Linux IPv6 HOWTO (4)
2008年9月13日
没有评论
14.1 Red Hat Linux and "clones"(小紅帽和它的弟兄娣妹)
自從我開始寫 [33]IPv6 & Linux - HowTo.我打算設定一個持久的IPv6配置,包 含: host-only, router-only, dual-homed-host, router with second stub network, normal tunnels, 6to4 tunnels 和其它.現在我寫了一 個configuration and script files 這個script有自己的HOWTO:
[34]IPv6-HOWTO/scripts/current. 夠運的是, Red Hat Linux 從 7.1 開始就 包含了這個script.多虧了Pekka Savola的幫助.
14.2 Mandrake(曼德萊克)Linux
從8.0後也包含了 IPv6-enabled initscript package但是有點小問 題("ifconfig" misses "inet6" before "add").
支持IPv6的網路設定 scripts 測試
script library應該存在: ______________________________________________________________
/etc/sysconfig/network-scripts/network-functions-ipv6 ______________________________________________________________
自動測試: ______________________________________________________________
# test -f /etc/sysconfig/network-scripts/network-functions-ipv6 && echo "Main ? IPv6 script library exists" ______________________________________________________________
library的版本很重要, 更高的版本包含了更多的功能.您可以通過這個檢視它: ______________________________________________________________
# source /etc/sysconfig/network-scripts/network-functions-ipv6 && ? getversion_ipv6_functions 20011124 ______________________________________________________________
Short hint for enabling IPv6 on current RHL 7.1, 7.2, 7.3, ...(一些小提示)
* 檢視IPv6模組是否已經掛進系統. ______________________________________________________________
# modprobe -c | grep net-pf-10 alias net-pf-10 off ______________________________________________________________
* 如果是"off" 在 /etc/sysconfig/network 中加入IPv6的支持. ______________________________________________________________
NETWORKING_IPV6=yes ______________________________________________________________
* 重新初始網路: ______________________________________________________________
# service network restart ______________________________________________________________
* IPv6模組應該掛進來了: ______________________________________________________________
# modprobe -c | grep ipv6 alias net-pf-10 ipv6 ______________________________________________________________
如果您提供路由廣告autoconfiguration 會自動為您設定, 更多的資訊請看 /usr/share/doc/initscripts-$version/sysconfig.txt.
14.3 SuSE(蘇澤斯)Linux
7.x 以上, 支持IPv6. 在/etc/rc.config 裡有更多的資訊. 因為不同的設定方 法和scripts結構, 所以不能將Red Hat Linux 當中的方法照搬過來.
更詳盡的資訊請看:
[35]How to setup 6to4 IPv6 with SuSE 7.3
14.4 Debian(迪比安)Linux
參照: [36]IPv6 on Debian Linux
15. 防火牆
15.1 使用 netfilter6防火牆
netfilter6防火牆只支持2.4以上的核心.早期的2.2核心您只能用41號協議過 濾IPv6-in-IPv4.
警告: 按照例子那樣設定並不能真正地保護您的作業系統.
15.2 更多的資訊:
* [37]Netfilter project * [38]maillist archive of netfilter users * [39]maillist archive of netfilter developers * [40]Unofficial status informations
15.3 準備
下載最新的核心: [41]http://www.kernel.org/
下載最新的iptables:
tar: [42]http://www.netfilter.org/
Source RPM for rebuild of binary (for RedHat systems): [43]ftp://ftp.redhat.com/redhat/linux/rawhide/SRPMS/SRPMS/
解開源代碼
解開源代碼與更名 ______________________________________________________________
# tar z|jxf kernel-version.tar.gz|bz2 # mv linux linux-version-iptables-version+IPv6 ______________________________________________________________
解開 iptables 源代碼 ______________________________________________________________
# tar z|jxf iptables-version.tar.gz|bz2 ______________________________________________________________
Apply pending patches ______________________________________________________________
# make pending-patches KERNEL_DIR=/path/to/src/linux-version-iptables-version/ ______________________________________________________________
Apply additional IPv6 related patches (still not in the vanilla kernel included) ______________________________________________________________
# make patch-o-matic KERNEL_DIR=/path/to/src/linux-version-iptables-version/ ______________________________________________________________
在下面的選單中回答yes: * ah-esp.patch * masq-dynaddr.patch (only needed for systems with dynamic IP assigned WAN connections like PPP or PPPoE) * ipv6-agr.patch.ipv6 * ipv6-ports.patch.ipv6 * LOG.patch.ipv6 * REJECT.patch.ipv6
檢視IPv6括展: ______________________________________________________________
# make print-extensions Extensions found: IPv6:owner IPv6:limit IPv6:mac IPv6:multiport ______________________________________________________________
Configure, build and install new kernel(設定,編譯,安裝新的核心)
進入代碼目錄: ______________________________________________________________
# cd /path/to/src/linux-version-iptables-version/ ______________________________________________________________
改變Makefile ______________________________________________________________
- EXTRAVERSION = + EXTRAVERSION = -iptables-version+IPv6-try ______________________________________________________________
運行相關的設定:Run configure, enable IPv6 related ______________________________________________________________
Code maturity level options Prompt for development and/or incomplete code/drivers : yes Networking options Network packet filtering: yes The IPv6 protocol: module IPv6: Netfilter Configuration IP6 tables support: module All new options like following: limit match support: module MAC address match support: module Multiple port match support: module Owner match support: module netfilter MARK match support: module Aggregated address check: module Packet filtering: module REJECT target support: module LOG target support: module Packet mangling: module MARK target support: module ______________________________________________________________
在系統的其它方面進行相應的修改.
