- 论坛徽章:
- 0
|
PING 内网网关没问题,就是PING 电信DNS很不稳定,有时候延时time<20MS有时又大于1200MS甚至掉包,如此循环。弄了很就都没搞好,郁闷啊!达人帮忙分析下。网络拓扑如下:(交换机是傻瓜式的)
ADSL
|
LINUX代理网关
|
Switch A
/ | \
/ | \
Switch1 Switch2 Switch3
用过的办法:
1、拔掉交换机A,直接在网关上PING 电信DNS,结果很正常,延时在12MS左右。初步判断网关没问题。
2、把Switch A换成HUB,然后用科来网络分析系统抓包,发现很多无请求的ARP应答,也有不少ARP扫描和ARP请求风暴,都是2个MAC地址发的。
3、因为网络比较乱,找不到这2个MAC的机在哪,就在网关用IPTABLES把这两个MAC地址封了
iptables -I INPUT -p all -m mac --mac-source 00:e0:4c:79:77:a1 -j DROP
然后在网关里用 tcpdump -i eth1 -p arp抓包, 还是能抓到这个MAC的IP在ARP扫描,掉包问题也没解决。郁闷啊。
IPTABLES是这样
[root@localhost root]# iptables-save
# Generated by iptables-save v1.2.7a on Mon Aug 21 15:59:16 2006
*nat
:PREROUTING ACCEPT [587355:42893000]
:POSTROUTING ACCEPT [176292:10694087]
:OUTPUT ACCEPT [176292:10694087]
-A PREROUTING -s 192.168.0.0/255.255.255.0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.254:8080
-A POSTROUTING -s 192.168.0.0/255.255.255.0 -o ppp0 -j MASQUERADE
COMMIT
# Completed on Mon Aug 21 15:59:16 2006
# Generated by iptables-save v1.2.7a on Mon Aug 21 15:59:16 2006
*mangle
:PREROUTING ACCEPT [7370189:4630539249]
:INPUT ACCEPT [7131342:4611734463]
:FORWARD ACCEPT [228382:15878343]
:OUTPUT ACCEPT [7624805:4820106264]
:POSTROUTING ACCEPT [7649557:4822550801]
COMMIT
# Completed on Mon Aug 21 15:59:16 2006
# Generated by iptables-save v1.2.7a on Mon Aug 21 15:59:16 2006
*filter
:INPUT DROP [143459:12152589]
:FORWARD DROP [191200:12664215]
:OUTPUT ACCEPT [11170324:6944667217]
:syn-flood - [0:0]
-A INPUT -m mac --mac-source 00:E0:4C:79:77:A1 -j DROP
-A INPUT -m mac --mac-source 4C:00:10:B5:12:6C -j DROP
-A INPUT -s 192.168.0.0/255.255.255.0 -p icmp -j ACCEPT
-A INPUT -p tcp -m tcp --dport 445 -j DROP
-A INPUT -p tcp -m tcp --dport 139 -j DROP
-A INPUT -s 192.168.0.0/255.255.255.0 -p tcp -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j syn-flood
-A FORWARD -s 192.168.0.244 -j ACCEPT
-A FORWARD -s 192.168.0.125 -j ACCEPT
-A FORWARD -s 192.168.0.224 -j ACCEPT
-A FORWARD -s 192.168.0.228 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A syn-flood -p tcp -m limit --limit 3/sec --limit-burst 6 -j RETURN
# Completed on Mon Aug 21 15:59:16 2006
[ 本帖最后由 耶寇 于 2006-8-21 16:09 编辑 ] |
|