/ 2. http://www.linuxports.com/howto/intro_to_networking/ 3. http://rfc.net/rfc1884.html 4. http://rfc.net/rfc3056.html/ 5. http://rfc.net/rfc2893.html 6. http://rfc.net/rfc2373.html 7. http://standards.ieee.org/regauth/oui/tutorials/EUI64.html 8. http://rfc.net/rfc3041.html 9. ftp://ftp.ietf.org/internet-drafts/ 10. http://rfc.net/rfc1519.html 11. http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status-distributions.html 12. http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status-distributions.html 13. http://www.linuxdoc.org/HOWTO/Kernel-HOWTO.html 14. ftp://ftp.bieringer.de/pub/linux/IPv6/kernel 15. http://www.linux-ipv6.org/faq.html 16. http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status-kernel.html#transport 17. http://rfc.net/rfc1055.html 18. ftp://ftp.inr.ac.ru/ip-routing/ 19. http://rpmfind.net/linux/rpm2html/search.php?query=iproute 20. http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status-distributions.html 21. file://localhost/tmp/zh-sgmltools.21666/IPv6&Linux-CurrentStatus-Applications 22. http://www.bieringer.de/linux/IPv6/IPv6-HOWTO/IPv6-HOWTO-3.html 23. http://www.bieringer.de/linux/IPv6/IPv6-HOWTO/IPv6-HOWTO-4.html 24. http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status-apps.html#HTTP 25. http://[3ffe:400:100::1]/ 26. http://www.kame.net/ 27. http://rfc.net/rfc2893.html 28. http://rfc.net/rfc3056.html 29. http://rfc.net/rfc3056.html 30. http://www.kfu.com/~nsayer/6to4/ 31. http://www.faqs.org/rfcs/rfc3068.html 32. http://rfc.net/rfc2473.html 33. http://www.bieringer.de/linux/IPv6/ 34. http://www.bieringer.de/linux/IPv6/IPv6-HOWTO/scripts/current/ 35. http://www.feyrer.de/IPv6/SuSE73-IPv6+6to4-setup.html 36. http://people.debian.org/~csmall/ipv6/ 37. http://www.netfilter.org/ 38. http://lists.samba.org/pipermail/netfilter/ 39. http://lists.samba.org/pipermail/netfilter-devel/ 40. http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status-kernel.html#netfilter6 41. http://www.kernel.org/ 42. http://www.netfilter.org/ 43. ftp://ftp.redhat.com/redhat/linux/rawhide/SRPMS/SRPMS/ 44. http://www.bieringer.de/linux/IPv6/status/IPv6?status-apps.html#security-auditing 45. http://www.insecure.org/nmap/ 46. http://www.freeswan.org/ 47. http://www.ipv6.iabg.de/downloadframe/ 48. http://www.freeswan.org/doc.html 49. file://localhost/tmp/zh-sgmltools.21666/Linux-IPv6-HOWTO.txt.html 50. http://www.join.uni-muenster.de/lab/testtools.html 51. http://www.ipng.nl/ 52. http://www.6bone.net/6bone_hookup.html 53. http://www.6bone.net/6bone_hookup.html 54. http://www.arin.net/ 55. http://www.ripe.net/ 56. http://www.apnic.net/ 57. http://lacnic.org/ 58. http://www.ripe.net/ripencc/mem-services/registration/ipv6/ipv6allocs.html 59. http://www.freenet6.net/ 60. http://ipv6tb.he.net/ 61. https://carmen.cselt.it/ipv6tb/ 62. http://tunnel.be.wanadoo.com/ 63. http://tb.6test.edu.cn/ 64. http://joshua.informatik.uni-leipzig.de/ 65. http://www.iij.ad.jp/IPv6/index-e.html 66. http://www.xs26.net/ 67. http://www.ipng.nl/ 68. http://www.uninett.no/testnett/index.en.html 69. http://www.uk.v6.ntt.net/ 70. http://www.nttv6.net/ 71. http://www.es.net/hypertext/welcome/pr/ipv6.html 72. http://www.6ren.net/ 73. http://www.ipv6-net.de/ 74. http://www.kfu.com/~nsayer/6to4/ 75. http://www.faqs.org/rfcs/rfc3068.html 76. http://hs247.com/ 77. http://bofh.st/ipv6/ 78. http://www.ipv6-net.de/ 79. http://www.hs247.com/ipv6rfc.html 80. http://playground.sun.com/pub/ipng/html/specs/standards.html 81. http://www.ipv6.org/specs.html 82. http://www.ietf.org/ids.by.wg/ipv6.html 83. http://www.ietf.org/ids.by.wg/ngtrans.html 84. http://www.ietf.org/ids.by.wg/dhc.html 85. http://www.ietf.org/ids.by.wg/dnsext.html 86. http://www.ietf.org/ids.by.wg/mobileip.html 87. http://www.networksorcery.com/enp/protocol/ipv6.htm 88. http://www.switch.ch/lan/ipv6/references.html 89. http://steinbeck.ucs.indiana.edu:47401/ 90. http://www.space.net/~gert/RIPE/ 91. http://www.bieringer.de/linux/IPv6/ 92. ftp://ftp.bieringer.de/pub/linux/IPv6/ 93. http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status.html 94. http://www.linux-ipv6.org/ 95. ftp://ftp.linux-ipv6.org/pub/ 96. http://www.bugfactory.org/~gav/ipv6/ 97. http://project6.ferrara.linux.it/ 98. ftp://ftp.ferrara.linux.it/pub/project6/ 99. http://www.pld.org.pl/ 100. http://www.redhat.com/ 101. http://www.netcore.fi/pekkas/linux/ipv6/ 102. http://www.debian.org/ 103. http://people.debian.org/~csmall/ipv6/ 104. http://www.suse.com/ 105. http://www.linux-mandrake.com/ </pre> Linux 2008-09-14T04:53:08Z 16hot Linux IPv6 HOWTO (3) http://16hot.blog.isyi.com/post/1/919 <pre> conf/default/* Change the interface-specific default settings conf/all/* 改變所有 interface-specific 設定. 除了: "conf/all/forwarding" 它有不同的含義. conf/all/forwarding * Type: BOOLEAN 在兩個界面之間進行global IPv6 forwarding (數據包轉寄.) IPv6 當中您不能單獨控制一個設備的 forwarding (數據包轉寄). forwarding 的控制由IPv6-netfilter 完成. 當值為"0"時數據包轉寄的能力被關閉,數據包 不會離開各自的界面(包括物理/虛擬)比如 tunnel. 當值為"1"時數據包轉寄的 能力被開啟. conf/interface/* 改變單個界面的設定. 依據local forwarding 是 enabled 或 not. accept_ra * Type: BOOLEAN * 默認值: enabled if local forwarding is disabled. disabled if local forwarding is enabled. 