Rebuild and install binaries of iptables (打造一個新的iptables)
確定您的核心源代碼存在於: /usr/src/linux/
Rename older directory ______________________________________________________________
# mv /usr/src/linux /usr/src/linux.old ______________________________________________________________
Create a new softlink ______________________________________________________________
# ln /path/to/src/linux-version-iptables-version /usr/src/linux ______________________________________________________________
Rebuild SRPMS ______________________________________________________________
# rpm --rebuild /path/to/SRPMS/iptables-version-release.src.rpm ______________________________________________________________
Install new iptables packages (iptables + iptables-ipv6) 安裝新 的iptables * On RH 7.1 systems, 通常已經有一個更早的版本, therefore use "freshen" ______________________________________________________________
# rpm -Fhv /path/to/RPMS/cpu/iptables*-version-release.cpu.rpm ______________________________________________________________
* 如果沒有安裝,您就親自來吧: ______________________________________________________________
# rpm -ihv /path/to/RPMS/cpu/iptables*-version-release.cpu.rpm ______________________________________________________________
* 如果在RH6.2上安裝,要加上"--nodep": ______________________________________________________________
# rpm -ihv --nodep /path/to/RPMS/cpu/iptables*-version-release.cpu.rpm
______________________________________________________________
* 可能要為iptables加上一個softlink: ______________________________________________________________
# ln -s /lib/iptables/ /usr/lib/iptables ______________________________________________________________
15.4 使用方法
檢視
將模組掛進來: ______________________________________________________________
# modprobe ip6_tables ______________________________________________________________
檢視 ______________________________________________________________
# [ ! -f /proc/net/ip6_tables_names ] && echo "Current kernel doesn'tsupport ? 'ip6tables' firewalling (IPv6)!" ______________________________________________________________
15.5 使用ip6tables
16.3.2.1. List all IPv6 netfilter entries
Short
# ip6tables -L
Extended
# ip6tables -n -v --line-numbers -L
List specified filter# ip6tables -n -v --line-numbers -L INPUT
加入一個日誌:# ip6tables --table filter --append INPUT -j LOG --log-prefix "INPUT:"? --log-level 7
加入一個入站丟棄的條件:# ip6tables --table filter --append INPUT -j DROP
移除一個條件:# ip6tables --table filter --delete INPUT 1
允許 ICMPv6:Using older kernels (unpatched kernel 2.4.5 and iptables-1.2.2) no type can bespecified
允許入站 ICMPv6 經過 tunnels
# ip6tables -A INPUT -i sit+ -p icmpv6 -j ACCEPT
允許出站 ICMPv6 經過 tunnels# ip6tables -A OUTPUT -o sit+ -p icmpv6 -j ACCEPT
Newer kernels allow specifying of ICMPv6 types:
# ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT
限制Rate-limitingBecause it can happen (author already saw it to times) that an ICMPv6 storm will raise up, you should use available rate limiting for at least ICMPv6 ruleset. In addition logging rules should also get rate limiting to prevent DoS attacks against syslog and storage of log file partition. An example for a rate limited ICMPv6 looks like:
# ip6tables -A INPUT --protocol icmpv6 --icmpv6-type echo-request -j ACCEPT --match limit --limit 30/minute
允許入站的 SSHHere an example is shown for a ruleset which allows incoming SSH connection from a specified IPv6 address
允許來自 3ffe:ffff:100::1/128 的 SSH 入站
# ip6tables -A INPUT -i sit+ -p tcp -s 3ffe:ffff:100::1/128 --sport 512:65535? --dport 22 -j ACCEPT
允許回應包Allow response packets (此刻 IPv6 連結追蹤不在 mainstream netfilter6implemented 當中)
# ip6tables -A OUTPUT -o sit+ -p tcp -d 3ffe:ffff:100::1/128 --dport 512:65535? --sport 22 ! --syn j ACCEPT
充許 tunneled IPv6-in-IPv4Tto accept tunneled IPv6-in-IPv4 packets, 在IPv4 防火牆做相應的設定 firewall setup relating to such packets, for example
充許 interface ppp0 的 IPv6-in-IPv4 入站
# iptables -A INPUT -i ppp0 -p ipv6 -j ACCEPT
充許 interface ppp0 的 IPv6-in-IPv4 出站
# iptables -A OUTPUT -o ppp0 -p ipv6 -j ACCEPT
If you have only a static tunnel, you can specify the IPv4 addresses, too, like
充許來自 endpoint 1.2.3.4 的 IPv6-in-IPv4 通過 interface ppp0 入站
# iptables -A INPUT -i ppp0 -p ipv6 -s 1.2.3.4 -j ACCEPT
充許來自 endpoint 1.2.3.4 的 IPv6-in-IPv4 通過 interface ppp0 入站
# iptables -A OUTPUT -o ppp0 -p ipv6 -d 1.2.3.4 -j ACCEPT
16.3.2.10. Protection against incoming TCP connection requests極力推薦! 出於安全考慮 您應當加入一個阻止TCP 連結請求入站的條件 . Adapt "-i" option, if other interface names are in use!
阻止入站的 TCP 連結請求
# ip6tables -I INPUT -i sit+ -p tcp --syn -j DROP
在路由器後面 阻止入站的 TCP 連結請求
# ip6tables -I FORWARD -i sit+ -p tcp --syn -j DROP
可能這些條件以經存在其它地方,但這是您想當然的想法.最好建一個包含很多條件的 script 然後執行.
16.3.2.11.阻止入站的 UDP 連結請求
極力推薦! 提起過我的防火牆資訊可以控制出站 UDP/TCP 會話的端口. 所以如果您的本地IPv6系統使用本地端口 比如:從 32768 至 60999 您也可以像這樣過濾UDP連結 (直到連結跟蹤正常工作) like:
阻止入站的 UDP 數據包 , 斬斷請求出站的回應數據包
# ip6tables -I INPUT -i sit+ -p udp ! --dport 32768:60999 -j DROP
在路由器上面阻止入站的 UDP 數據包轉寄到路由器後面的主機
ip6tables -I FORWARD -i sit+ -p udp ! --dport 32768:60999 -j DROP
實例:
下面這個實例是一個經典, 由 Happy netfilter6 ruleset 生成: ______________________________________________________________
# ip6tables -n -v -LChain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 extIN all sit+ * ::/0 ::/0 4 384 intIN all eth0 * ::/0 ::/0 0 0 ACCEPT all * * ::1/128 ::1/128 0 0 ACCEPT all lo * ::/0 ::/0 0 0 LOG all * * ::/0 ::/0? LOG flags 0 level 7 prefix `INPUT-default:' 0 0 DROP all * * ::/0 ::/0
Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination? 0 0 int2ext all eth0 sit+ ::/0 ::/0 0 0 ext2int all sit+ eth0 ::/0 ::/0 0 0 LOG all * * ::/0 ::/0? LOG flags 0 level 7 prefix `FORWARD-default:' 0 0 DROP all * * ::/0 ::/0
Chain OUTPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination? 0 0 extOUT all * sit+ ::/0 ::/0 4 384 intOUT all * eth0 ::/0 ::/0 0 0 ACCEPT all * * ::1/128 ::1/128 0 0 ACCEPT all * lo ::/0 ::/0 0 0 LOG all * * ::/0 ::/0? LOG flags 0 level 7 prefix `OUTPUT-default:' 0 0 DROP all * * ::/0 ::/0
Chain ext2int (1 references) pkts bytes target prot opt in out source destination? 0 0 ACCEPT icmpv6 * * ::/0 ::/0 0 0 ACCEPT tcp * * ::/0 ::/0? tcp spts:1:65535 dpts:1024:65535 flags:!0x16/0x02 0 0 LOG all * * ::/0 ::/0? LOG flags 0 level 7 prefix `ext2int-default:' 0 0 DROP tcp * * ::/0 ::/0 0 0 DROP udp * * ::/0 ::/0 0 0 DROP all * * ::/0 ::/0
Chain extIN (1 references) pkts bytes target prot opt in out source destination? 0 0 ACCEPT tcp * * 3ffe:400:100::1/128 ::/0? tcp spts:512:65535 dpt:22 0 0 ACCEPT tcp * * 3ffe:400:100::2/128 ::/0? tcp spts:512:65535 dpt:22 0 0 ACCEPT icmpv6 * * ::/0 ::/0 0 0 ACCEPT tcp * * ::/0 ::/0? tcp spts:1:65535 dpts:1024:65535 flags:!0x16/0x02 0 0 ACCEPT udp * * ::/0 ::/0? udp spts:1:65535 dpts:1024:65535 0 0 LOG all * * ::/0 ::/0? limit: avg 5/min burst 5 LOG flags 0 level 7 prefix `extIN-default:' 0 0 DROP all * * ::/0 ::/0
Chain extOUT (1 references) pkts bytes target prot opt in out source destination? 0 0 ACCEPT tcp * * ::/0? 3ffe:ffff:100::1/128tcp spt:22 dpts:512:65535 flags:!0x16/0x02 0 0 ACCEPT tcp * * ::/0? 3ffe:ffff:100::2/128tcp spt:22 dpts:512:65535 flags:!0x16/0x02 0 0 ACCEPT icmpv6 * * ::/0 ::/0 0 0 ACCEPT tcp * * ::/0 ::/0? tcp spts:1024:65535 dpts:1:65535 0 0 ACCEPT udp * * ::/0 ::/0? udp spts:1024:65535 dpts:1:65535 0 0 LOG all * * ::/0 ::/0? LOG flags 0 level 7 prefix `extOUT-default:' 0 0 DROP all * * ::/0 ::/0
Chain int2ext (1 references) pkts bytes target prot opt in out source destination? 0 0 ACCEPT icmpv6 * * ::/0 ::/0 0 0 ACCEPT tcp * * ::/0 ::/0? tcp spts:1024:65535 dpts:1:65535 0 0 LOG all * * ::/0 ::/0? LOG flags 0 level 7 prefix `int2ext:' 0 0 DROP all * * ::/0 ::/0 0 0 LOG all * * ::/0 ::/0? LOG flags 0 level 7 prefix `int2ext-default:' 0 0 DROP tcp * * ::/0 ::/0 0 0 DROP udp * * ::/0 ::/0 0 0 DROP all * * ::/0 ::/0
Chain intIN (1 references) pkts bytes target prot opt in out source destination? 0 0 ACCEPT all * * ::/0? fe80::/ffc0:: 4 384 ACCEPT all * * ::/0 ff02::/16
Chain intOUT (1 references) pkts bytes target prot opt in out source destination? 0 0 ACCEPT all * * ::/0? fe80::/ffc0:: 4 384 ACCEPT all * * ::/0 ff02::/16 0 0 LOG all * * ::/0 ::/0? LOG flags 0 level 7 prefix `intOUT-default:' 0 0 DROP all * * ::/0 ::/0 ______________________________________________________________
16. 安全
16.1 Access limitations
有許多服務使用 tcp_wrapper library 控制訪問.Below is described the use of tcp_wrapper
內容有待增加...
