kernel/git/shemminger/iproute2.git - Iproute2 routing commands and utilities
index : kernel/git/shemminger/iproute2.git Iproute2 routing commands and utilitiesStephen Hemminger aboutsummaryrefslogtreecommitdiffstats AgeCommit message (Expand)AuthorFilesLines 32 hoursman: fix small formatting errorsHEADmasterLuca Boccassi3-6/+4 4 daysman: routel/routef: don't mention filesystem pathsLuca Boccassi1-5/+0 4 daysman: ip-address: document 15-char limit for LABELLuca Boccassi1-0/
Task-centered iproute2 user guide
# Overview of iproute2 iproute2 is the Linux networking toolkit that replaced net-tools (ifconfig, vconfig, route, arp etc.). Most of the networking functionality is unified in the ip command. There’s also tc for managing traffic policies (QoS), and ss (a netstat replacement), but this document is focused on the ip part. iproute2 was originally written by Alex Kuznetsov and is now maintained by St
Linuxã§ãƒãƒ¼ãƒ‰ãƒãƒ©ãƒ³ã‚µã‚„ã‚ャッシュサーãƒã‚’マルãƒã‚³ã‚¢ã‚¹ã‚±ãƒ¼ãƒ«ã•ã›ã‚‹ãŸã‚ã®ã‚«ãƒ¼ãƒãƒ«ãƒãƒ¥ãƒ¼ãƒ‹ãƒ³ã‚° - ゆã†ã†ãブãƒã‚°
本記事ã®å…¬é–‹å¾Œã®2016å¹´7月ã«ã¯ã¦ãªã«ãŠã‘ã‚‹ãƒãƒ¥ãƒ¼ãƒ‹ãƒ³ã‚°äº‹ä¾‹ã‚’紹介ã—ãŸã€‚ ã¯ã¦ãªã«ãŠã‘ã‚‹Linuxãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¹ã‚¿ãƒƒã‚¯ãƒ‘フォーマンス改善 / Linux network performance improvement at hatena - Speaker Deck HAProxy ã‚„ nginx ãªã©ã®ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ãƒãƒ¼ãƒ‰ãƒãƒ©ãƒ³ã‚µã‚„リãƒãƒ¼ã‚¹ãƒ—ãƒã‚ã‚·ã€memcached ãªã©ã® KVS ã®ã‚ˆã†ãªé«˜ãƒ‘ケットレートã«ãªã‚Šã‚„ã™ã„ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¢ãƒ—リケーションã«ãŠã„ã¦ã€å˜ä¸€ã® CPU