接受IPv6路由廣告.並且根據得到的信息自動設定. accept_redirectsc * Type: BOOLEAN * Functional default: enabled if local forwarding is disabled. disabled if local forwarding is enabled. 接受IPv6路由器的重定向. autoconf * Type: BOOLEAN * Default: TRUE 設定本地連結地址使用L2硬體地址. 它依據界面的L2-MAC address自動產生一個 地址如:"fe80::201:23ff:fe45:6789" dad_transmits * Type: INTEGER * Default: 1 發送重複地址嗅探的總數. forwarding * Type: BOOLEAN * Default: FALSE if global forwarding is disabled (default), otherwise TRUE 設定主機/路由的interface-specific動作. 注意:推薦所有interface(界面)使用相同的設定.混合路由器/主機的想法真是難 得. * Value FALSE: By default, Host behaviour is assumed. This means: + IsRouter 標緻沒有在Neighbour Advertisements當中. + 當需要的時候就發送路由請求. + 如果accept_ra是TRUE (default), 接受路由廣告. + 如果accept_redirects 是 TRUE (default), 接受重定向. * Value TRUE: 如果具備本地forwarding(轉寄),路由器動作為假定.這和上面 的情況相反: + IsRouter 標緻存在於Neighbour Advertisements當中. + 不發送路由請求. + 忽略路由廣告. + 忽略重定向. hop_limit * Type: INTEGER * Default: 64 缺省hop限制. mtu * Type: INTEGER * Default: 1280 (IPv6 要求的最小值) 缺省最大傳輸單元. router_solicitation_delay * Type: INTEGER * Default: 1 在發送路由請求之前界面的等待時間(秒). router_solicitation_interval * Type: INTEGER * Default: 4 在每個路由請求之間的等待時間(秒). router_solicitations * Type: INTEGER * Default: 3 假定沒有路由的情況下發送的請求個數. neigh/default/* Change default settings for neighbor detection and some special global interval and threshold values: gc_thresh1 * Type: INTEGER * Default: 128 More to be filled. gc_thresh2 * Type: INTEGER * Default: 512 More to be filled. gc_thresh3 * Type: INTEGER * Default: 1024 芳鄰列印表大小的調節項. 如果您有許多界面,或路由表現反常試著增大數值. Or if a running Zebra (routing daemon) reports: ______________________________________________________________ ZEBRA: netlink-listen error: No buffer space available, type=RTM_NEWROUTE(24), seq=426, pid=0 ______________________________________________________________ gc_interval * Type: INTEGER * Default: 30 More to be filled. neigh/interface/* Change special settings per interface for neighbor detection. anycast_delay * Type: INTEGER * Default: 100 More to be filled. gc_stale_time * Type: INTEGER * Default: 60 More to be filled. proxy_qlen * Type: INTEGER * Default: 64 More to be filled. unres_qlen * Type: INTEGER * Default: 3 More to be filled. app_solicit * Type: INTEGER * Default: 0 More to be filled. locktime * Type: INTEGER * Default: 0 More to be filled. retrans_time * Type: INTEGER * Default: 100 More to be filled. base_reachable_time * Type: INTEGER * Default: 30 More to be filled. mcast_solicit * Type: INTEGER * Default: 3 More to be filled. ucast_solicit * Type: INTEGER * Default: 3 More to be filled. delay_first_probe_time * Type: INTEGER * Default: 5 More to be filled. proxy_delay * Type: INTEGER * Default: 80 More to be filled. route/* 設定global(全局)路由 flush Removed in newer kernel releases - more to be filled. gc_interval * Type: INTEGER * Default: 30 More to be filled. gc_thresh * Type: INTEGER * Default: 1024 More to be filled. mtu_expires * Type: INTEGER * Default: 600 More to be filled. gc_elasticity * Type: INTEGER * Default: 0 More to be filled. gc_min_interval * Type: INTEGER * Default: 5 More to be filled. gc_timeout * Type: INTEGER * Default: 60 More to be filled. min_adv_mss * Type: INTEGER * Default: 12 More to be filled. max_size * Type: INTEGER * Default: 4096 More to be filled. 11.4 IPv6-related entries in /proc/sys/net/ipv4/ 目前(直到IPv4全部成為核心模組),一些開關也可以為IPv6所使用. ip_* ip_local_port_range 也可以為IPv6使用. tcp_* 也可以為IPv6使用. ICMP_* 不能為IPv6使用. 激活 ICMPv6 比率限制 rate limting (極力推薦,因為它有抵 禦 ICMPv6 網路風暴的能力) netfilter-v6 rules must be used. 其它 不知道, 不能為IPv6使用吧. 11.5 IPv6-related entries in /proc/net/ 這個地方是只讀的, 您不能通過 "sysctl" 得到資訊,可以使用 "cat" if_inet6 每一行地址包含多個值. 這裡IPv6地址是用特殊的格式列印的,例子只列印環繞interface(界面)含義在下 面 ______________________________________________________________ # cat /proc/net/if_inet6 00000000000000000000000000000001 01 80 10 80 lo +------------------------------+ ++ ++ ++ ++ ++ | | | | | | 1 2 3 4 5 6 ______________________________________________________________ 1. 地址用32個不包含":"的十六進制列印. 2. 連結的設備數值(interface index)使用十六進制列印. 3. 前綴的長度使用十六進制列印. 4. Scope value (see kernel source " include/net/ipv6.h" and "net/ipv6/addrconf.c" for more) 5. Interface flags (see "include/linux/rtnetlink.h" and "net/ipv6/addrconf.c" for more) 6. 設備名. ipv6_route 每一行地址包含多個值. 這裡IPv6地址是用特殊的格式列印的,例子只列印環繞interface(界面)含義在下 面 ______________________________________________________________ # cat /proc/net/ipv6_route 00000000000000000000000000000000 00 00000000000000000000000000000000 00 +------------------------------+ ++ +------------------------------+ ++ | | | | 1 2 3 4 ? 00000000000000000000000000000000 ffffffff 00000001 00000001 00200200 lo ? +------------------------------+ +------+ +------+ +------+ +------+ ++ ? | | | | | | ? 5 6 7 8 9 10 ______________________________________________________________ 1. IPv6目標網路用32個不包含":"的十六進制列印. 2. IPv6prefix(前綴)的長度使用十六進制列印. 3. IPv6來源網路用32個不包含":"的十六進制列印. 4. IPv6來源prefix(前綴)的長度使用十六進制列印. 5. IPv6下一個hop(躍點)用32個不包含":"的十六進制列印. 