linux下查看网卡是否是混杂模式及ifconfig命令

桃扇骨 2022-09-18 09:49 1212阅读 0赞

1使用**ifconfig命令可查看当前网卡是否设置为混杂模式**

\[zhaihf@localhost~\]$ ifconfig  
eth0      Linkencap:Ethernet  HWaddr 00:16:31:FF:A6:2E  
         inet addr:192.168.9.1  Bcast:192.168.9.255 Mask:255.255.255.0  
         **UPBROADCAST MULTICAST** MTU:1500  Metric:1  
         RX packets:0 errors:0 dropped:0 overruns:0 frame:0  
         TX packets:0 errors:0 dropped:0 overruns:0 carrier:0  
         collisions:0 txqueuelen:1000  
         RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)  
         Memory:98420000-98440000

eth1     Link encap:Ethernet  HWaddr 00:16:31:FF:A6:2F  
         inet addr:192.168.8.48  Bcast:192.168.8.255 Mask:255.255.255.0  
         inet6 addr: fe80::216:31ff:feff:a61f/64 Scope:Link  
         **UPBROADCAST RUNNING PROMISC MULTICAST** MTU:1500  Metric:1  
         RX packets:28011022 errors:0 dropped:0 overruns:0 frame:0  
         TX packets:18408510 errors:0 dropped:0 overruns:0 carrier:0  
         collisions:0 txqueuelen:1000  
         RX bytes:31733322503 (29.5 GiB)  TX bytes:21092798216 (19.6GiB)  
         Memory:98400000-98420000

lo       Link encap:Local Loopback  
         inet addr:127.0.0.1  Mask:255.0.0.0  
         inet6 addr: ::1/128 Scope:Host  
         UP LOOPBACK RUNNING  MTU:16436  Metric:1  
         RX packets:8873 errors:0 dropped:0 overruns:0 frame:0  
         TX packets:8873 errors:0 dropped:0 overruns:0 carrier:0  
         collisions:0 txqueuelen:0  
         RX bytes:3140421 (2.9 MiB)  TX bytes:3140421 (2.9 MiB)

usb0     Link encap:Ethernet  HWaddr 5E:F3:FC:E1:D2:19  
         inet addr:169.254.95.120  Bcast:169.254.95.255 Mask:255.255.255.0  
         inet6 addr: fe80::5cf3:fcff:fee1:d217/64 Scope:Link  
         UP BROADCAST RUNNING MULTICAST  MTU:1500 Metric:1  
          RXpackets:220031 errors:0 dropped:0 overruns:0 frame:0  
         TX packets:110230 errors:0 dropped:0 overruns:0 carrier:0  
         collisions:0 txqueuelen:1000  
         RX bytes:14862206 (14.1 MiB)  TX bytes:5251125 (5.0 MiB)

其中**UPBROADCAST RUNNING PROMISC MULTICAST**的**PROMISC**说明网卡eth1已经设置成混杂模式。

字段含义说明：  
eth0/eth1:           分别表示第一块网卡和第二块网卡；  
lo:                       表示回环测试接口，注意，这个虚拟的interface一定要存在！  
usb0:                  表示USB接口的网卡；  
Linkencap:         表示位于OSI物理层的名称，即连接类型Ethernet（以太网）  
HWaddr:             表示网卡的硬件地址，即MAC地址  
inetaddr:             表示网卡IP；  
Bcast:                 表示广播(broadcast ) 的地址；  
Mask:                 表示子网掩码；  
UP:                     表示网卡开启状态；  
BROADCAST:  表示支持广播；  
MULTICAST:   表示网卡混杂模式；  
RUNNING:        表示网卡的网线被接上；  
MULTICAST:    表示支持组播；  
MTU:                  表示MaximumTrasmission Unit 最大传输单元(字节)，即此接口一次所能传输的最大封包；  
Metric:                 表示路由度量值，缺省值是0；  
RX:                      表示网络由激活到目前为止接收的数据包；  
TX:                      表示网络由激活到目前为止发送的数据包；  
collisions:            表示网络信号冲突的情况；  
txqueuelen:          表示传输缓冲区长度大小；  
Memory:             表示占用内存范围。