コアã«è² è·ãŒåã‚Šã€ãƒžãƒ«ãƒã‚³ã‚¢ã‚¹ã‚±ãƒ¼ãƒ«ã—ãªã„ã“ã¨ãŒã‚ã‚Šã¾ã™ã€‚ 今回ã¯ã€ã“ã®ã‚ˆã†ãªãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¢ãƒ—リケーションã«ãŠã„㦠CPU è² è·ãŒãƒžãƒ«ãƒã‚³ã‚¢ã‚¹ã‚±ãƒ¼ãƒ«ã—ãªã„ç†ç”±ã¨ã€ãƒžãƒ«ãƒã‚³ã‚¢ã‚¹ã‚±ãƒ¼ãƒ«ã•ã›ã‚‹ãŸã‚ã® Linux カーãƒãƒ«ã®ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¹ã‚¿ãƒƒã‚¯ã®ãƒãƒ¥ãƒ¼ãƒ‹ãƒ³ã‚°æ‰‹æ³•ã¨ã—㦠RFS (Receive Flow Steering) ã‚’
特殊用途å‘ã‘Linuxãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚° - 一æ±ä¸‰èœ
Linuxã§socketプãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ã§å‡ºæ¥ã‚‹äº‹ä»¥ä¸Šã‚’ã‚„ã‚ã†ã¨ã—ãŸæ™‚ã®ãƒã‚¤ãƒ³ã‚¿ã§ã™ã€‚Windowsã®å ´åˆã¯MSDNã‚’æ¼ã‚Œã°å‰²ã¨ãƒ‰ã‚ュメント化ã•ã‚Œã¦ã„ã‚‹ã®ã§åˆ†ã‹ã‚Šã‚„ã™ã„ã®ã§ã™ãŒã€Linuxã¯ãªã‹ãªã‹ä¸€ç®‡æ‰€ã«é›†ã¾ã£ãŸæƒ…å ±ãŒç„¡ã„ã®ã§ã€ã¡ã‚‡ã£ã¨ã¾ã¨ã‚ã¦ã¿ã¾ã—ãŸã€‚ ã¨ã¯ã„ãˆå¤§æŠµã®çŸ¥è˜ã¯ã€Unix Network Programming, Volume 1: The Sockets Networking API (Addison-Wesley Professional Computing Series)ã‚’èªã‚ã°æ‰‹ã«å…¥ã‚Šã¾ã™ã€‚ ã“れ以外ã«ã‚‚「ã“ã‚“ãªã“ã¨ã‚‚出æ¥ã‚‹ã‚ˆï¼ã€ã¨ã„ã†ã®ã‚’知ã£ã¦ã„ã‚‹æ–¹ãŒã„らã£ã—ゃã„ã¾ã—ãŸã‚‰ã€ã‚³ãƒ¡ãƒ³ãƒˆæ¬„やブコメã§ã”指摘ã„ãŸã ã‘ã‚‹ã¨å¬‰ã—ã„ã§ã™ã€‚ 基本的ã«ã€ 特殊ãªã‚½ã‚±ãƒƒãƒˆ getsockopt / setsockopt ioctl /proc, /sys ã®ã©ã‚Œã‹ã‚’使ã†ã“ã¨ã«ãªã‚Šã¾ã™ã®ã§
Your Docker image may be broken and you don't even know it
YOUR DOCKER IMAGE MIGHT BE BROKEN without you knowing it Learn the right way to build your Dockerfile. You learned about Docker. It's awesome and you're excited. You go and create a Dockerfile: FROM ubuntu:16.04 RUN apt-get install all_my_dependencies ADD my_app_files /my_app CMD ["/my_app/start.sh"] Cool, it seems to work. Pretty easy, right? Not so fast. You just built a container which contains