6. Metric in hexadecimal 7. Reference counter 8. Use counter 9. Flags(標緻) 10.Device name sockstat6 每一行地址包含多個值. IPv6 sockets統計: ______________________________________________________________ # cat /proc/net/sockstat6 TCP6: inuse 7 UDP6: inuse 2 RAW6: inuse 1 FRAG6: inuse 0 memory 0 ______________________________________________________________ tcp6 To be filled. udp6 To be filled. igmp6 To be filled. raw6 To be filled. ip6_flowlabel To be filled. rt6_stats To be filled. snmp6 Type: One line per SNMP description and value SNMP statistics, can be retrieved via SNMP server and related MIB table by netw ork management software. ip6_tables_names Available netfilter6 tables 12. Netlink-Interface to kernel 內容有待增加... 這方面我沒什麼經驗... 13. 網路 debugging 13.1 Server socket binding(綁定) 13.2 Using "netstat" for server socket binding check 使用 "netstat" 是得到這些信息的捷徑. 使用選項: -nlptu 例子: ______________________________________________________________ # netstat -nlptu Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State ? PID/Program name tcp 0 0 0.0.0.0:32768 0.0.0.0:* LISTEN ? 1258/rpc.statd tcp 0 0 0.0.0.0:32769 0.0.0.0:* LISTEN ? 1502/rpc.mountd tcp 0 0 0.0.0.0:515 0.0.0.0:* LISTEN ? 22433/lpd Waiting tcp 0 0 1.2.3.1:139 0.0.0.0:* LISTEN ? 1746/smbd tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN ? 1230/portmap tcp 0 0 0.0.0.0:6000 0.0.0.0:* LISTEN ? 3551/X tcp 0 0 1.2.3.1:8081 0.0.0.0:* LISTEN ? 18735/junkbuster tcp 0 0 1.2.3.1:3128 0.0.0.0:* LISTEN ? 18822/(squid) tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN ? 30734/named tcp 0 0 ::ffff:1.2.3.1:993 :::* LISTEN ? 6742/xinetd-ipv6 tcp 0 0 :::13 :::* LISTEN ? 6742/xinetd-ipv6 tcp 0 0 ::ffff:1.2.3.1:143 :::* LISTEN ? 6742/xinetd-ipv6 tcp 0 0 :::53 :::* LISTEN ? 30734/named tcp 0 0 :::22 :::* LISTEN ? 1410/sshd tcp 0 0 :::6010 :::* LISTEN ? 13237/sshd udp 0 0 0.0.0.0:32768 0.0.0.0:* ? 1258/rpc.statd udp 0 0 0.0.0.0:2049 0.0.0.0:* ? - udp 0 0 0.0.0.0:32770 0.0.0.0:* ? 1502/rpc.mountd udp 0 0 0.0.0.0:32771 0.0.0.0:* ? - udp 0 0 1.2.3.1:137 0.0.0.0:* ? 1751/nmbd udp 0 0 0.0.0.0:137 0.0.0.0:* ? 1751/nmbd udp 0 0 1.2.3.1:138 0.0.0.0:* ? 1751/nmbd udp 0 0 0.0.0.0:138 0.0.0.0:* ? 1751/nmbd udp 0 0 0.0.0.0:33044 0.0.0.0:* ? 30734/named udp 0 0 1.2.3.1:53 0.0.0.0:* ? 30734/named udp 0 0 127.0.0.1:53 0.0.0.0:* ? 30734/named udp 0 0 0.0.0.0:67 0.0.0.0:* ? 1530/dhcpd udp 0 0 0.0.0.0:67 0.0.0.0:* ? 1530/dhcpd udp 0 0 0.0.0.0:32858 0.0.0.0:* ? 18822/(squid) udp 0 0 0.0.0.0:4827 0.0.0.0:* ? 18822/(squid) udp 0 0 0.0.0.0:111 0.0.0.0:* ? 1230/portmap udp 0 0 :::53 :::* ? 30734/named ______________________________________________________________ 13.3 Examples for tcpdump packet dumps 下面是一些被捕獲的數據包 ...下一次我會多弄一點來...: Router discovery(路由發現) Router advertisement ______________________________________________________________ 15:43:49.484751 fe80::212:34ff:fe12:3450 > ff02::1: icmp6: router ? advertisement(chlim=64, router_ltime=30, reachable_time=0, ? retrans_time=0)(prefix info: AR valid_ltime=30, preffered_ltime=20, ? prefix=2002:0102:0304:1::/64)(prefix info: LAR valid_ltime=2592000, ? preffered_ltime=604800, prefix=3ffe:ffff:0:1::/64)(src lladdr: ? 0:12:34:12:34:50) (len 88, hlim 255) ______________________________________________________________ 路由器使用link-local 地址 "fe80::212:34ff:fe12:3450" 發送廣告至 all-node-on-link multicast address "ff02::1" 在它自己的 layer 2 MAC 地址 "0:12:34:12:34:50"中, 包含兩個前綴2002:0102:0304:1::/64" (lifetime 30 s) 和 "3ffe:ffff:0:1::/64" (lifetime 2592000 s) Router solicitation(路由請求) ______________________________________________________________ 15:44:21.152646 fe80::212:34ff:fe12:3456 > ff02::2: icmp6: router solicitation ? (src lladdr: 0:12:34:12:34:56) (len 16, hlim 255) ______________________________________________________________ 擁有link-local地址 "fe80::212:34ff:fe12:3456" 和 layer 2 MAC 地址 "0:12:34:12:34:56"的節點尋找在線的路由器. 所以發送一個路由請求到所有 在線的路由器地址multicast address "ff02::2" Neighbor discovery(發現芳鄰) Neighbor discovery solicitation for duplicate address detection(對網路芳鄰當 中 "重複的地址" 進行檢查) 隨著數據包從layer 2 MAC 地址 "0:12:34:12:34:56" 發送出去的同時檢查是否 有節點用相同的地址發送數據包. Following packets are sent by a node with layer 2 MAC address "0:12:34:12:34:56" during autoconfiguration to check whether a potential address is already used by another node on the link sending this to the solicited-node link-local multicast address * 當節點將使用地址"fe80::212:34ff:fe12:3456"作為本地連結時檢查重複的 地址. ______________________________________________________________ 15:44:17.712338 :: > ff02::1:ff12:3456: icmp6: neighbor sol: who has ? fe80::212:34ff:fe12:3456(src lladdr: 0:12:34:12:34:56) (len 32, hlim 255) ______________________________________________________________ * 當節點將使用地址"2002:0102:0304:1:212:34ff:fe12:3456"作為global(全 局)連結時檢查重複的地址(得到上面的廣告之後). ______________________________________________________________ 15:44:21.905596 :: > ff02::1:ff12:3456: icmp6: neighbor s ol: who has ? 2002:0102:0304:1:212:34ff:fe12:3456(src lladdr: 0:12:34 :12:34:56) (len 32, ? hlim 255) ______________________________________________________________ * 當節點將使用地址"3ffe:ffff:0:1:212:34ff:fe12:3456" 作為global(全 局)連結時檢查重複的地址(得到上面的廣告之後). ______________________________________________________________ 15:44:22.304028 :: > ff02::1:ff12:3456: icmp6: neighbor s ol: who has ? 