16.2 IPv6安全審核
目前沒有什麼較好的商業工具來進行
Legal issues
警告:您只能掃瞄自己的系統,不然,可能會觸及法律.開始之前,請檢察您要掃瞄 的IPv6目標地址兩次!.
16.3 Security auditing using IPv6-enabled netcat(使用適應IPv6的netcat)
關於IPv6-enabled netcat的詳細資訊請參照: [44] IPv6?status-apps/security-auditing
例子: ______________________________________________________________
# nc6 ::1 daytime 13 JUL 2002 11:22:22 CEST ______________________________________________________________
16.4 Security auditing using IPv6-enabled nmap
全世界最為優秀的掃瞄程式之一.它的首頁: [45] http://www.insecure.org/nmap/ 從 3.10ALPHA1 的版本開始支持IPv6. 例子: ______________________________________________________________
# nmap -6 -sT ::1 Starting nmap V. 3.10ALPHA3 ( www.insecure.org/nmap/ ) Interesting ports on localhost6 (::1): (The 1600 ports scanned but not shown below are in state: closed) Port State Service 22/tcp open ssh 53/tcp open domain 515/tcp open printer 2401/tcp open cvspserver Nmap run completed -- 1 IP address (1 host up) scanned in 0.525 seconds ______________________________________________________________
16.5 Security auditing using IPv6-enabled strobe
Strobe 同 NMap相比更不具靈活性,但已經有 IPv6-enabling patch (see IPv6?status-apps/security-auditing for more). Usage example: ______________________________________________________________
# ./strobe ::1 strobe 1.05 (c) 1995-1999 Julian Assange <proff@iq.org>. ::1 2401 unassigned unknown ::1 22 ssh Secure Shell - RSA encrypted rsh ::1 515 printer spooler (lpd) ::1 6010 unassigned unknown ::1 53 domain Domain Name Server ______________________________________________________________
16.6 審核結果
如果審核結果同您的IPv6安全策略有出入, 請堵上檢測出的漏洞.
17. Encryption and Authentication(加密和認證)
Support in kernel
Currently missing in 2.4, perhaps in 2.5 (see below). There is an issue about keeping the Linux kernel source free of export/import-control-laws regarding encryption code. This is also one case why [46]FreeS/WAN project (IPv4 only IPsec) isn't still contained in vanilla source.
Support in USAGI kernel
The USAGI project has taken over in July 2001 the IPv6 enabled FreeS/WAN code from the [47]IABG / IPv6 Project and included in their kernel extensions, but still work in progress, means that not all IABG features are already working in USAGI extension.
17.1 用法
參照: [48]FreeS/WAN / Online documentation
18. 線上測試工具
內容有待增加... 歡迎提建議! * finger, nslookup, ping, traceroute, whois: [49]UK IPv6 Resource Centre / The test page * ping, traceroute, tracepath, 6bone registry, DNS: [50]JOIN / Testtools (German language only, but should be no problem for non German speakers) * traceroute6, whois: [51]IPng.nl
19. 其它資訊
19.1 線上資訊
加入IPv6 backbone骨幹網路 IPv6 test backbone: [52]6bone, [53]How to join 6bone
主要的註冊區域
* America: [54]ARIN [55]Ripe * Asia/Pacific: [56]APNIC * Latin America and Caribbea: [57]LACNIC
Also a list of major (prefix length 35) allocations per local registry is available here: [58]Ripe NCC / IPv6 allocations
Tunnel brokers
* [59]Freenet6 Canada * [60]Hurricane Electric US backbone * [61]Centro Studi e Laboratory Telecomunicazioni Italy * [62]Wanadoo Belgium * [63]CERTNET-Nokia China * [64]Tunnelbroker Leipzig Germany - DialupUsers with dynamic IP's can get a fix IPv6 IP... * [65]Internet Initiative Japan Japan - with IPv6 native line service and IPv6 tunneling Service * [66]XS26 - Access to SixNetherland - with POPs in Slovak Republic, Czech Republic, Netherlands, Germany and Hungary. * [67]IPng Netherland Netherland - Intouch, SurfNet, AMS-IX, UUNet, Cistron, RIPE NCC and AT& T are connected at the AMS-IX. It is possible (there are requirements...) to get an static tunnel. * [68]UNINETT Norway - Pilot IPv6 Service (for Customers): tunnelbroker & address allocation * [69]NTT Europe [70]NTT Euroope United Kingdom - IPv6 Trial. IPv4 Tunnel and native IPv6 leased Line connections. POPs are located in London, UK Dusseldorf, Germany New Jersey, USA (East Coast) Cupertino, USA (West Coast) Tokyo, Japan * [71]ESnet USA - Energy Sciences Network: Tunnel Registry & Address Delegation for directly connected ESnet sites and ESnet collaborators. * [72]6REN USA - The 6ren initiative is being coordinated by the Energy Sciences Network (ESnet), the network for the Energy Research program of the US Dept. of Energy, located at the University of California's Lawrence Berkeley National Laboratory
更多的IPv6資訊: [73]ipv6-net.org
6to4
* [74]NSayer's 6to4 information * [75]RFC 3068 / An Anycast Prefix for 6to4 Relay Routers
Latest news
* [76]http://hs247.com/ name="hs247 / IPv6 news and information"> also homepage for #ipv6 channel on EFnet * [77]bofh.st / latest IPv6 news but currently Jan 2002 outdated..., also homepage for IPv6 channel on IRCnet * [78]ipv6-net.org German forum
有關協議的參考
* [79]HS247 / IPv6 RFC list Publishing the list of IPv6-related RFCs is beyond the scope of this document, but given URLs will lead you to such lists: * [80]IPng Standardization Status a little bit out-of-sync at the moment * [81]IPv6 Related Specifications on IPv6.org
目前與IPv6有關的草案:
* [82]IP Version 6 ipv6 * [83]Next Generation Transitition * [84]Dynamic Host Configuration * [85]Domain Name System Extension * [86]Mobile IP mobileip
其它
* [87]Network Sorcery / IPv6, Internet Protocol version 6 IPv6 protocol header * [88]SWITCH IPv6 Pilot / References big list of IPv6 references maintained by Simon Leinen * [89]Advanced Network Management Laboratory / IPv6 Address Oracle shows you IPv6 addresses in detail
統計
* [90]IPv6 routing table history created by Gert Ding
19.2 更多的資訊
期待加入更多的內容,歡迎提建議!