2**设置混杂模式**

\[zhaihf@localhost~\]$**ifconfigeth1 pro****misc**

3**命令**

3.1help  
\[zhaihf@localhost~\]$ifconfig --help  
Usage:  
ifconfig\[-a\] \[-v\] \[-s\] <interface> \[\[<AF>\] <address>\]  
\[add<address>\[/<prefixlen>\]\]  
\[del<address>\[/<prefixlen>\]\]  
\[\[-\]broadcast\[<address>\]\] \[\[-\]pointopoint \[<address>\]\]  
\[netmask<address>\] \[dstaddr <address>\] \[tunnel <address>\]  
\[outfill<NN>\] \[keepalive <NN>\]  
\[hw<HW> <address>\] \[metric <NN>\] \[mtu <NN>\]  
\[\[-\]trailers\] \[\[-\]arp\] \[\[-\]allmulti\]  
\[multicast\] \[\[-\]promisc\]  
\[mem\_start<NN>\] \[io\_addr <NN>\] \[irq <NN>\] \[media <type>\]  
\[txqueuelen<NN>\]  
\[\[-\]dynamic\]  
\[up|down\]...  
<HW>=HardwareType.  
Listof possible hardware types:  
loop(Local Loopback) slip (Serial Line IP) cslip (VJ Serial Line IP)  
slip6(6-bit Serial Line IP) cslip6 (VJ 6-bit Serial Line IP) adaptive(Adaptive Serial Line IP)  
strip(Metricom Starmode IP) ash (Ash) ether (Ethernet)  
tr(16/4 Mbps Token Ring) tr (16/4 Mbps Token Ring (New)) ax25 (AMPRAX.25)  
netrom(AMPR NET/ROM) rose (AMPR ROSE) tunnel (IPIP Tunnel)  
ppp(Point-to-Point Protocol) hdlc ((Cisco)-HDLC) lapb (LAPB)  
arcnet(ARCnet) dlci (Frame Relay DLCI) frad (Frame Relay Access Device)  
sit(IPv6-in-IPv4) fddi (Fiber Distributed Data Interface) hippi (HIPPI)  
irda(IrLAP) ec (Econet) x25 (generic X.25)  
infiniband(InfiniBand)  
<AF>=Addressfamily. Default: inet  
Listof possible address families:  
unix(UNIX Domain) inet (DARPA Internet) inet6 (IPv6)  
ax25(AMPR AX.25) netrom (AMPR NET/ROM) rose (AMPR ROSE)  
ipx(Novell IPX) ddp (Appletalk DDP) ec (Econet)  
ash(Ash) x25 (CCITT X.25)  
2.2man ifconfig  
NAME  
ifconfig- configure a network interface  
SYNOPSIS  
ifconfig\[interface\]  
ifconfiginterface \[aftype\] options | address ...  
DESCRIPTION  
Ifconfig is used to configure the kernel-resident network interfaces.  
Itis used at boot time to set up interfaces as necessary. After that,  
it is usually only needed when debugging or when system tuning is  
needed.  
Ifno arguments are given, ifconfig displays the status of the cur-  
rently active interfaces. If a single interface argument is given, it  
displaysthe status of the given interface only; if a single -a argu-  
ment is given, it displays the status of all interfaces, even those  
thatare down. Otherwise, it configures an interface.  
AddressFamilies  
Ifthe first argument after the interface name is recognized as the  
name of a supported address family, that address family is used for  
decodingand displaying all protocol addresses. Currently supported  
address families include inet (TCP/IP, default), inet6 (IPv6), ax25  
(AMPRPacket Radio), ddp (Appletalk Phase 2), ipx (Novell IPX) and  
netrom(AMPR Packet radio). All numbers supplied as parts in IPv4 dot-  
teddecimal notation may be decimal, octal, or hexadecimal, as speci-  
fied in the ISO C standard (that is, a leading 0x or 0X implies hex-  
adecimal;otherwise, a leading ’0’ implies octal; otherwise, the number  
is interpreted as decimal). Use of hexamedial and octal numbers is not  
RFC-compliantand therefore its use is discouraged and may go away.  
OPTIONS  
interface  
Thename of the interface. This is usually a driver name fol-  
lowed by a unit number, for example eth0 for the first Ethernet  
interface.  
up This flag causes the interface to be activated. It is implic-  
itlyspecified if an address is assigned to the interface.  
down This flag causes the driver for this interface to be shut down.  
\[-\]arpEnable or disable the use of the ARP protocol on this interface.  
\[-\]promisc  
Enable or disable the promiscuous mode of the interface. If  
selected,all packets on the network will be received by the  
interface.  
\[-\]allmulti  
Enable or disable all-multicast mode. If selected, all multi-  
castpackets on the network will be received by the interface.  
metricN  
Thisparameter sets the interface metric.  
mtuN This parameter sets the Maximum Transfer Unit (MTU) of an inter-  
face.  
dstaddraddr  
Set the remote IP address for a point-to-point link (such as  
PPP). This keyword is now obsolete; use the pointopoint keyword  
instead.  
netmaskaddr  
Setthe IP network mask for this interface. This value defaults  
tothe usual class A, B or C network mask (as derived from the  
interfaceIP address), but it can be set to any value.  
addaddr/prefixlen  
Addan IPv6 address to an interface.  
deladdr/prefixlen  
Removean IPv6 address from an interface.  
tunnel::aa.bb.cc.dd  
Create a new SIT (IPv6-in-IPv4) device, tunnelling to the given  
destination.  
irqaddr  
Setthe interrupt line used by this device. Not all devices can  
dynamicallychange their IRQ setting.  
io\_addraddr  
Setthe start address in I/O space for this device.  
mem\_startaddr  
Set the start address for shared memory used by this device.  
Onlya few devices need this.  
mediatype  
Setthe physical port or medium type to be used by the device.  
Notall devices can change this setting, and those that can vary  
inwhat values they support. Typical values for type are  
10base2(thin Ethernet), 10baseT (twisted-pair 10Mbps Ethernet),  
AUI(external transceiver) and so on. The special medium type  
of auto can be used to tell the driver to auto-sense the media.  
Again,not all drivers can do this.  
\[-\]broadcast\[addr\]  
Ifthe address argument is given, set the protocol broadcast  
address for this interface. Otherwise, set (or clear) the  
IFF\_BROADCASTflag for the interface.  
\[-\]pointopoint\[addr\]  
Thiskeyword enables the point-to-point mode of an interface,  
meaning that it is a direct link between two machines with  
nobodyelse listening on it.  
Ifthe address argument is also given, set the protocol address  
of the other side of the link, just like the obsolete dstaddr  
keyworddoes. Otherwise, set or clear the IFF\_POINTOPOINT flag  
forthe interface.  
hwclass address  
Setthe hardware address of this interface, if the device driver  
supportsthis operation. The keyword must be followed by the  
nameof the hardware class and the printable ASCII equivalent of  
thehardware address. Hardware classes currently supported  
include ether (Ethernet), ax25 (AMPR AX.25), ARCnet and netrom  
(AMPRNET/ROM).  
multicast  
Setthe multicast flag on the interface. This should not nor-  
mally be needed as the drivers set the flag correctly them-  
selves.  
address  
TheIP address to be assigned to this interface.  
txqueuelenlength  
Setthe length of the transmit queue of the device. It is useful  
to set this to small values for slower devices with a high  
latency(modem links, ISDN) to prevent fast bulk transfers from  
disturbinginteractive traffic like telnet too much.  
NOTES  
Sincekernel release 2.2 there are no explicit interface statistics for  
aliasinterfaces anymore. The statistics printed for the original  
address are shared with all alias addresses on the same device. If you  
wantper-address statistics you should add explicit accounting rules  
forthe address using the ipchains(8) command.  
Interrupt problems with Ethernet device drivers fail with EAGAIN. See  
http://www.scyld.com/expert/irq-conflict.htmlfor more information.  
FILES  
/proc/net/socket  
/proc/net/dev  
/proc/net/if\_inet6  
BUGS  
Whileappletalk DDP and IPX addresses will be displayed they cannot be  
alteredby this command.  
SEEALSO  
route(8),netstat(8), arp(8), rarp(8), ipchains(8)

