实验目的：

1. 通过对链路层的抓包，了解网络结构及网关、路由的概念

实验场景：

10.49.4.65 和 10.49.4.64为同一个网段

实验步骤：

1. 在10.49.4.65上抓包

2. 从10.49.4.65上ping 10.4.4.64

抓包结果：

# tcpdump -i eth1 -e -nn host 10.49.4.64

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes

17:54:36.804406 00:13:72:65:65:e1 > 00:19:a9:3b:ec:00, ethertype IPv4 (0x0800), length 98: 10.49.4.65 > 10.49.4.64: ICMP echo request, id 35935, seq 1, length 64

17:54:36.805908 00:18:8b:2d:ef:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: arp who-has 10.49.4.65 tell 10.49.4.64

17:54:36.805927 00:13:72:65:65:e1 > 00:18:8b:2d:ef:79, ethertype ARP (0x0806), length 42: arp reply 10.49.4.65 is-at 00:13:72:65:65:e1

17:54:36.806013 00:18:8b:2d:ef:79 > 00:13:72:65:65:e1, ethertype IPv4 (0x0800), length 98: 10.49.4.64 > 10.49.4.65: ICMP echo reply, id 35935, seq 1, length 64

17:54:37.804893 00:13:72:65:65:e1 > 00:19:a9:3b:ec:00, ethertype IPv4 (0x0800), length 98: 10.49.4.65 > 10.49.4.64: ICMP echo request, id 35935, seq 2, length 64

17:54:37.805035 00:18:8b:2d:ef:79 > 00:13:72:65:65:e1, ethertype IPv4 (0x0800), length 98: 10.49.4.64 > 10.49.4.65: ICMP echo reply, id 35935, seq 2, length 64

17:54:38.805104 00:13:72:65:65:e1 > 00:19:a9:3b:ec:00, ethertype IPv4 (0x0800), length 98: 10.49.4.65 > 10.49.4.64: ICMP echo request, id 35935, seq 3, length 64

17:54:38.805209 00:18:8b:2d:ef:79 > 00:13:72:65:65:e1, ethertype IPv4 (0x0800), length 98: 10.49.4.64 > 10.49.4.65: ICMP echo reply, id 35935, seq 3, length 64

1

2

3

4

5

6

7

8

9

10

11

# tcpdump -i eth1 -e -nn host 10.49.4.64

tcpdump:verboseoutputsuppressed,use-vor-vvforfullprotocoldecode

listeningoneth1,link-typeEN10MB(Ethernet),capturesize96bytes

17:54:36.80440600:13:72:65:65:e1>00:19:a9:3b:ec:00,ethertypeIPv4(0x0800),length98:10.49.4.65>10.49.4.64:ICMPechorequest,id35935,seq1,length64

17:54:36.80590800:18:8b:2d:ef:79>ff:ff:ff:ff:ff:ff,ethertypeARP(0x0806),length60:arpwho-has10.49.4.65tell10.49.4.64

17:54:36.80592700:13:72:65:65:e1>00:18:8b:2d:ef:79,ethertypeARP(0x0806),length42:arpreply10.49.4.65is-at00:13:72:65:65:e1

17:54:36.80601300:18:8b:2d:ef:79>00:13:72:65:65:e1,ethertypeIPv4(0x0800),length98:10.49.4.64>10.49.4.65:ICMPechoreply,id35935,seq1,length64

17:54:37.80489300:13:72:65:65:e1>00:19:a9:3b:ec:00,ethertypeIPv4(0x0800),length98:10.49.4.65>10.49.4.64:ICMPechorequest,id35935,seq2,length64

17:54:37.80503500:18:8b:2d:ef:79>00:13:72:65:65:e1,ethertypeIPv4(0x0800),length98:10.49.4.64>10.49.4.65:ICMPechoreply,id35935,seq2,length64

17:54:38.80510400:13:72:65:65:e1>00:19:a9:3b:ec:00,ethertypeIPv4(0x0800),length98:10.49.4.65>10.49.4.64:ICMPechorequest,id35935,seq3,length64

17:54:38.80520900:18:8b:2d:ef:79>00:13:72:65:65:e1,ethertypeIPv4(0x0800),length98:10.49.4.64>10.49.4.65:ICMPechoreply,id35935,seq3,length64

分析：

1.  第一个数据包，数据首先从10.49.4.65发送给网关； 因为路由表中有如下设置(大写G标志为经过网关)：

10.49.0.0 10.49.1.1 255.255.0.0 UG 0 0 0 eth1

1

10.49.0.010.49.1.1255.255.0.0UG000eth1

(没有更精确匹配 10.49.4.64的路由了)

2. 10.49.4.64 上有如下路由配置(没有大写G，说明不需要经过网关)：

10.49.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth1

1

10.49.0.00.0.0.0255.255.0.0U000eth1

(没有更精确匹配 10.49.4.65的路由了)

所以10.49.4.64可以直接回包给10.49.4.65； 但是10.49.4.64不知道10.49.4.65的mac地址是多少，于是先发了一个广播(第二个数据包，arp类型的)，询问了一下； 10.49.4.65 回复了10.49.4.64的询问(第三个数据包，arp类型的)，然后10.49.4.64就给出了icmp的响应包(第四个数据包)

总结

1. 添加一条路由，网关和接口至少指定一个

2. 只有同一个局域网下，才可以不经过网关(网关基本是有至少两块网卡的，用来连接不同的网络)

3. 指定网关的时候一般不需要同时指定接口

添加路由示例

1. 经过网关

/sbin/route add -host 10.49.4.64 gw 10.49.1.1

1

/sbin/routeadd-host10.49.4.64gw10.49.1.1

2. 不经过网关

/sbin/route add -host 10.49.4.64 eth1

1

/sbin/routeadd-host10.49.4.64eth1