GRE bridging, IPsec and NFQUEUE « \1
Lots of stuff, apparently unrelated, but it all came together recently, so here it is. Probably the whole thing is useless, but along the way I found many interesting things. The network topology used for this experiment is as follows: The initial task was trying to find a way to bridge site A and site B using IPsec (for starters, something that's not terribly useful; and yes, I know that there ar
iptables example
gistfile1.sh ` ��]U �� �]U :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :LOG_PINGDEATH - [0:0] -A INPUT -i lo -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -f -j LOG --log-prefix "[IPTABLES FRAGMENT] : " -A INPUT -f -j DROP -A INPUT -p icmp -m icmp --icmp-type 8 -j LOG_PINGDEATH -A INPUT -d 255.255.255.255 -j DROP -A INPUT -d 224.0.0.1 -j DROP -A INPUT -p
インターãƒãƒƒãƒˆã«å…¬é–‹ã™ã‚‹ã‚µãƒ¼ãƒãƒ¼ã®åŸºæœ¬çš„ãªã‚»ã‚ュリティè¨å®š | 774::Blog
定期的ã«ã“ã†ã„ã†å†…容を書ã„ã¦å…¬é–‹ã—ã¦ã„ã‚‹æ°—ãŒã™ã‚‹ã€‚昔ã®è¨˜äº‹ã‚‚ã‚ã‚‹ã®ã§ãã¡ã‚‰ã‚’èªã‚ã°ã„ã„ã®ã ãŒã€ã¾ãŸæ›¸ãå¿…è¦æ€§ãŒç”Ÿã˜ã¦ããŸã®ã§ã‚らãŸã‚ã¦æ›¸ãã¾ã™ã€‚ ç¾ä»£ã§ã¯ AWS ã®ã‚ˆã†ãªã‚¯ãƒ©ã‚¦ãƒ‰ã‚„ VPS ãªã©æ ¼å®‰ã§æ‰‹è»½ã«ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆä¸Šã«ã‚µãƒ¼ãƒãƒ¼ã‚’æŒã¦ã‚‹ã‚ˆã†ã«ãªã£ãŸã€‚ã—ã‹ã—インターãƒãƒƒãƒˆã§èª°ã§ã‚‚アクセスã§ãる環境ã§ã‚µãƒ¼ãƒãƒ¼ã‚’稼åƒã•ã›ã‚‹ã¨ã„ã†ã“ã¨ã¯ã€å¸¸ã«äººé–“ã‚„ãƒãƒœãƒƒãƒˆã®æ”»æ’ƒã«æ™’ã•ã‚Œã‚‹ã¨ã„ã†ã“ã¨ã‚’åŒæ™‚ã«æ„味ã—ã¦ã„る。