4  **其它方法**

4.1 arp

使用arp协议，向指定怀疑的ip主机发送arp协议报文，如果有rarp协议报文返回，则证明该ip主机的网卡是混杂模式

5  **使用实例：**

**实例****1：显示****网络设备信息****（****激活状态的****）**

**命令：**

**ifconfig**

**输出：**

\[root@localhost ~\]\# ifconfig  
eth0      Link encap:Ethernet  HWaddr 00:50:56:BF:26:20    
          inet addr:192.168.120.204  Bcast:192.168.120.255  Mask:255.255.255.0  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1  
          RX packets:8700857 errors:0 dropped:0 overruns:0 frame:0  
          TX packets:31533 errors:0 dropped:0 overruns:0 carrier:0  
          collisions:0 txqueuelen:1000   
          RX bytes:596390239 (568.7 MiB)  TX bytes:2886956 (2.7 MiB)  
  
lo        Link encap:Local Loopback    
          inet addr:127.0.0.1  Mask:255.0.0.0  
          UP LOOPBACK RUNNING  MTU:16436  Metric:1  
          RX packets:68 errors:0 dropped:0 overruns:0 frame:0  
          TX packets:68 errors:0 dropped:0 overruns:0 carrier:0  
          collisions:0 txqueuelen:0   
          RX bytes:2856 (2.7 KiB)  TX bytes:2856 (2.7 KiB)

