ping, traceroute, tcpdump, netstat, ss, nmap, lsof, iptables チートシート

## はじめに
RHEL7のネットワークコマンドのチートシートを発見した。

[Cheat sheet: Linux networking](https://opensource.com/downloads/cheat-sheet-networking)

## pingで死活監視
ping, ping6 - send ICMP ECHO_REQUEST to network hosts

```
# ping google.com
PING google.com (172.217.26.46) 56(84) bytes of data.
64 bytes from nrt12s17-in-f14.1e100.net (172.217.26.46): icmp_seq=1 ttl=55 time=16.7 ms
64 bytes from nrt12s17-in-f46.1e100.net (172.217.26.46): icmp_seq=2 ttl=55 time=16.9 ms
64 bytes from nrt12s17-in-f46.1e100.net (172.217.26.46): icmp_seq=3 ttl=55 time=16.6 ms
64 bytes from nrt12s17-in-f46.1e100.net (172.217.26.46): icmp_seq=4 ttl=55 time=16.8 ms
64 bytes from nrt12s17-in-f14.1e100.net (172.217.26.46): icmp_seq=5 ttl=55 time=16.7 ms
```

## tracerouteでネットワークの経路を調べる
traceroute - print the route packets trace to network host

```
# traceroute google.com
traceroute to google.com (172.217.27.78), 30 hops max, 60 byte packets
 1  gateway (153.126.200.1)  75.221 ms  75.223 ms  75.210 ms
 2  iskrt101b-rt125e.bb.sakura.ad.jp (103.10.114.209)  0.980 ms  0.987 ms iskrt102b-rt125e.bb.sakura.ad.jp (103.10.114.217)  0.978 ms
 3  iskrt1s-rt101b-1.bb.sakura.ad.jp (103.10.113.9)  0.967 ms iskrt1s-rt101b-2.bb.sakura.ad.jp (103.10.113.93)  0.962 ms iskrt2s-rt102b-1.bb.sakura.ad.jp (103.10.113.21)  0.943 ms
 4  iskrt3-rt1s.bb.sakura.ad.jp (103.10.113.109)  0.938 ms iskrt4-rt2s.bb.sakura.ad.jp (103.10.113.121)  0.930 ms iskrt4-rt1s.bb.sakura.ad.jp (103.10.113.117)  0.921 ms
 5  tkort4-iskrt3.bb.sakura.ad.jp (157.17.131.33)  26.273 ms tkert1-iskrt4.bb.sakura.ad.jp (157.17.131.37)  20.071 ms  20.077 ms
 6  tkort4-ert1.bb.sakura.ad.jp (157.17.130.113)  26.259 ms  25.333 ms as15169.ix.jpix.ad.jp (210.171.224.96)  16.513 ms
 7  as15169.ix.jpix.ad.jp (210.171.224.96)  18.323 ms 108.170.242.129 (108.170.242.129)  17.855 ms as15169.ix.jpix.ad.jp (210.171.224.96)  18.313 ms
 8  108.170.242.129 (108.170.242.129)  19.368 ms 108.170.236.7 (108.170.236.7)  16.781 ms 108.170.242.129 (108.170.242.129)  19.476 ms
 9  nrt12s15-in-f14.1e100.net (172.217.27.78)  16.918 ms 108.170.236.5 (108.170.236.5)  18.383 ms nrt12s15-in-f14.1e100.net (172.217.27.78)  16.721 ms
```

## tcpdumpでパケットキャプチャ
tcpdump - dump traffic on a network

```
# tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
23:46:03.435953 IP ik1-336-28385.vs.sakura.ne.jp.ssh > p790304a1.tubecm00.ap.so-net.ne.jp.53226: Flags [P.], seq 1688385275:1688385463, ack 2376062222, win 623, options [nop,nop,TS val 2886427956 ecr 882642228], length 188
```

## netstatでLISTEN状態のポートを調べる
netstat - Print network connections, routing tables, interface statistics, masquerade connections, and multicast memberships
※ RHEL7系では推奨されてないけど、つかう人は使う

```
# netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 0.0.0.0:pop3            0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:imap            0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:http            0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN
tcp        0      0 localhost:smtp          0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:imaps           0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:pop3s           0.0.0.0:*               LISTEN
tcp6       0      0 [::]:pop3               [::]:*                  LISTEN
```

```-l, --listening
Show only listening sockets.  (These are omitted by default.)```
LISTEN状態のソケットを表示する

## ssでLISTEN状態のポートを調べる
ss - another utility to investigate sockets

```
# ss -l
Netid  State      Recv-Q Send-Q Local Address:Port                 Peer Address:Port
nl     UNCONN     0      0      rtnl:ntpd/29827             *
nl     UNCONN     0      0      rtnl:-2034209599            *
nl     UNCONN     0      0      rtnl:-1719636799            *
nl     UNCONN     0      0      rtnl:kernel                 *
nl     UNCONN     0      0      rtnl:ntpd/29827             *
nl     UNCONN     0      0      rtnl:-1719636799            *
nl     UNCONN     4352   0      tcpdiag:ss/23344               *
nl     UNCONN     768    0      tcpdiag:kernel                 *
nl     UNCONN     0      0      xfrm:kernel                 *
```

```-l, --listening
              Display only listening sockets (these are omitted by default).```
LISTEN状態のソケットを表示する

## nmapでポートスキャン
nmap - Network exploration tool and security / port scanner

```
# nmap google.com

Starting Nmap 6.40 ( http://nmap.org ) at 2018-12-17 23:34 JST
Nmap scan report for google.com (172.217.161.46)
Host is up (0.017s latency).
rDNS record for 172.217.161.46: nrt12s23-in-f14.1e100.net
Not shown: 998 filtered ports
PORT    STATE SERVICE
80/tcp  open  http
443/tcp open  https

Nmap done: 1 IP address (1 host up) scanned in 4.23 seconds
```

## lsofで開いているポートを確認
lsof - list open files

```
# lsof -i:80
COMMAND   PID   USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
httpd   18587 apache    3u  IPv4 20317281      0t0  TCP *:http (LISTEN)
httpd   18588 apache    3u  IPv4 20317281      0t0  TCP *:http (LISTEN)
httpd   18589 apache    3u  IPv4 20317281      0t0  TCP *:http (LISTEN)
httpd   18590 apache    3u  IPv4 20317281      0t0  TCP *:http (LISTEN)
httpd   18591 apache    3u  IPv4 20317281      0t0  TCP *:http (LISTEN)
httpd   18908 apache    3u  IPv4 20317281      0t0  TCP *:http (LISTEN)
httpd   19477 apache    3u  IPv4 20317281      0t0  TCP *:http (LISTEN)
httpd   28361   root    3u  IPv4 20317281      0t0  TCP *:http (LISTEN)
```

```-i [i]   
selects  the  listing  of files any of whose Internet address matches the address specified in i.  If no address is specified, this option selects the listing of all Internet and x.25 (HP-UX) network files.```
開いているポートの確認

## iptablesでファイアウォールルールを確認
iptables/ip6tables -- administration tool for IPv4/IPv6 packet filtering and NAT

```
# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD_IN_ZONES (0 references)
```

```-L, --list [chain]
List  all rules in the selected chain.  If no chain is selected, all chains are listed. Like every other iptables command, it applies to the specified table (filter is the default), so NAT rules get listed by iptables -t nat -n -L```
ファイアウォールルールを表示する