ã—ãŸãŒã£ã¦åˆå¿ƒè€…ã ã‹ã‚‰ã ã¨ã‹ã€ä¼šç¤¾ã®ä¸ã§ã¯ã“ã†ã‚„ã£ã¦ä»•äº‹ã‚’ã—ã¦ã„ã‚‹ã‹ã‚‰ã¨ã„ã£ãŸè¨€ã„訳ã¯ä¸€åˆ‡é€šç”¨ã—ãªã„。セã‚ュリティè¨å®šã‚’ãã¡ã‚“ã¨ã—ãªã‘ã‚Œã°å†…部ã¸ã®ä¾µå…¥ã‚’ãŸã‚„ã™ã許ã—ã€æ€ã‚ã¬ãƒ‡ãƒ¼ã‚¿ã®æ¼æ´©ã«ã¤ãªãŒã‚‹ã®ã§ã‚る。ã¨ã¯ã„ãˆã‚»ã‚ュリティã¨ã„ã†ã®ã¯ãƒˆãƒ¬ãƒ¼ãƒ‰ã‚ªãƒ•ã‚’考慮ã—ãªã‘ã‚Œã°ã„ãらã§ã‚‚強化ã§ãã‚‹ã‚‚ã®ã§ã‚ã‚Šã‚リãŒãªã„。ã“ã“ã§ã¯æœ€ä½Žé™ã“ã‚Œã ã‘ã¯ã‚„ã£ã¦ãŠã“ã†ã¨ã„ã†ç¾å®Ÿçš„ãªè½ã¨ã—所をæ示ã—ã€äººã€…ã¸ã®å•“蒙をã¯ã‹ã‚‹ã‚‚ã®
Stray Penguin - Linux Memo (iptables)
éžå¸¸ã«å½¹ã«ç«‹ã¤ HOWTO ã«ã€ Oskar Andreasson ã® Iptables tutorial ãŒã‚る。日本語訳ãŒå˜åœ¨ã—ãªã‹ã£ãŸã®ã§ç¿»è¨³ã—㟠(2006/01 本家ã«ã‚‚掲載ã•ã‚Œã¾ã—㟠- Thank you, Oskar !)。 iptables ã¯ã€ã‚«ãƒ¼ãƒãƒ«ãŒåˆ©ç”¨ã™ã‚‹IPパケットフィルタã®ãƒ«ãƒ¼ãƒ«ã‚’ã€æ“作ã™ã‚‹ãŸã‚ã®ãƒ¦ãƒ¼ãƒ†ã‚£ãƒªãƒ†ã‚£ã€‚カーãƒãƒ«ãã®ã‚‚ã®ã¨å¯†æŽ¥ã«é–¢ä¿‚ã—ã¦ãŠã‚Šã€kernel-2.2 ã§ã¯ ipchains ãŒä½¿ã‚ã‚Œã¦ã„ãŸã€‚kernel-2.4 以é™ã€ iptables ãŒæ¨™æº–ã¨ãªã‚‹ã€‚ipchains ã¨ã¯æ¯”ã¹ã‚‚ã®ã«ãªã‚‰ãªã„ã»ã©ã€è†¨å¤§ãªç¨®é¡žã®æ“作オプションãŒç”¨æ„ã•ã‚Œã¦ã„る。ipchains ã¨ã®æœ€ã‚‚大ããªé•ã„ã¯ã€ãƒ‘ケットを既å˜ã®ã‚³ãƒã‚¯ã‚·ãƒ§ãƒ³ã¨ã®é–¢ä¿‚性ã«ã‚ˆã£ã¦è˜åˆ¥ã§ãる「コãƒã‚¯ã‚·ãƒ§ãƒ³ãƒˆãƒ©ãƒƒã‚ング (接続追跡)〠ã¨ã„ã†ãƒ¡ã‚«ãƒ‹ã‚ºãƒ を実装ã—ã¦ã„ã‚‹ã“ã¨ã€‚ã“ã® conntrack æ©Ÿ
Stray Penguin - Linux Memo (Iptables tutorial)
ã“ã®ã‚µã‚¤ãƒˆã¯ã€ã‚‚ã¨ã‚‚ã¨ä½œè€…ã®è‡ªåˆ†ç”¨ãƒ¡ãƒ¢ã¨ã—ã¦æ›¸ã始ã‚ãŸã‚‚ã®ã§ã™ã€‚書ã„ã¦ã‚ã‚‹ã“ã¨ãŒå…¨ã¦æ£ã—ã„ã¨ã¯é™ã‚Šã¾ã›ã‚“。他ã®æ–‡çŒ®ã€ã‚ªãƒ•ã‚£ã‚·ãƒ£ãƒ«ãªã‚µã‚¤ãƒˆã‚‚確èªã—ã¦ã€è‡ªå·±è²¬ä»»ã«ã¦åˆ©ç”¨ã—ã¦ãã ã•ã„。
ç±³CTERAã€Ext3互æ›ã§é«˜åº¦ãªã‚¹ãƒŠãƒƒãƒ—ショット機能をæŒã¤ãƒ•ã‚¡ã‚¤ãƒ«ã‚·ã‚¹ãƒ†ãƒ 「Next3ã€ã‚’公開 | OSDN Magazine