**说明：**

eth0 表示第一块网卡， 其中 HWaddr 表示网卡的物理地址，可以看到目前这个网卡的物理地址(MAC地址）是 00:50:56:BF:26:20

inet addr 用来表示网卡的IP地址，此网卡的 IP地址是 192.168.120.204，广播地址， Bcast:192.168.120.255，掩码地址Mask:255.255.255.0

lo 是表示主机的回坏地址，这个一般是用来测试一个网络程序，但又不想让局域网或外网的用户能够查看，只能在此台主机上运行和查看所用的网络接口。比如把 HTTPD服务器的指定到回坏地址，在浏览器输入 127.0.0.1 就能看到你所架WEB网站了。但只是您能看得到，局域网的其它主机或用户无从知道。

第一行：连接类型：Ethernet（以太网）HWaddr（硬件mac地址）

第二行：网卡的IP地址、子网、掩码

第三行：UP（代表网卡开启状态）RUNNING（代表网卡的网线被接上）MULTICAST（支持组播）MTU:1500（最大传输单元）：1500字节

第四、五行：接收、发送数据包情况统计

第七行：接收、发送数据字节数统计信息。

**实例****2：****启动关闭指定网卡**

**命令：**

**ifconfig eth0 up**

**ifconfig eth0 down**

**输出：**

**说明：**

ifconfig eth0 up 为启动网卡eth0 ；ifconfig eth0 down 为关闭网卡eth0。**ssh登陆linux服务器操作要小心，关闭了就不能开启了，除非你有多网卡。**

**实例****3：****为网卡配置和删除IPv6地址**

**命令：**

**ifconfig eth0 add 33ffe:3240:800:1005::2/64**

**ifconfig eth0 del 33ffe:3240:800:1005::2/64**

**输出：**

**说明：**

ifconfig eth0 add 33ffe:3240:800:1005::2/64 为网卡eth0配置IPv6地址；

ifconfig eth0 add 33ffe:3240:800:1005::2/64 为网卡eth0删除IPv6地址；

**练习的时候，ssh登陆linux服务器操作要小心，关闭了就不能开启了，除非你有多网卡。**

**实例****4：**用ifconfig修改MAC地址

**命令：**

**ifconfig eth0 hw ether 00:AA:BB:CC:DD:EE**

**输出：**

\[root@localhost ~\]\# ifconfig eth0 down //关闭网卡  
\[root@localhost ~\]\# ifconfig eth0 hw ether 00:AA:BB:CC:DD:EE //修改MAC地址  
\[root@localhost ~\]\# ifconfig eth0 up //启动网卡  
\[root@localhost ~\]\# ifconfig  
eth0      Link encap:Ethernet  HWaddr 00:AA:BB:CC:DD:EE    
          inet addr:192.168.120.204  Bcast:192.168.120.255  Mask:255.255.255.0  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1  
          RX packets:8700857 errors:0 dropped:0 overruns:0 frame:0  
          TX packets:31533 errors:0 dropped:0 overruns:0 carrier:0  
          collisions:0 txqueuelen:1000   
          RX bytes:596390239 (568.7 MiB)  TX bytes:2886956 (2.7 MiB)  
  
lo        Link encap:Local Loopback    
          inet addr:127.0.0.1  Mask:255.0.0.0  
          UP LOOPBACK RUNNING  MTU:16436  Metric:1  
          RX packets:68 errors:0 dropped:0 overruns:0 frame:0  
          TX packets:68 errors:0 dropped:0 overruns:0 carrier:0  
          collisions:0 txqueuelen:0   
          RX bytes:2856 (2.7 KiB)  TX bytes:2856 (2.7 KiB)  
\[root@localhost ~\]\# ifconfig eth0 hw ether 00:50:56:BF:26:20 //关闭网卡并修改MAC地址   
\[root@localhost ~\]\# ifconfig eth0 up //启动网卡  
\[root@localhost ~\]\# ifconfig  
eth0      Link encap:Ethernet  HWaddr 00:50:56:BF:26:20    
          inet addr:192.168.120.204  Bcast:192.168.120.255  Mask:255.255.255.0  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1  
          RX packets:8700857 errors:0 dropped:0 overruns:0 frame:0  
          TX packets:31533 errors:0 dropped:0 overruns:0 carrier:0  
          collisions:0 txqueuelen:1000   
          RX bytes:596390239 (568.7 MiB)  TX bytes:2886956 (2.7 MiB)  
  
lo        Link encap:Local Loopback    
          inet addr:127.0.0.1  Mask:255.0.0.0  
          UP LOOPBACK RUNNING  MTU:16436  Metric:1  
          RX packets:68 errors:0 dropped:0 overruns:0 frame:0  
          TX packets:68 errors:0 dropped:0 overruns:0 carrier:0  
          collisions:0 txqueuelen:0   
          RX bytes:2856 (2.7 KiB)  TX bytes:2856 (2.7 KiB)