Linux related
* [91]IPv6-HowTo for Linux by Peter Bieringer - Germany, and his * [92]Bieringer / IPv6 - software archive * [93]Linux+IPv6 status by Peter Bieringer Germany * [94]USAGI project Japan, and their * [95]USAGI project - software archive * [96]Gav's Linux IPv6 Page * [97]Project6 - IPv6 Networking For Linux Italy, and their * [98]Project6 - software archive
19.3 通信論壇
+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+|
|| Focus Request e-mail address What to subscribe Maillist e-mail address Language Access throughWWW |+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+| Linux kernel majordomo (at) oss.sgi.com netdev netdev (at) oss.sgi.com English http://oss.sgi.com/projects/netdev/archive/ || networking
|| including
|| IPv6
|+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+| Linux and majordomo (at) linux-ipv6 linux-ipv6 (at) list.f00f.org English || list.f00f.org
|| IPv6 in (moderated) || general (1)
|+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+| Mobile IP majordomo (at) mipl (at) list.mipl. English http://www.mipl.mediapoli.com/mailinglist.html || (v6) for list.mipl.mediapoli.com mipl mediapoli.com http://www.mipl.mediapoli.com/mail-archive/ || Linux
||
|+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+|Linux IPv6 usagi-users-ctl usagi-users English http://www.mipl.mediapoli.com/mailinglist.html ||users using (at) linux-ipv6.org (at) linux-ipv6.org http://www.mipl.mediapoli.com/mail-archive/ ||USAGI
||extension
|+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+|
||IPv6 on Debian debian-ipv6 (at) English http://lists.debian.org/debian-ipv6/ ||Linux Web-based, see URL lists.debian.org ||Web-based
||
|+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+|
||IPv6/6bone in majordomo (at) ipv6 (at) German/English http://www.join.uni-muenster.de/JOIN/ipv6/texte-englisch/mailingliste.html || Germany atlan.uni-muenster.de ipv6 uni-muenster.de http://www.join.uni-muenster.de/local/majordomo/ipv6/ ||
|+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+|
|| 6bone majordomo (at) 6bone 6bone (at) English http://www.6bone.net/6bone_email.html || isi.edu isi.edu http://ryouko.dgim.crc.ca/ipv6/ || http://www.wcug.wwu.edu/lists/6bone/ ||
|+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+|
||IPv6 majordomo (at) ipng ipng (at) English http://playground.sun.com/pub/ipng/html/instructions.html ||discussions sunroof.eng.sun.com sunroof.eng.sun.com ftp://playground.sun.com/pub/ipng/mail-archive/ || http://www.wcug.wwu.edu/lists/ipng/ |+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+|
|| IPv6 users majordomo (at) users users (at) ipv6.org English http://www.ipv6.org/mailing-lists.html || in general ipv6.org
||
|+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+|
|| Bugtracking of bugtraq-subscribe (at) bugtraq (at) English http://online.securityfocus.com/popups/forums/bugtraq/intro.shtml || Internet securityfocus.com securityfocus.com (moderated) http://online.securityfocus.com/archive/1 || applications (2)
||
|+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+|
|| IPv6 in general Web-based, see URL ipv6 (at) ipng.nl English http://mailman.ipng.nl/mailman/listinfo/ipv6/ || http://mailman.ipng.nl/pipermail/ipv6/ ||
|+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
|
|
|
||
||
|| majordomo (at) majordomo (at) ipv6 ipv6 (at) mfa.eti.br Portuguese http://www.mfa.eti.br/listas.html || mfa.eti.br mfa.eti.br
||
|+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
(1) recommended for common Linux & IPv6 issues.
(2) very recommended if you provide server applications.
是不是有什麼遺漏? 歡迎你的建議!
這裡還有另一份清單: http://www.join.uni-muenster.de/JOIN/ipv6/texte-englisch/ipv6.infoquellen.html
有關的發行版
* [99]Polish(ed) Linux Distribution ("market leader" in containing IPv6 enabled packages) * [100]Red Hat Linux * [101]Pekka Savola's IPv6 packages Germany * [102]Debian Linux * [103]Craig Small's IPv6 information and status * [104]SuSE Linux * [105]Linux Mandrake
20. 歷史
x.y版本 發佈在Internet上. x.y.z 表示正在進行的版本and only published as LyX file on CVS.
Releases 0.x
0.312002-09-29/PB: Extend information in proc-filesystem entries
0.302002-09-27/PB: Add some maillists
0.292002-09-18/PB: Update statement about nmap (triggered by Fyodor)
0.28.12002-09-16/PB: Add note about ping6 to multicast addresses, add some labels
0.282002-08-17/PB: Fix broken LDP/CVS links, add info about Polish translation, add URL of the IPv6 Address Oracle
0.272002-08-10/PB: Some minor updates
0.26.22002-07-15/PB: Add information neighbor discovery, split of firewalling (got some updates) and security into extra chapters
0.26.12002-07-13/PB: Update nmap/IPv6 information
0.262002-07-13/PB: Fill /proc-filesystem chapter, update DNS information about depricated A6/DNAME, change P-t-P tunnel setup to use of "ip" only
0.25.22002-07-11/PB: Minor spelling fixes
0.25.12002-06-23/PB: Minor spelling and other fixes
0.252002-05-16/PB: Cosmetic fix for 2^{ }128, thanks to Jos□ Ab□lio Oliveira Matos for help with LyX
0.242002-05-02/PB: Add entries in URL list, minor spelling fixes
0.232002-03-27/PB: Add entries in URL list and at maillists, add a label and minorinformation about IPv6 on RHL
0.222002-03-04/PB: Add info about 6to4 support in kernel series 2.2.x and add an entry in URL list and at maillists
0.212002-02-26/PB: Migrate next grammar checks submitted by John Ronan
0.20.42002-02-21/PB: Migrate more grammar checks submitted by John Ronan, add some additional hints at DNS section
0.20.32002-02-12/PB: Migrate a minor grammar check patch submitted by John Ronan
0.20.22002-02-05/PB: Add mipl to maillist table
0.20.12002-01-31/PB: Add a hint how to generate 6to4 addresses
0.202002-01-30/PB: Add a hint about default route problem, some minor updates
0.19.22002-01-29/PB: Add many new URLs
0.19.12002-01-27/PB: Add some forgotten URLs
0.192002-01-25/PB: Add two German books, fix quote entinities in exported SGML code
0.18.22002-01-23/PB: Add a FAQ on the program chapter
0.18.12002-01-23/PB: Move "the end" to the end, add USAGI to maillists
0.182002-01-22/PB: Fix bugs in explanation of multicast address types
0.17.22002-01-22/PB: Cosmetic fix double existing text in history (at 0.16), move all credits to the end of the document
0.17.12002-01-20/PB: Add a reference, fix URL text in online-test-tools
0.172002-01-19/PB: Add some forgotten information and URLs about global IPv6 addresses
0.162002-01-19/PB: Minor fixes, remove "bold" and "emphasize" formats on code lines, fix "too long unwrapped code lines" using selfmade utility, extend list of URLs.