3ffe:ffff:0:1:212:34ff:fe12:3456(src lladdr: 0:12:34:12 :34:56) (len 32, hlim ? 255) ______________________________________________________________ Neighbor discovery solicitation for looking for host or gateway(查找一台主機 或閘道) * 節點想要發送數據包至"3ffe:ffff:0:1::10",但是沒有layer 2 MAC 的發送 地址,於是發送請求. ______________________________________________________________ 13:07:47.664538 2002:0102:0304:1:2e0:18ff:fe90:9205 > ff0 2::1:ff00:10: icmp6: ? neighbor sol: who has 3ffe:ffff:0:1::10(src lladdr: 0:e 0:18:90:92:5) (len 32, ? hlim 255) ______________________________________________________________ * 節點現在查找"fe80::10" ______________________________________________________________ 13:11:20.870070 fe80::2e0:18ff:fe90:9205 > ff02::1:ff00: 10: icmp6: neighbor ? sol: who has fe80::10(src lladdr: 0:e0:18:90:92:5) (le n 32, hlim 255) ______________________________________________________________ 14. Support for persistent IPv6 configuration in Linux distributions(在不同的發 行版中設定IPv6) </pre> Linux 2008-09-14T04:51:24Z 16hot Linux IPv6 HOWTO (2) http://16hot.blog.isyi.com/post/1/918 <pre># /sbin/route -A inet6 ______________________________________________________________ 例子:在同一個界面上不同的IPv6路由. ______________________________________________________________ # /sbin/ip -6 route show dev eth0 # /sbin/route -A inet6 |grep -w "eth0" 3ffe:ffff:0:f101 ::/64 :: UA 256 0 0 eth0 <- Interface route for global ? address fe80::/10 :: UA 256 0 0 eth0 <- Interface route for link-local ? address ff00::/8 :: UA 256 0 0 eth0 <- Interface route for all multicast ? addresses ::/0 :: UDA 256 0 0 eth0 <- Automatic default route ______________________________________________________________ 7.2 設定IPv6路由通過閘道 使用"ip" 使用方法: ______________________________________________________________ # /sbin/ip -6 route add <ipv6network>/<prefixlength> via <ipv6address> ? [dev <device>] ______________________________________________________________ 例子: ______________________________________________________________ # /sbin/ip -6 route add 2000::/3 via 3ffe:ffff:0:f101::1 ______________________________________________________________ 使用 "route" 使用方法: ______________________________________________________________ # /sbin/route -A inet6 add <ipv6network>/<prefixlength> gw ? <ipv6address> [dev <device>] ______________________________________________________________ 例子:為當前所有的(全局地址global addresses 2000::/3)址通過閘 道3ffe:ffff:0:f101::1 ______________________________________________________________ # /sbin/route -A inet6 add 2000::/3 gw 3ffe:ffff:0:f101::1 ______________________________________________________________ 7.3 移除 IPv6路由通過閘道 使用"ip" 使用方法: ______________________________________________________________ # /sbin/ip -6 route del <ipv6network>/<prefixlength> via <ipv6address> ? [dev <device>] ______________________________________________________________ 例子: ______________________________________________________________ # /sbin/ip -6 route del 2000::/3 via 3ffe:ffff:0:f101::1 ______________________________________________________________ 使用 "route" 使用方法: ______________________________________________________________ # /sbin/route -A inet6 del <network>/<prefixlength> [dev <device>] ______________________________________________________________ 例子:移除前所有的(全局地址global addresses 2000::/3)址通過閘 道3ffe:ffff:0:f101::1 ______________________________________________________________ # /sbin/route -A inet6 del 2000::/3 gw 3ffe:ffff:0:f101::1 ______________________________________________________________ 7.4 增加IPv6路由至interface(界面) 使用 "ip" 使用方法: ______________________________________________________________ # /sbin/ip -6 route add <ipv6network>/<prefixlength> dev <device> ? metric 1 ______________________________________________________________ 例子: ______________________________________________________________ # /sbin/ip -6 route add 2000::/3 dev eth0 metric 1 ______________________________________________________________ 使用 "route" 使用方法: ______________________________________________________________ # /sbin/route -A inet6 add <network>/<prefixlength> dev <device> ______________________________________________________________ 例子: ______________________________________________________________ # /sbin/route -A inet6 add 2000::/3 dev eth0 ______________________________________________________________ 7.5 從interface(界面)移除IPv6路由 使用 "ip" 使用方法: ______________________________________________________________ # /sbin/ip -6 route del <ipv6network>/<prefixlength> dev <device> ? metric 1 ______________________________________________________________ 例子: ______________________________________________________________ # /sbin/ip -6 route del 2000::/3 dev eth0 ______________________________________________________________ 使用 "route" 使用方法: ______________________________________________________________ # /sbin/route -A inet6 del <network>/<prefixlength> dev <device> ______________________________________________________________ 例子: ______________________________________________________________ # /sbin/route -A inet6 del 2000::/3 dev eth0 ______________________________________________________________ 7.6 FAQ for IPv6 routes(IPv6 路由的經常問答) Support of an IPv6 default route IPv6的一個方法是hierachical routing(分級路由).