**说明：**

**实例****5：****配置IP地址**

**命令：**

**输出：**

\[root@localhost ~\]\# **ifconfig eth0 192.168.120.56**   
\[root@localhost ~\]\# **ifconfig eth0 192.168.120.56 netmask 255.255.255.0**   
\[root@localhost ~\]\# **ifconfig eth0 192.168.120.56 netmask 255.255.255.0 broadcast 192.168.120.255**

**说明：**

ifconfig eth0 192.168.120.56

给eth0网卡配置IP地：192.168.120.56

ifconfig eth0 192.168.120.56 netmask 255.255.255.0

给eth0网卡配置IP地址：192.168.120.56 ，并加上子掩码：255.255.255.0

ifconfig eth0 192.168.120.56 netmask 255.255.255.0 broadcast 192.168.120.255

/给eth0网卡配置IP地址：192.168.120.56，加上子掩码：255.255.255.0，加上个广播地址： 192.168.120.255

**实例****6：****启用和关闭ARP协议**

**命令：**

**ifconfig eth0 arp**

**ifconfig eth0 -arp**

**输出：**

\[root@localhost ~\]\# ifconfig eth0 arp   
\[root@localhost ~\]\# ifconfig eth0 -arp

**说明：**

ifconfig eth0 arp 开启网卡eth0 的arp协议；

ifconfig eth0 -arp 关闭网卡eth0 的arp协议；

**实例****7：****设置最大传输单元**

**命令：**

**ifconfig eth0 mtu 1500**

**输出：**

\[root@localhost ~\]\# ifconfig eth0 mtu 1480  
\[root@localhost ~\]\# ifconfig  
eth0      Link encap:Ethernet  HWaddr 00:50:56:BF:26:1F    
          inet addr:192.168.120.203  Bcast:192.168.120.255  Mask:255.255.255.0  
          UP BROADCAST RUNNING MULTICAST  MTU:1480  Metric:1  
          RX packets:8712395 errors:0 dropped:0 overruns:0 frame:0  
          TX packets:36631 errors:0 dropped:0 overruns:0 carrier:0  
          collisions:0 txqueuelen:1000   
          RX bytes:597062089 (569.4 MiB)  TX bytes:2643973 (2.5 MiB)  
  
lo        Link encap:Local Loopback    
          inet addr:127.0.0.1  Mask:255.0.0.0  
          UP LOOPBACK RUNNING  MTU:16436  Metric:1  
          RX packets:9973 errors:0 dropped:0 overruns:0 frame:0  
          TX packets:9973 errors:0 dropped:0 overruns:0 carrier:0  
          collisions:0 txqueuelen:0   
          RX bytes:518096 (505.9 KiB)  TX bytes:518096 (505.9 KiB)  
\[root@localhost ~\]\# ifconfig eth0 mtu 1500  
\[root@localhost ~\]\# ifconfig  
eth0      Link encap:Ethernet  HWaddr 00:50:56:BF:26:1F    
          inet addr:192.168.120.203  Bcast:192.168.120.255  Mask:255.255.255.0  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1  
          RX packets:8712548 errors:0 dropped:0 overruns:0 frame:0  
          TX packets:36685 errors:0 dropped:0 overruns:0 carrier:0  
          collisions:0 txqueuelen:1000   
          RX bytes:597072333 (569.4 MiB)  TX bytes:2650581 (2.5 MiB)  
  
lo        Link encap:Local Loopback    
          inet addr:127.0.0.1  Mask:255.0.0.0  
          UP LOOPBACK RUNNING  MTU:16436  Metric:1  
          RX packets:9973 errors:0 dropped:0 overruns:0 frame:0  
          TX packets:9973 errors:0 dropped:0 overruns:0 carrier:0  
          collisions:0 txqueuelen:0   
          RX bytes:518096 (505.9 KiB)  TX bytes:518096 (505.9 KiB)  
\[root@localhost ~\]\#

**说明：**

设置能通过的最大数据包大小为 1500 bytes

备注：用ifconfig命令配置的网卡信息，在网卡重启后机器重启后，配置就不存在。要想将上述的配置信息永远的存的电脑里，那就要修改网卡的配置文件。