0.152002-01-15/PB: Fix bug in addresstype/anycast, move content related credits toend of document
0.142002-01-14/PB: Minor review at all, new chapter "debugging", review "addresses", spell checking, grammar checking (from beginning to 3.4.1) by Martin Krafft,add tcpdump examples, copy firewalling/netfilter6 from IPv6+Linux-HowTo, minorenhancements
0.132002-01-05/PB: Add example BIND9/host, move revision history to end of document, minor extensions
0.122002-01-03/PB: Merge review of David Ranch
0.112002-01-02/PB: Spell checking and merge review of Pekka Savola
0.102002-01-02/PB: First public release of chapter 1
References
1. http://www.bieringer.de/pb/ 2. http://www.linuxports.com/howto/intro_to_networking/ 3. http://rfc.net/rfc1884.html 4. http://rfc.net/rfc3056.html/ 5. http://rfc.net/rfc2893.html 6. http://rfc.net/rfc2373.html 7. http://standards.ieee.org/regauth/oui/tutorials/EUI64.html 8. http://rfc.net/rfc3041.html 9. ftp://ftp.ietf.org/internet-drafts/ 10. http://rfc.net/rfc1519.html 11. http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status-distributions.html 12. http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status-distributions.html 13. http://www.linuxdoc.org/HOWTO/Kernel-HOWTO.html 14. ftp://ftp.bieringer.de/pub/linux/IPv6/kernel 15. http://www.linux-ipv6.org/faq.html 16. http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status-kernel.html#transport 17. http://rfc.net/rfc1055.html 18. ftp://ftp.inr.ac.ru/ip-routing/ 19. http://rpmfind.net/linux/rpm2html/search.php?query=iproute 20. http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status-distributions.html 21. file://localhost/tmp/zh-sgmltools.21666/IPv6&Linux-CurrentStatus-Applications 22. http://www.bieringer.de/linux/IPv6/IPv6-HOWTO/IPv6-HOWTO-3.html 23. http://www.bieringer.de/linux/IPv6/IPv6-HOWTO/IPv6-HOWTO-4.html 24. http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status-apps.html#HTTP 25. http://[3ffe:400:100::1]/ 26. http://www.kame.net/ 27. http://rfc.net/rfc2893.html 28. http://rfc.net/rfc3056.html 29. http://rfc.net/rfc3056.html 30. http://www.kfu.com/~nsayer/6to4/ 31. http://www.faqs.org/rfcs/rfc3068.html 32. http://rfc.net/rfc2473.html 33. http://www.bieringer.de/linux/IPv6/ 34. http://www.bieringer.de/linux/IPv6/IPv6-HOWTO/scripts/current/ 35. http://www.feyrer.de/IPv6/SuSE73-IPv6+6to4-setup.html 36. http://people.debian.org/~csmall/ipv6/ 37. http://www.netfilter.org/ 38. http://lists.samba.org/pipermail/netfilter/ 39. http://lists.samba.org/pipermail/netfilter-devel/ 40. http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status-kernel.html#netfilter6 41. http://www.kernel.org/ 42. http://www.netfilter.org/ 43. ftp://ftp.redhat.com/redhat/linux/rawhide/SRPMS/SRPMS/ 44. http://www.bieringer.de/linux/IPv6/status/IPv6?status-apps.html#security-auditing 45. http://www.insecure.org/nmap/ 46. http://www.freeswan.org/ 47. http://www.ipv6.iabg.de/downloadframe/ 48. http://www.freeswan.org/doc.html 49. file://localhost/tmp/zh-sgmltools.21666/Linux-IPv6-HOWTO.txt.html 50. http://www.join.uni-muenster.de/lab/testtools.html 51. http://www.ipng.nl/ 52. http://www.6bone.net/6bone_hookup.html 53. http://www.6bone.net/6bone_hookup.html 54. http://www.arin.net/ 55. http://www.ripe.net/ 56. http://www.apnic.net/ 57. http://lacnic.org/ 58. http://www.ripe.net/ripencc/mem-services/registration/ipv6/ipv6allocs.html 59. http://www.freenet6.net/ 60. http://ipv6tb.he.net/ 61. https://carmen.cselt.it/ipv6tb/ 62. http://tunnel.be.wanadoo.com/ 63. http://tb.6test.edu.cn/ 64. http://joshua.informatik.uni-leipzig.de/ 65. http://www.iij.ad.jp/IPv6/index-e.html 66. http://www.xs26.net/ 67. http://www.ipng.nl/ 68. http://www.uninett.no/testnett/index.en.html 69. http://www.uk.v6.ntt.net/ 70. http://www.nttv6.net/ 71. http://www.es.net/hypertext/welcome/pr/ipv6.html 72. http://www.6ren.net/ 73. http://www.ipv6-net.de/ 74. http://www.kfu.com/~nsayer/6to4/ 75. http://www.faqs.org/rfcs/rfc3068.html 76. http://hs247.com/ 77. http://bofh.st/ipv6/ 78. http://www.ipv6-net.de/ 79. http://www.hs247.com/ipv6rfc.html 80. http://playground.sun.com/pub/ipng/html/specs/standards.html 81. http://www.ipv6.org/specs.html 82. http://www.ietf.org/ids.by.wg/ipv6.html 83. http://www.ietf.org/ids.by.wg/ngtrans.html 84. http://www.ietf.org/ids.by.wg/dhc.html 85. http://www.ietf.org/ids.by.wg/dnsext.html 86. http://www.ietf.org/ids.by.wg/mobileip.html 87. http://www.networksorcery.com/enp/protocol/ipv6.htm 88. http://www.switch.ch/lan/ipv6/references.html 89. http://steinbeck.ucs.indiana.edu:47401/ 90. http://www.space.net/~gert/RIPE/ 91. http://www.bieringer.de/linux/IPv6/ 92. ftp://ftp.bieringer.de/pub/linux/IPv6/ 93. http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status.html 94. http://www.linux-ipv6.org/ 95. ftp://ftp.linux-ipv6.org/pub/ 96. http://www.bugfactory.org/~gav/ipv6/ 97. http://project6.ferrara.linux.it/ 98. ftp://ftp.ferrara.linux.it/pub/project6/ 99. http://www.pld.org.pl/ 100. http://www.redhat.com/ 101. http://www.netcore.fi/pekkas/linux/ipv6/ 102. http://www.debian.org/ 103. http://people.debian.org/~csmall/ipv6/ 104. http://www.suse.com/ 105. http://www.linux-mandrake.com/
2. 什麼是IPv6?
IPv6是新的第三層傳輸協議(參 考http://www.linuxports.com/howto/intro_to_networking/c4412.htm#PAGE10 3HTML),它將用來取代IPv4(也叫做IP).