因此,分級當中最少需要一 個路由. 在目前的核心中有一些問題: Clients (not routing any packet!)沒有任何數據包被路由. Clinets 可以設定一個缺省的prefix "::/0"(前綴為 ::/0 的路由). ______________________________________________________________ # ip -6 route show | grep ^default default via fe80::212:34ff:fe12:3450 dev eth0 proto kernel metric 1024 expires ? 29sec mtu 1500 advmss 1440 ______________________________________________________________ Routers on packet forwarding (路由包轉寄) 目前主流的Linux核心(最少是 <=2.4.17) 不支持缺省路由. 您可以設定它們,但 在發送數據包時環繞會失敗. 所以,目前的缺省路由可以被設定成前綴 為"2000::/3"的 global (全局地址). USAGI 對這個有著良好的支持. 注意: 注意沒有地址篩選的邊緣路由器的缺省路由, 不然會有多餘的multicast 或 site-local 傳輸從邊緣溢出. 8. Neighbor Discovery(發現芳鄰) IPv6 的 Neighbor Discovery繼承了IPv4 的 ARP (Address Resolution Protocol地址解析協議). 您可以重新得到芳鄰的資訊. 並且可以編輯/刪除它. Neighbor detection(對芳鄰進行探測) 核心負責對探測成功的芳鄰進行追蹤. 您可以用 "ip" 來挖掘其中的信息. 8.1 Displaying neighbors using "ip" (用"ip"命令列印芳鄰) 使用以下的命令,您可以知道芳鄰的設定. ______________________________________________________________ # ip -6 neigh show [dev <device>] ______________________________________________________________ 下面的例子當中列印了一個芳鄰,它是一個可到達的路由器. ______________________________________________________________ # ip -6 neigh show fe80::201:23ff:fe45:6789 dev eth0 lladdr 00:01:23:45:67:89 router nud reachable ______________________________________________________________ 8.2 用 "ip" 對芳鄰的列印表進行處理 用以下的命令可以加入一個entry(列印項) ______________________________________________________________ # ip -6 neigh add <IPv6 address> lladdr <link-layer address> dev <device> ______________________________________________________________ 例子: ______________________________________________________________ # ip -6 neigh add fec0::1 lladdr 02:01:02:03:04:05 dev eth0 ______________________________________________________________ 用以下的命令可以移除一個entry(列印項) ______________________________________________________________ # ip -6 neigh del <IPv6 address> lladdr <link-layer address> dev <device> ______________________________________________________________ 例子: ______________________________________________________________ # ip -6 neigh del fec0::1 lladdr 02:01:02:03:04:05 dev eth0 ______________________________________________________________ 更高階的設定 "ip"工具非常強大, 但沒有足夠的幫助資訊. ______________________________________________________________ # ip -6 neigh help Usage: ip neigh { add | del | change | replace } { ADDR [ lladdr LLADDR ] [ nud { permanent | noarp | stale | reachable } ] | proxy ADDR } [ dev DEV ] ip neigh {show|flush} [ to PREFIX ] [ dev DEV ] [ nud STATE ] ______________________________________________________________ 有點像IPv4的列印, 如果您知道它的詳細用法,請幫我 send 一份過來. 9. Configuring IPv6-in-IPv4 tunnels(設定遂道) 9.1 遂道的類型 將IPv6數據包傳輸到IPv4連結不只有一種可能. Static point-to-point tunneling: 6bone (以點對點方式構建的遂道) IPv6和IPv4的遂道定義在 [27]RFC 2893 / Transition Mechanisms for IPv6 Hosts and Routers 必備條件: * 遂道另一端的IPv4地址必需是static(靜態的).global unique and reachable from the foreign tunnel endpoint * 您以經擁有的一個global IPv6 prefix(前綴),參照 6bone registry. * 有一個可以將您的IPv6 prefix 路由到本地端的外界tunnel端(通常需要進 行遠端操作) Automatically tunneling(遂道操作自動化) 當一個節點直接同另一個節點進行連結,在得到節點IPv4地址之前,節點就會執行 遂道操作自動化. 6to4-Tunneling(遂道操作) 它使用一個簡單的機制實行Tunneling(遂道操作) [28]RFC 3056 / Connection of IPv6 Domains via IPv4 Clouds. 每個節點的global unique IPv4 (唯一全 局地址)可以成為 6to4 tunnel 的終點(如果沒有IPv4防火牆限制通訊). 6to4-Tunneling(遂道操作)不是專用於一對一的遂道, 這個案例可以分開針 對upstream and downstream (上級和下級)的遂道操作. 同樣,一個特別的IPv6 地址會指出這個節點使用6to4-Tunnel同全世界的 IPv6 網路進行連結. Generation of 6to4 prefix(產生6to4的前綴). 6to4 的地址像下面這樣定義:(源自 [29]RFC 3056 / Connection of IPv6 Domains via IPv4 Clouds) ______________________________________________________________ __________________________________________________________________ | 3+13 | 32 | 16 | 64 bits | +---+------+-----------+--------+--------------------------------+ | FP+TLA | V4ADDR | SLA ID | Interface ID | | 0x2002 | | | | +---+------+-----------+--------+--------------------------------+ ______________________________________________________________ FP是global addresses(全局地址)的前綴. TLA是top level aggregator(最高層 集) V4ADDR是IPv4全局唯一地址((in hexadecimal notation). SLA是子網路標 緻(65536 local subnets possible). 這些前綴產生時的SLA 為"0000" 後綴是 "::1" 並分配到6to4 tunnel interface(界面). 6to4 upstream tunneling(上級遂道操作) 節點知道向哪裡發送含有IPv6數據包的IPv4數據包. 早期的6to4遂道,必需設定 一個專用的上級路由器接受這種操作. 參照 [30]NSayer's 6to4 information 裡的路由列印. 現在 6to4上級路由器可以使用anycast address 192.88.99.1 它由後台的路由協議控制. 參照 [31]RFC 3068 / An Anycast Prefix for 6to4 Relay Routers 6to4 downstream tunneling(下級遂道操作) The downstream (6bone -> your 6to4 enabled node) is not really fix and can vary from foreign host which originated packets were send to. There exist two possibilities: 它還沒有正式修正對數據包來源的確定, 存 在以下兩種可能: * 外部主機直接使用6to4把IPv6數據包發回給您. * 外部主機通過全球IPv6網路, 依靠動態路建立一個automatic tunnel 由 將IPv6數據包發回給您. Possible 6to4 traffic(6to4的幾種通訊方法) * 從 6to4 到 6to4: 通常在兩個 6to4 enabled 主機之間直接進行遂道操作 tunneled between the * 從 6to4 到 non-6to4: 通過上級遂道操作發送數據包. * 從 non-6to4 到 6to4: 通過下級遂道操作發送數據包. 