ç±³CTERA Networksã¯6月8日（米国時間）ã€ãƒ•ã‚¡ã‚¤ãƒ«ã‚·ã‚¹ãƒ†ãƒ 技術「Next3ã€ã‚’オープンソースã¨ã—ã¦å…¬é–‹ã—ãŸã€‚Linuxã§åºƒã採用ã•ã‚Œã¦ã„ã‚‹Ext3ã¨å®Œå…¨ãªäº’æ›æ€§ãŒã‚ã‚Šã€ã‚¹ãƒŠãƒƒãƒ—ショット機能ãªã©ã«ã‚ˆã‚ŠLinuxシステムã®ãƒ‡ãƒ¼ã‚¿ä¿è·ã‚’強化ã§ãã‚‹ã¨ã„ã†ã€‚ Next3ã¯ã€CTERAãŒè‡ªç¤¾ã‚¯ãƒ©ã‚¦ãƒ‰ã‚¹ãƒˆãƒ¬ãƒ¼ã‚¸ãƒ»ã‚¢ãƒ—ライアンス「CTERA C200ã€ãŠã‚ˆã³ã€ŒCTERA CloudPlugã€ã§æ載ã™ã‚‹ãƒ•ã‚¡ã‚¤ãƒ«ã‚·ã‚¹ãƒ†ãƒ 。Ext3をベースã¨ã—ã€ã‚¨ãƒ³ã‚¿ãƒ¼ãƒ—ライズレベルã®ã‚¹ãƒŠãƒƒãƒ—ショット機能をæä¾›ã™ã‚‹ã€‚ 軽é‡ã€ãƒ€ã‚¤ãƒŠãƒŸãƒƒã‚¯ãªã‚¹ãƒˆãƒ¬ãƒ¼ã‚¸ãƒ—ãƒãƒ“ジョニングã€æ‹¡å¼µæ€§ãªã©ã‚’特徴ã¨ã—ã€æ€§èƒ½ã«æ”¯éšœã‚’与ãˆã‚‹ã“ã¨ãªã複数ã®ã‚¹ãƒŠãƒƒãƒ—ショットを得るã“ã¨ãŒã§ãる。Ext3ã¨å®Œå…¨ãªäº’æ›æ€§ã‚’å‚™ãˆã¦ãŠã‚Šã€æ™‚刻を指定ã—ã¦ã®ãƒã‚¤ãƒ³ãƒˆã‚¤ãƒ³ã‚¿ã‚¤ãƒ ã§ã®å¾©æ—§ãŒå¯èƒ½ã¨ã„ã†ã€‚Linuxã®LVM（Logical Volume Manager）ã§ã¯é™
Selfkleptomaniac — CentOS 5.4ã§ã‚‚prelinkã¯Ruby-1.9.1ã®ãƒã‚¤ãƒŠãƒªã‚’ç ´å£Šã™ã‚‹ã€ã‹ã‚‚
Blogging is a disease: selfkleptomania, your normal condition. About GPG Public Key CentOS 5.4上ã§Ruby 1.9.1を使ã£ã¦ã„ã‚‹ã®ã ãŒã€ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã—ã¦ã—ã°ã‚‰ãã™ã‚‹ã¨ã“ã‚“ãªçŠ¶æ…‹ã«ãªã£ã¦ã‚¯ãƒ©ãƒƒã‚·ãƒ¥ã—ã¦ã—ã¾ã£ã¦ã„ãŸã€‚ $ ruby -v compile/should not be reached: compile.c:473 ã§ã€ã‚‚ã†ä¸€å›žruby-1.9.1ã‚’make installã™ã‚‹ã¨ä½•äº‹ã‚‚ãªãã¡ã‚ƒã‚“ã¨å‹•ä½œã™ã‚‹ã€‚ã¨ã„ã†ã“ã¨ã¯ã€rubyã®å®Ÿè¡Œãƒ•ã‚¡ã‚¤ãƒ«ãŒä½•ã‹ã—らãŠã‹ã—ãªã“ã¨ã«ãªã£ã¦ã„ã‚‹ã®ã§ã¯ãªã„ã‹ã€ã¨æ€ã£ã¦èª¿ã¹ã¦ã„ãŸã‚‰ã€ã¡ã‚‡ã£ã¨å‰ã«ã€ŒCentOS 4.7 ã§ã¯ prelink ㌠ruby 1.9.1 ã®ãƒã‚¤ãƒŠãƒªã‚’ç ´å£Šã™ã‚‹ã€ã¨ã„ã†ãƒšãƒ¼ã‚¸ã‚’ブックマークã—ã¦ã„ãŸã®ã‚’æ€ã„出ã—ãŸã€‚ ã¨ã„ã†ã‚ã‘ã§ã€/etc/
ï¼ IT：Fedora Coreã®éžå…¬å¼ãƒªãƒã‚¸ãƒˆãƒªã‚’yumã§åˆ©ç”¨ã™ã‚‹ã«ã¯