IPv4是很早以前設計的,現在對IPv4提供更多的地址和性能方面有著更高的要求. 在IPv6中主要的變革是重新設計了報頭. 包括將地址位的大小從32 bits 增加到 128 bits. 因為第三層傳輸主要負責end-to-end(端對端)基於地址的數據包路 由. 它必需包含新的IPv6地址(來源和目標),這點就像IPv4一樣.
下面這個連結提供了更多有關IPv6的資訊, 和RFC 的例表等等:
http://www.switch.ch/lan/ipv6/references.html
2.1 IPv6在Linux作業系統上的歷史
將要做的: 更好的時間排列, 更多的內容...
2.2 開始
第一次將與IPv6有關的代碼加入 Linux kernel 2.1.8 的工作是由Pedro Roque 在1996年11月完成的. 它基於BSD API: ______________________________________________________________
diff -u --recursive --new-file v2.1.7/linux/include/linux/in6.h linux/include/linux/in6.h--- v2.1.7/linux/include/linux/in6.h Thu Jan 1 02:00:00 1970+++ linux/include/linux/in6.h Sun Nov 3 11:04:42 1996@@ -0,0 +1,99 @@+/*+ * Types and definitions for AF_INET6+ * Linux INET6 implementation+ * + * Authors:+ * Pedro Roque <******>+ *+ * Source:+ * IPv6 Program Interfaces for BSD Systems+ * <draft-ietf-ipngwg-bsd-api-05.txt> ______________________________________________________________
以上的代碼來自patch-2.1.8 (e-mail 地址在複製&貼上時漏掉了)
2.3 其間
因為缺少人手, 在核心加入IPv6的計劃不能按照討論的或新的RFCs執行.
在2000年的10月, 一個叫做USAGI(http://www.linux-ipv6.org/)的計劃在日本 正式啟動. 目標是執行所有不見了的, 擱淺的(IPv6 support in Linux)計劃. 計劃緊隨 KAME project (http://www.kame.net/) 的腳步. 依據 vanilla Linux 核心源代碼進行遂步的改動.
2.4 現在
不幸的是 USAGI 的 patch(補丁)很大, Linux networking 維護人員無法將它包 含進現在Linux 2.4.x 系列的源代碼當中去. 因此2.4.x 失去了一些(多數)括展 性, 並且不支持所有當前的設計和RFCs. 這導致了它和其它作業系統會產生一些 協同問題.
2.5 將來
USAGI 現在正在將當前的括展加入到 Linux 2.5.x 核心當中.
希望2.6.x 系列核心能有一個真正和最新的IPv6功能.
2.6 IPv6 的地址會是什麼樣 ?
剛才提過, IPv6 的地址有128 bits 長. 這樣的 bits 可以產生39個十進字數 字: ______________________________________________________________
2^128-1: 340282366920938463463374607431768211455 ______________________________________________________________
這樣的地址很難記得住. IPv6的地址是逐位定位的(就像IPv4, 但這個觀點不是 公認的). 所以十六進制能更好地代表這些數字, 4 bits(也叫做"nibble")表現 為數字(0-9)或字符 a-f(10-15). 這種格式將IPv6的地址長度縮減到個32字符. ______________________________________________________________
2^128-1: 0xffffffffffffffffffffffffffffffff ______________________________________________________________
這種表現形式仍然很不方便. (可能混淆或遺漏單個十六進制數字), 所以IPv6的 設計者將地址形式定為每16bit就用":"區分開來. 開頭的"0x"(在程式設計當中 用來表示十六進制數值)被移除了: ______________________________________________________________
2^128-1: ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff ______________________________________________________________
一個有效的地址(稍後請看地址類型)如下: ______________________________________________________________
3ffe:ffff:0100:f101:0210:a4ff:fee3:9566 ______________________________________________________________
為了簡化, 每個16bit開頭的0可以被省略: ______________________________________________________________
3ffe:ffff:0100:f101:0210:a4ff:fee3:9566 -> 3ffe:ffff:100:f101:210:a4ff:fee3:9566 ______________________________________________________________
連續的並且數值為0的16bit地址段可以用"::"表示. 但是一個IPv6地址當中只能 出現一次, 不然這種方法保持不了多久. ______________________________________________________________
3ffe:ffff:100:f101:0:0:0:1 -> 3ffe:ffff:100:f101::1 ______________________________________________________________
簡化得最短的IPv6 localhost地址: ______________________________________________________________
0000:0000:0000:0000:0000:0000:0000:0001 -> ::1 ______________________________________________________________
這種方法也叫做 compact (base85 coded) representation defined RFC 1924 / A IPv6緊湊地址表示法(定於1996), 但沒有提起過, 例如: ______________________________________________________________
# ipv6calc --addr_to_base85 3ffe:ffff:0100:f101:0210:a4ff:fee3:9566Itu&-ZQ82s>J%s99FJXT ______________________________________________________________
資訊: ipv6calc 是一個IPv6地址格式的計算和轉換的計劃, 您可以在這裡找到: http://www.bieringer.de/linux/IPv6/ipv6calc/
2.7 FAQ(基礎)
為什麼叫IPv6,而不能成為IPv4之後的IPv5 ?
在任何IP頭, 前4bits 是為協議版本號所保留的. 所以理論上一個協議的版本號 在0和15之間是有效的:
* 4 己經為IPv4所使用. * 5 為 Stream 協議所保留(STP, RFC 1819 http://rfc.net/rfc1819.html 沒有公開過)
IPv4之後可用的版本號是6, 因此 IPv6 就這樣旦生了!
IPv6 地址: 為什麼會有這麼長的bits
在設計IPv4的時候,人們認為32bit的長度足夠全世界使用. 看一看這些年, 32bit 就現在和未來幾年來說是足夠的. 然而, 32bits 不能在將來滿足全球各 種網路設備對IP地址的需求. 想一想將來要連結網路的移動電話, 汽車(包括電 子總控系統), 烤麵包機,冰箱, 照明開關...
所以設計者採用了128bits, 是今天IPv4 大小(2^96)與長度的4倍.
實際使用的大小可能比它看起來的還要小. 因為現在的定義地址設計, 64bits 用於interface identifiers(界面標識). 另外64bits用於路由. 寄於現在嚴格 的層數集合(/48, /35, ...), IPv6 所能提供的地址空間還是可能不夠, 希望這 種情況不要在往後的幾年裡發生.
IPv6 地址: 為什麼在新的設計裡bits這麼小?
雖然, (可能)有些人(在Internet裡)考慮IPv8和IPv6, 設計無論從接受和執行都 是那麼的遙遠. 在此其間128bit對於報頭和數據傳輸來說是最佳的選擇.
考慮到在IPv4里和IPv6里的最大/最小傳輸單位(MTU,它們分別是576byte 和 1280 byte), IPv4 的報頭是20 byte(最小值,可以通過調節IPv4的選項增大 到60byte), IPv6 的報頭是48 byte(固定不變的), 報頭分別占它們MTU的3.4% 和3.8%, 這意昧著報頭佔了很大一部分開銷. 更大bits的地址需要更大的報頭, 因而佔據更大的開銷.
同樣,顧及到MTU正常連結的最大值(像現在的以太網): 1500byte(除了特別的列 子:9k byte 應用在 Jumbo frames 當中). 最終,如果要傳輸在第三層數據包中 占10%或20%報頭, 這樣的IP地址在設計上也就沒有意義了.