9.2 列印現存的tunnels(遂道) 使用 "ip" 用法: ______________________________________________________________ # /sbin/ip -6 tunnel show [<device>] ______________________________________________________________ 例子: ______________________________________________________________ # /sbin/ip -6 tunnel show sit0: ipv6/ip remote any local any ttl 64 nopmtudisc sit1: ipv6/ip remote 195.226.187.50 local any ttl 64 ______________________________________________________________ 使用 "route" 用法: ______________________________________________________________ # /sbin/route -A inet6 ______________________________________________________________ 例子:只列印從sit0界面通過的遂道. ______________________________________________________________ # /sbin/route -A inet6 | grep "Wsit0W*$" ::/96 :: U 256 2 0 sit0 2002::/16 :: UA 256 0 0 sit0 2000::/3 ::193.113.58.75 UG 1 0 0 sit0 fe80::/10 :: UA 256 0 0 sit0 ff00::/8 :: UA 256 0 0 sit0 ______________________________________________________________ 9.3 Setup of point-to-point tunnel(設定點對點的遂道) 有3種方法可以加入/移除point-to-point tunnel Add point-to-point tunnels (加入) 使用 "ip" 目前針對少量tunnels的方法 設定tunnel device (它不會立既啟用.TTL必需指定, 因為初始值是0) ______________________________________________________________ # /sbin/ip tunnel add < device > mode sit ttl < ttldefault > remote ? < ipv4addressofforeigntunnel > local < ipv4addresslocal > ______________________________________________________________ 用法(這個例子中有三個遂道) ______________________________________________________________ # /sbin/ip tunnel add sit1 mode sit ttl <ttldefault> remote ? <ipv4addressofforeigntunnel1> local <ipv4addresslocal> # /sbin/ip set dev sit1 up # /sbin/ip -6 route add <prefixtoroute1> dev sit1 metric 1 # /sbin/ip tunnel add sit2 mode sit ttl <ttldefault> ? <ipv4addressofforeigntunnel2> local <ipv4addresslocal> # /sbin/ip set dev sit2 up # /sbin/ip -6 route add <prefixtoroute2> dev sit2 metric 1 # /sbin/ip tunnel add sit3 mode sit ttl <ttldefault> ? <ipv4addressofforeigntunnel3> local <ipv4addresslocal> # /sbin/ip set dev sit3 up # /sbin/ip -6 route add <prefixtoroute3> dev sit3 metric 1 ______________________________________________________________ 使用 "ifconfig" and "route" (deprecated) 不推薦一次就 Non Broadcast Multiple Access (NBMA)這麼多,因為您如果只想 關閉第一個但又要讓其它的繼續運行,有點難啊.只加一個是沒有問題的. ______________________________________________________________ # /sbin/ifconfig sit0 up # /sbin/ifconfig sit0 tunnel <ipv4addressofforeigntunnel1> # /sbin/ifconfig sit1 up # /sbin/route -A inet6 add <prefixtoroute1> dev sit1 # /sbin/ifconfig sit0 tunnel <ipv4addressofforeigntunnel2> # /sbin/ifconfig sit2 up # /sbin/route -A inet6 add <prefixtoroute2> dev sit2 # /sbin/ifconfig sit0 tunnel <ipv4addressofforeigntunnel3> # /sbin/ifconfig sit3 up # /sbin/route -A inet6 add <prefixtoroute3> dev sit3 ______________________________________________________________ 警告:這樣做有很大的風險, 因為任何人可以從Internet的任何地點使 用"automatic tunneling"同您進行連結.我不推薦您這樣做. 使用 "route" only 當然可以設定tunnel使用 Non Broadcast Multiple Access (NBMA)非多地址廣 播的方式這種方法可以一次就加入很多tunnel. 使用方法 (三個tunnel的基本 例子): ______________________________________________________________ # /sbin/ifconfig sit0 up # /sbin/route -A inet6 add <prefixtoroute1> gw ? ::<ipv4addressofforeigntunnel1> dev sit0 # /sbin/route -A inet6 add <prefixtoroute2> gw ? ::<ipv4addressofforeigntunnel2> dev sit0 # /sbin/route -A inet6 add <prefixtoroute3> gw ? ::<ipv4addressofforeigntunnel3> dev sit0 ______________________________________________________________ 警告:這樣做有很大的風險, 因為任何人可以從Internet的任何地點使 用"automatic tunneling"同您進行連結.我不推薦您這樣做. Removing point-to-point tunnels(移除遂道) 手工方式不經常使用,可以用scripts移除/重新設定IPv6tunnels 使用 "ip" 移除遂道設備的用法: ______________________________________________________________ # /sbin/ip tunnel del <device> ______________________________________________________________ Usage (三個tunnel的基本例子): ______________________________________________________________ # /sbin/ip -6 route del <prefixtoroute1> dev sit1 # /sbin/ip set sit1 down # /sbin/ip tunnel del sit1 # /sbin/ip -6 route del <prefixtoroute2> dev sit2 # /sbin/ip set sit2 down # /sbin/ip tunnel del sit2 # /sbin/ip -6 route del <prefixtoroute3> dev sit3 # /sbin/ip set sit3 down # /sbin/ip tunnel del sit3 ______________________________________________________________ 使用 "ifconfig" and "route" (因為不怎麼有趣所以不贊成這麼做) Usage (三個tunnel的基本例子):您必需反向移除它們, 也就是先建立的必需先 移除. ______________________________________________________________ # /sbin/route -A inet6 del <prefixtoroute3> dev sit3 # /sbin/ifconfig sit3 down # /sbin/route -A inet6 del <prefixtoroute2> dev sit2 # /sbin/ifconfig sit2 down # /sbin/route -A inet6 add <prefixtoroute1> dev sit1 # /sbin/ifconfig sit1 down # /sbin/ifconfig sit0 down ______________________________________________________________ 使用 "route" 移除IPv6路由. 使用方法 (三個tunnel的基本例子): ______________________________________________________________ # /sbin/route -A inet6 del <prefixtoroute1> gw ? ::<ipv4addressofforeigntunnel1> dev sit0 # /sbin/route -A inet6 del <prefixtoroute2> gw ? ::<ipv4addressofforeigntunnel2> dev sit0 # /sbin/route -A inet6 del <prefixtoroute3> gw ? ::<ipv4addressofforeigntunnel3> dev sit0 # /sbin/ifconfig sit0 down ______________________________________________________________ Numbered point-to-point tunnels(有限的點對點遂道) 有時需要設定一個point-to-point 遂道和IPv6地址, 但方法中只有第一 個(ifconfig+route - deprecated)和第三個(ip+route)可行. 