普段使ã£ã¦ã„ãªã„リãƒã‚¸ãƒˆãƒªã‚’一時的ã«yumã§åˆ©ç”¨ã™ã‚‹ã«ã¯ã§èª¬æ˜Žã—ãŸ--enablerepoオプション付ãã§yumコマンドを実行ã™ã‚‹ã¨ã€Fedora Core用ã®ãƒ‘ッケージを独自ã«ç”¨æ„ã—ã¦ã„るリãƒã‚¸ãƒˆãƒªã‚’å¿…è¦ãªã¨ãã«ã ã‘利用ã§ãる。 Fedora Core用ã®éžå…¬å¼ãƒªãƒã‚¸ãƒˆãƒªã¯ã€ä¸»ãªã‚‚ã®ã ã‘ã§ã‚‚ç´„10種類ã‚る。ã“れらを利用ã™ã‚‹ã«ã¯ã€æœ¬æ¥ã§ã‚ã‚Œã°å„リãƒã‚¸ãƒˆãƒªç”¨ã®å®šç¾©ãƒ•ã‚¡ã‚¤ãƒ«ã‚’作æˆã—ãªã‘ã‚Œã°ãªã‚‰ãªã„。The Unofficial Fedora FAQ（http://fedorafaq.yanbaru.dyndns.org/）ã§ã¯ã€ãれらã®å®šç¾©ãƒ•ã‚¡ã‚¤ãƒ«ã‚’ã¾ã¨ã‚ã¦é…布ã—ã¦ã„る。以下ã®ã‚³ãƒžãƒ³ãƒ‰ã§ã€ãã®ãƒ•ã‚¡ã‚¤ãƒ«ã‚’インストールã§ãる。
GREã¨ã‹ - kno1020ã®æ—¥è¨˜
IHANetを見ã¦ã€ ã‚ーã€ãã†ã„ãˆã°ã†ã¡ã®ä¼šç¤¾ã§BGPã¨ã‹å®Ÿéš›ã«å‹•ã‹ã™æ©Ÿä¼šã£ã¦ã¾ãšãªã„よãªãƒ¼ quaggaã£ã¦çµå±€ä½¿ã£ã¦ãªã„ 興味ã¯ã‚ã‚‹ã‘ã©IPv4ã‚‚IPv6も固定æŒã£ã¦ãªã„ã‚„ 知è˜è¶³ã‚ŠãªéŽãŽã¦è©°ã¾ã‚Šãㆠã¨ã‹æ€ã£ãŸã®ã§ã€è‡ªåˆ†ã§ã¡ã‚‡ã£ã¨è©¦ã—ã¦ã¿ãŸã€‚ã„ã‚„ã€ã¡ã‚‡ã£ã¨ã£ã¦ã„ã†ã®ã¯èªžå¼ŠãŒã‚る程度ã«ã¯æ™‚é–“ã‹ã‹ã£ãŸã‘ã©ãƒ»ãƒ»ãƒ»ã€‚ è©°ã¾ã£ãŸï¼ˆor 調ã¹ã‚‹å¿…è¦ãŒã‚ã£ãŸï¼‰ã¨ã“ã‚ GREã®IF用ã®Configã£ã¦ã©ã†æ›¸ãã®ï¼Ÿ GREã®IFã«IPv6アドレスãŒæŒ¯ã‚Œãªã„？ ã‚ã‚Œã€ãƒ«ãƒ¼ãƒ†ã‚£ãƒ³ã‚°ãƒ†ãƒ¼ãƒ–ルã‚ã‚‹ã®ã«ãƒ«ãƒ¼ãƒ†ã‚£ãƒ³ã‚°ã•ã‚Œãªã„？ ã¨ã„ã†ã“ã¨ã§é †ç•ªã«ã€‚CentOS5.3ã«ã€‚ 1.GREã®IF用ã®Config /etc/sysconfig/network-scripts/ifcfg-gre1 DEVICE=gre1 BOOTPROTO=none TYPE=GRE ONBOOT=yes MY_OUTER_IPADDR=
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
For readers of this blog
Basic iptables template for ordinary servers (both IPv4 and IPv6)
http://github.com/id774/scripts/blob/master/etc/iptables-deb
4.9. Routing Policy Database (RPDB)
10 iptables rules to help secure your Linux box | TechRepublic
The 67th Yokohama kernel reading party
{{#tags}}- {{label}}
{{/tags}}