3. 地址的類型
3.1 沒有前綴的地址
Localhost 地址
這是一個特別為loopback interface(回送界面或環繞)定義的地址, 就像IPv4的 "127.0.0.1" 對於IPv6 localhost address 是: ______________________________________________________________
0000:0000:0000:0000:0000:0000:0000:0001 ______________________________________________________________
或縮減成 ______________________________________________________________
::1 ______________________________________________________________
這個地址的數據包將它當作host(主機)發送的來源和目標.
未指明的地址
這是一個在IPv4當中表示 "所有" 或"0.0.0.0". 對於IPv6為: ______________________________________________________________
0000:0000:0000:0000:0000:0000:0000:0000 ______________________________________________________________
或者是: ______________________________________________________________
:: ______________________________________________________________
這些地址大多 用在/顯示 socket 捆綁(到所有IPv6地址)或路由表當中.
注意:未說明的地址不能當成目標地址來使用.
植入了IPv4地址的IPv6地址
它包含了兩個地址其中一個為IPv4地址.
IPv4映射IPv6地址
IPv4-only IPv6-compatible 是由IPv6後台產生的有時 用於或顯示 sockets . 它只捆綁IPv4地址.
這些地址被定義為擁有長度為96的前綴特殊地址(a.b.c.d 是IPv4地址): ______________________________________________________________
0:0:0:0:0:ffff:a.b.c.d/96 ______________________________________________________________
或者使用縮寫形式 ______________________________________________________________
::ffff:a.b.c.d/96 ______________________________________________________________
這些地址也用於自動遂道, 已經被6to4tunneling取代.
3.2 網路部分,也叫做前綴
設計者定義並預留了一部份空間以便於將來遇到像現在這樣的需求. RFC 2373 [July 1998] / IP Version 6 Addressing Architecture (http://rfc.net/rfc2373.html) 定義了現在的地址設計, 但已經有了新的草案 (ftp://ftp.ietf.org/internet-drafts/)draft-ietf-ipngwg-addr-arch-*.txt
讓我們來看一下不同的前綴定義(和地址類型):
連結本地地址的類型
這些地址不對外界(Internet)連接有效. 以這些地址為目標的數據包不會通過路 由器. 這種連結用於以下情形:
* 同其它任意一個也使用這個連結的人進行通訊. * 同其它任意一個擁有特殊地址的連結進行通訊.(例如尋找路由)
它們的地址由以下這些開頭("x"是任意的十六進制字符,一般是"0") ______________________________________________________________
fe8x: <- 目前只有這個在用.fe9x:feax:febx: ______________________________________________________________
一個開頭為以上這些前綴的地址, 由IPv6沒有在界面指定IP地址的時候創立.
目前只有fe80在使用.
本地站點的地址定義
這些地址和IPv4相似(http://rfc.net/rfc1918.html RFC 1918 / Address Allocation for Private Internets) 它的優勢: 只用16bits 就可以定義65536 個子網.同IPv4的10.0.0.0/8相似.
另一個優勢:在IPv6的界面上可以定義多個IP地址, 在已有本地站點地址的基礎 上還可以加上一個global(全局)地址.
它們的地址由以下這些開頭("x"是任意的十六進制字符,一般是"0") ______________________________________________________________
fecx: <- 大多數使用這個fedx:feex:fefx: ______________________________________________________________
Global(全局)地址類型 "(Aggregatable) global unicast"可聚合的全局唯一地址.
今天,只有一個全局地址類型的定義(第一個設計,也是多年以來一直使用的叫做 "provider based," [3]RFC 1884 / IP Version 6 Addressing Architecture [obsolete]) 您能在早期的核心源代碼中找到一些.
它們的地址由以下這些開頭("x"是任意的十六進制字符,一般是"0") ______________________________________________________________
2xxx:3xxx: ______________________________________________________________
注意: 前綴"aggregatable" 被當前的草案拋棄了. 下面有一些更有意義的子類 型定義:
6bone test addresses
這些是最初定義和使用的全局地址. 它們的開頭是 ______________________________________________________________
3ffe: ______________________________________________________________
例子 ______________________________________________________________
3ffe:ffff:100:f102::1 ______________________________________________________________
一個無唯一全局化的特別6bone例子 ______________________________________________________________
3ffe:ffff:100:f102::1 ______________________________________________________________
這些主要都是例子, 因為如果使用真實的地址,可能會有些人將它拷貝&貼上 到 他們自己的配置中去. 從而不注意地複製了全局唯一地址, 這樣會導致原來擁有 這個地址的主機產生一些問題(比如,請求的回應包不會被發送.) 您可以從這些 前綴當中申請一個, 看這裡: "如何加入6bone" 也有一些在 tunnel brokers 他 們發佈用於測試6bone 的地址前綴.
6to4 地址
這些地址是為特別tunneling機制設計的. [4][RFC 3056 / Connection of IPv6 Domains via IPv4 Clouds 和 [5]RFC 2893 / Transition Mechanisms for IPv6 Hosts and Routers], 給IPv4地址和可能的子網編碼並以類似下面的形式 開頭: ______________________________________________________________
2002: ______________________________________________________________
例子,重新對192.168.1.1/5編碼: ______________________________________________________________
2002:c0a8:0101:5::1 ______________________________________________________________
這個shell命令將幫助您用一個IPv4地址產生這樣的地址: ______________________________________________________________
ipv4="1.2.3.4"; sla="5"; printf "2002:%02x%02x:%02x%02x:%04x::1" `echo $ipv4 |tr "." " "` $sla ______________________________________________________________
參照tunneling using 6to4 and information about 6to4 relay routers.
從分級路由分配到的地址
這些地址分配給Internet服務供商(ISP)並且有類似如下的開頭: ______________________________________________________________
2001: ______________________________________________________________
主ISP(擁有骨幹網路)的前綴是由local registries分配的, 並且現在他們分配 的前綴長度為35.
主ISPs通常分配給下級ISPs的前綴長度為48.
Multicast addresses(多點傳送的地址)
Multicast addresses 應用於服務當中.
它們總是有同下面相類似的開頭(xx是範圍值) ______________________________________________________________
ffxy: ______________________________________________________________
它們有著不同的範圍和類型:
Multicast scopes(多點傳達送範圍)
Multicast scope 是用來定義發送實體的multicast 數據包有效最遠傳輸值的參 數.
通常,下面的範圍已經被定義: * ffx1: 本地節點, 數據包不會離開節點. * ffx2: 本地連結, 數據包不會被路由,所以它們不會離開這個特別的連結. * ffx5: 本地站點, 數據包不會離開站點. * ffx8: 本地組織, 數據包不會離開組織(執行起來不那麼容易,必須依靠路由 協議) * ffxe: 全局範圍. * 其它的都被保留
Multicast(多點傳送)類型
許多類型都已經定義/保留(細節請參照 [6]RFC 2373 / IP Version 6 Addressing Architecture). 這裡有一些例子: * 所有節點地址: ID=1h, 所有本地節點主機的地址(ff01:0:0:0:0:0:0:1) 或 已連接好的地址(ff02:0:0:0:0:0:0:1). * 所有路由地址:ID=2h,所有本地節點的路由地址(ff01:0:0:0:0:0:0:2), 已 連接的(ff02:0:0:0:0:0:0:2), 或本地站點(ff05:0:0:0:0:0:0:2).
Solicited node link-local multicast address(本地多播請求的節點地址)
在neighborhood discovery(多播發現)中當成目標地址使用的特別多播地址. 與IPv4不同,ARP(地址解析協議)將不在IPv6中使用.