在這些案例中您 可以加入一個IPv6地址到 tunnel interface(用於遂道操作的那個界面) 9.4 Setup of 6to4 tunnels (設定 IPv6至IPv4的遂道) 注意:6to4 tunnels 目前缺乏vanilla 2.2.x系列核心的支持. 同樣要注意的 是6to4地址的前綴長度是16 所有的 6to4 主機都在相同的第二層. Add a 6to4 tunnel(增加一個 6to4 遂道) 首先, 您必需用可路由的本地IPv4 global 地址來計算 6to4 的前綴. (如果您 的主機沒有可路由的本地IPv4 global 地址, 在閘道邊緣的NAT地址也行 in special cases NAT on border gateways is possible): 假定您的IPv4地址為: ______________________________________________________________ 1.2.3.4 ______________________________________________________________ 產生的6to4 prefix(前綴)為 : ______________________________________________________________ 2002:0102:0304:: ______________________________________________________________ 本地的 6to4 閘道需要手工設定後綴為"::1", 因此您的6to4地址就成為: ______________________________________________________________ 2002:0102:0304::1 ______________________________________________________________ 以下依據指定的IPv4地址產生6to4地址: ______________________________________________________________ ipv4="1.2.3.4"; printf "2002:%02x%02x:%02x%02x::1" `echo $ipv4 | tr "." " "` ______________________________________________________________ 目前有兩種方法可以設定6to4遂道 使用 "ip" 和專用的遂道設備. 這是被推薦的做法. 創建一個遂道設備. ______________________________________________________________ # /sbin/ip tunnel add tun6to4 mode sit remote any local <localipv4address> ______________________________________________________________ Bring interface up(激活它) ______________________________________________________________ # /sbin/ip link set dev tun6to4 up ______________________________________________________________ 將本地6to4地址加入到界面.(注意:它的前綴長度必需是16) ______________________________________________________________ # /sbin/ip -6 addr add <local6to4address>/16 dev tun6to4 ______________________________________________________________ 加入一個用all-6to4-routers IPv4 anycast 地址作為到達global IPv6 網路的 路由(缺省的路由) ______________________________________________________________ # /sbin/ip -6 route add 2000::/3 via ::192.88.99.1 dev tun6to4 metric 1 ______________________________________________________________ 使用 "ifconfig" and "route" and generic tunnel device "sit0" (不被推薦的做法) 不被推薦是因為tunnel device sit0 不支持特別的過慮器應用在每個設備上. Bring generic tunnel interface sit0 up(將界面sit0激活) ______________________________________________________________ # /sbin/ifconfig sit0 up ______________________________________________________________ Add local 6to4 address to interface(向界面添加本地 6to4 地址) ______________________________________________________________ # /sbin/ifconfig sit0 add <local6to4address>/16 ______________________________________________________________ 加入一個用all-6to4-relays IPv4 anycast地址作為到達global IPv6 網路的路 由(缺省的路由) ______________________________________________________________ # /sbin/route -A inet6 add 2000::/3 gw ::192.88.99.1 dev sit0 ______________________________________________________________ Remove a 6to4 tunnel(移除 6to4 遂道) 使用 "ip" and a 專用遂道設備 從dedicated tunnel device 移除所有路由 ______________________________________________________________ # /sbin/ip -6 route flush dev tun6to4 ______________________________________________________________ Shut down interface(關閉界面) ______________________________________________________________ # /sbin/ip link set dev tun6to4 down ______________________________________________________________ Remove created tunnel device(移除遂道設備) ______________________________________________________________ # /sbin/ip tunnel del tun6to4 ______________________________________________________________ 使用 "ifconfig" and "route" and generic tunnel device "sit0" (不被推薦的做法) 移除 6to4 界面上遂道的路由 ______________________________________________________________ # /sbin/route -A inet6 del 2000::/3 gw ::192.88.99.1 dev sit0 ______________________________________________________________ Remove local 6to4 address to interface(從界面移除本地 6to4 地址) ______________________________________________________________ # /sbin/ifconfig sit0 del <local6to4address>/16 ______________________________________________________________ 並閉 generic tunnel device (當心, 可能它還在使用當中) ______________________________________________________________ # /sbin/ifconfig sit0 down ______________________________________________________________ 10. 設定 IPv4-in-IPv6 遂道 這裡的內容會在將來添加,目前這種遂道處在試驗階段.參照: [32]RFC 2473 / Generic Packet Tunneling in IPv6 Specification 11. 核心設定 in /proc-filesystem 11.1 怎樣進入 /proc-filesystem 使用 "cat"和 "echo" 使用 "cat"和 "echo" 是進入 /proc-filesystem的最簡單方法. 但必需具備下 面幾個條件: * 在核心中打開 /proc-filesystem 支持, 在編譯的時候可以通過 CONFIG_PROC_FS=y 做到. * /proc-filesystem 已經掛進系統,可以用以下的方法測試: ______________________________________________________________ # mount | grep "type proc" none on /proc type proc (rw) ______________________________________________________________ * 您必需知道對/proc-filesystem 的各種操作. 通常/proc/sys/* 都是可寫的, 其它的都是只讀或只提供相關資訊. 得到一個值 可以使用 "cat" 得到一個值. ______________________________________________________________ # cat /proc/sys/net/ipv6/conf/all/forwarding 0 ______________________________________________________________ 設定一個值 可以使用 "echo" 設定一個值. ______________________________________________________________ # echo "1" >/proc/sys/net/ipv6/conf/all/forwarding ______________________________________________________________ 使用 "sysctl" 使用 "sysctl" 設定核心是當前流行的方法, 您也能用. 如果/proc-filesystem 沒有掛進來, 那麼您只可以訪問/proc/sys/* "sysctl"程式在"procps"安裝包中.(Red Hat Linux systems) sysctl-interface 需要在核心中進行激活, 在編譯的時候可以通過以下選項完 成: ______________________________________________________________ CONFIG_SYSCTL=y ______________________________________________________________ 設定一個值 A new value can be set (if entry is writable): ______________________________________________________________ # sysctl -w net.ipv6.conf.all.forwarding=1 net.ipv6.conf.all.forwarding = 1 ______________________________________________________________ 在 "=" 兩邊不能出現spaces符號,也不能像下面那樣一次設定多個值: ______________________________________________________________ # sysctl -w net.ipv4.ip_local_port_range="32768 61000" net.ipv4.ip_local_port_range = 32768 61000 ______________________________________________________________ 另外 sysctl使用 "/" 代替 "." 詳細資訊請看sysctl的manpage 提示:快速查找設定的資訊,可以聯合使用帶"-a"的grep. 11.2 /proc-filesystems 裡的數值類型. * BOOLEAN: simple a "0" (false) or a "1" (true) * INTEGER: an integer value, can be unsigned, too * more sophisticated lines with several values: sometimes a header line is displayed also, if not, have a look into the kernel source to retrieve information about the meaning of each value... 11.3 Entries in /proc/sys/net/ipv6/ </pre> Linux 2008-09-14T04:50:50Z 16hot Linux IPv6 HOWTO (1) http://16hot.blog.isyi.com/post/1/917 <pre>Author:Peter Bieringer pb@bieringer.de 譯者: 陳敏劍 expns@yahoo.com Revision Release 0.31 2002-09-29 Revised by: PB 翻譯日期: 2002-10-14 , 2002-11-19 第二次修正 _________________________________________________________________ Linux IPv6 HOWTO 的目地是回答在 Linux 作業系統上設定IPv6的基本/進階問 題.這份HOWTO為用戶在Linux作業系統上安裝,設定和使用IPv6提供足夠的資訊. _________________________________________________________________ 1. 概述 * 1.1 版本 * 1.2 版權,許可與其它 * 1.3 關於作者 * 1.4 聯繫 * 1.5 類別 * 1.6 版本, 歷史和打算 * 1.7 歷史 * 1.8 全部歷史 * 1.9 打算 * 1.10 翻譯 * 1.11 德語 * 1.12 其它的語系 * 1.13 波蘭版 * 1.14 中譯版 * 1.15 技術方面 * 1.16 代碼封裝 * 1.17 產生SGML * 1.18 2HTML版式的在線目錄(linking/anchors) * 1.19 專用的頁面 * 1.20 有多少個關於 Linux和IPv6 HOWTO的變動版本? * 1.21 Linux IPv6 FAQ/HOWTO (過時的) * 1.22 IPv6 & Linux - HowTo (正在維護當中) * 1.23 Linux IPv6 HOWTO (現在這份HOWTO) * 1.24 Long code line wrapping signal char * 1.25 Placeholders (佔位符) * 1.26 Commands in the shell(shell 裡的命令) * 1.27 使用這個HOWTO的必需條件 2. 什麼是IPv6? * 2.1 IPv6在Linux作業系統上的歷史 * 2.2 開始 * 2.3 其間 * 2.4 現在 * 2.5 將來 * 2.6 IPv6 的地址會是什麼樣 ? * 2.7 FAQ(基礎) 3. 地址的類型 * 3.1 沒有前綴的地址 * 3.2 網路部分,也叫做前綴 * 3.3 地址類型(主機) * 3.4 路由的前綴長度 4. 準備IPv6的運行系統 * 4.1 IPv6-ready kernel * 4.2 IPv6-ready 網路設定工具 * 4.3 IPv6-ready 測試/調式程式 * 4.4 IPv6-ready programs(能和IPv6協同工作的程式) * 4.5 IPv6-ready 客戶端程式 (selection) * 4.6 IPv6-ready server 程式 5. 設定interfaces(界面) * 5.1 不同的網路設備 * 5.2 Bringing interfaces up/down(設定界面的開/關) 6. 設定IPv6地址 * 6.1 列印當前的IPv6地址 * 6.2 增加一個IPv6地址 * 6.3 移除IPv6地址 7. 設定IPv6路由 * 7.1 列印現有的路由 * 7.2 設定IPv6路由通過閘道 * 7.3 移除 IPv6路由通過閘道 * 7.4 增加IPv6路由至interface(界面) * 7.5 從interface(界面)移除IPv6路由 * 7.6 FAQ for IPv6 routes(IPv6 路由的經常問答) 8. Neighbor Discovery(發現芳鄰) * 8.1 Displaying neighbors using "ip" (用"ip"命令列印芳鄰) * 8.2 用 "ip" 對芳鄰的列印表進行處理 9. Configuring IPv6-in-IPv4 tunnels(設定遂道) * 9.1 遂道的類型 * 9.2 列印現存的tunnels(遂道) * 9.3 Setup of point-to-point tunnel(設定點對點的遂道) * 9.4 Setup of 6to4 tunnels (設定 IPv6至IPv4的遂道) 10. 設定 IPv4-in-IPv6 遂道 11. 核心設定 in /proc-filesystem * 11.1 怎樣進入 /proc-filesystem * 11.2 /proc-filesystems 裡的數值類型. * 11.3 Entries in /proc/sys/net/ipv6/ * 11.4 IPv6-related entries in /proc/sys/net/ipv4/ * 11.5 IPv6-related entries in /proc/net/ 12. Netlink-Interface to kernel 13. 網路 debugging * 13.1 Server socket binding(綁定) * 13.2 Using "netstat" for server socket binding check * 13.3 Examples for tcpdump packet dumps 14. Support for persistent IPv6 configuration in Linux distributions(在不同的發 行版中設定IPv6) * 14.1 Red Hat Linux and "clones"(小紅帽和它的弟兄娣妹) * 14.2 Mandrake(曼德萊克)Linux * 14.3 SuSE(蘇澤斯)Linux * 14.4 Debian(迪比安)Linux 15. 防火牆 * 15.1 使用 netfilter6防火牆 * 15.2 更多的資訊: * 15.3 準備 * 15.4 使用方法 * 15.5 使用ip6tables 16. 安全 * 16.1 Access limitations * 16.2 IPv6安全審核 * 16.3 Security auditing using IPv6-enabled netcat(使用適應IPv6 的netcat) * 16.4 Security auditing using IPv6-enabled nmap * 16.5 Security auditing using IPv6-enabled strobe * 16.6 審核結果 17. Encryption and Authentication(加密和認證) * 17.1 用法 18. 線上測試工具 19. 其它資訊 * 19.1 線上資訊 * 19.2 更多的資訊 * 19.3 通信論壇 20. 歷史 _________________________________________________________________ 1. 概述 1.1 版本 Revision Release 0.31 2002-09-29 Revised by: PB See revision history for more Revision Release 0.30 2002-09-27 Revised by: PB See revision history for more Revision Release 0.29 2002-09-18 Revised by: PB 1.2 版權,許可與其它 版權所有: Peter Bieringer Copyright Written and Copyright (C) 2001-2002 by Peter Bieringer 1.1.2. License This Linux IPv6 HOWTO is published under GNU GPL version 2: The Linux IPv6 HOWTO, a guide how to configure and use IPv6 on Linux systems. Copyright (C) 2001-2002 Peter Bieringer This documentation is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Sof