例子: ______________________________________________________________
ff02::1:ff00:1234 ______________________________________________________________
使用前綴表示它是一個本地多播地址, 後綴由目標地址產生. 這個例子當中將有 一個數據包發往"fe80::1234", 但是網路堆棧並不知道第二層的MAC(多媒體通 路). 它將上部份的104 bits 更改為 "ff02:0:0:0:0:1:ff00::/104" 下部分24 bits 不變. 現在這個地址以on-link(在線)的形式尋找相應的節點(這個節點應 當發送了包含有第二層 MAC 地址的回應包)
Anycast addresses(隨播地址)
Anycast addresses是一個特別的地址, 它用於鄰近的DNS或DHCP服務, 或用於相 似的dynamic groups(動態組群). 地址從 unicast address (單播地 址aggregatable global or site-local at the moment)空間中取得. 隨播地址 的機制(從客戶端的觀點來看)由動態路由協議控制.
注意:隨播地址不能成為作為來源地址, 它必需以目標地址的身份出現.
Subnet-router Anycast addresses(子網路隨播路由器)
一個Subnet-router Anycast addresses的例子. 假設一個分配了如下IPv6地址 的節點: ______________________________________________________________
3ffe:ffff:100:f101:210:a4ff:fee3:9566/64 <- 節點的地址 ______________________________________________________________
Subnet-router將使用沒有後綴的地址 (least significant 64 bits): ______________________________________________________________
3ffe:ffff:100:f101::/64 <- subnet-router anycast address ______________________________________________________________
3.3 地址類型(主機)
因為自動的配製/隨機分配,在當前的地址類型中主機使用更低的 64 bits地址. 因此每個subnet(子網)可以擁有大量的地址.
主機的地址分配可以有如下幾種形式:
自動分配(also known as stateless)
在自動分配當中,主機的地址由界面的MAC地址決定. 使用EUI-64方法,指定一 個IPv6 地址. 如果沒有可用的MAC(如:虛擬設備), 就用其它的代替(如IPv4地址 或物理界面的MAC地址)
再看一下前面的例子: ______________________________________________________________
3ffe:ffff:100:f101:210:a4ff:fee3:9566 ______________________________________________________________
這裡: ______________________________________________________________
210:a4ff:fee3:9566 ______________________________________________________________
主機地址由NIC的MAC地址決定: ______________________________________________________________
00:10:A4:E3:95:66 ______________________________________________________________
用 [7]IEEE-Tutorial EUI-64 作為EUI-48 的標識符.
自動分配帶來的隱私問題
因為自動分配的是唯一地址,客戶端在不通過任何代理的情況下容易被跟蹤. 這 是個公認的問題,它的解決方法是:privacy extension,定義於 [8]RFC 3041 / Privacy Extensions for Stateless Address Autoconfiguration in IPv6 這 裡也有一個草案: [9]draft-ietf-ipngwg-temp-addresses-*.txt 使用不同的靜 態數值, 每次產生一個新的後綴. 注意: 只對client 的連接有效, 對於servers 沒有什麼用處.
手動設定
對於servers來說, 大概很容易記起簡單的地址. 同時也可以向它的界面添加一 個IPv6地址: ______________________________________________________________
3ffe:ffff:100:f101::1 ______________________________________________________________
手動設定的後綴為"::1",例子當中最重要的第6 bits設定為"0", 它為anycast addresses(任意傳送地址)保留 (the universal/local bit of the automatically generated identifier).
3.4 路由的前綴長度
在早期設計階級,使用完全分離的路由分級來最大層度地縮小路由表. 論證的方 法是使用當前IPv4的核心路由數目(> 104 thousand in May 2001) 減少硬體記 憶體的需求來控制路由表和速度(較少的個數使查找速度加快).
前綴長度(也叫做子網路遮罩)
同IPv4相似, 網路產生可路由的路徑. 因為128 bits標準的netmasks 看起來不 怎麼樣. 設計者借鑒了IPv4的風格: Classless Inter Domain Routing (CIDR [10]RFC 1519 / Classless Inter-Domain Routing) 它們是用於IP地址路由 的bits號碼. 也叫做"/"
例子: ______________________________________________________________
3ffe:ffff:100:1:2:3:4:5/48 ______________________________________________________________
它們可以被擴展成: ______________________________________________________________
網路:3ffe:ffff:0100:0000:0000:0000:0000:0000 ______________________________________________________________ ______________________________________________________________
子網路遮罩:ffff:ffff:ffff:0000:0000:0000:0000:0000 ______________________________________________________________
Matching a route(路由匹配)
在一般情況下(no QoS), 在路由表裡查找一個重要的地址數值意味著路由前綴的 長度必需先匹配.
例子, 如果路由表像下面那樣(清單未完全例出): ______________________________________________________________
3ffe:ffff:100::/48 :: U 1 0 0 sit12000::/3 ::192.88.99.1 UG 1 0 0 tun6to4 ______________________________________________________________
IPv6的目標地址將被下面的設備路由: ______________________________________________________________
3ffe:ffff:100:1:2:3:4:5/48 -> routed through device sit13ffe:ffff:200:1:2:3:4:5/48 -> routed through device tun6to4 ______________________________________________________________
4. 準備IPv6的運行系統
4.1 IPv6-ready kernel
現在的Linux發行版的核心都具備了運行IPv6的條件. IPv6功能被編譯成一個可 載入模組. 在一般情況下模組不會在開機的時候自動載入.
參照更新的資訊: [11]IPv6+Linux-Status-Distribution
檢察現在的系統是否支持IPv6
注意您的/proc-file-system.必需有如下的結構: ______________________________________________________________
/proc/net/if_inet6 ______________________________________________________________
一個簡單的測試: ______________________________________________________________
# test -f /proc/net/if_inet6 && echo "Running kernel is IPv6 ready" ______________________________________________________________
如果失敗, 表明模組沒有載入.
試著載入模組
執行載入模組的命令: ______________________________________________________________
# modprobe ipv6 ______________________________________________________________
如果成功, 模組會在列表中顯示,執行如下命令: ______________________________________________________________
# lsmod |grep -w 'ipv6' && echo "IPv6 module successfully loaded" ______________________________________________________________
讓模組自動載入
模組是可以自動載入的,只要在核心模組設定文件( /etc/modules.conf 或 /etc/conf.modules)中加入: ______________________________________________________________
alias net-pf-10 ipv6 # automatically load IPv6 module on demand ______________________________________________________________
也可以關掉IPv6模組的自動載入: ______________________________________________________________
alias net-pf-10 off # disable automatically load of IPv6 module on demand ______________________________________________________________
編譯有 IPv6 功能的核心
如果以上兩個結果都證實了核心不具有IPv6功能, 您可以有如下選擇: * 升級成外包裝有IPv6支持說明的Linux發行版(推薦新手使用)再看一下這裡: [12]IPv6+Linux-Status-Distribution * 編譯一個新的vanilla核心(如果您知道該怎麼選擇,會比較簡單). * 重新編譯您現在擁有的發行版核心(不太容易). * 將核心同 USAGI 的擴展一起編譯.
如果您決定編譯一個核心,您必需讀過 [13]Linux Kernel HOWTO. 以及這方面的 經驗.
注意:您必需使用核心2.4.x系列或更高. 因為IPv6對2.2.x系列缺少相應的支持. 並且需要ICMPv6 和 6to4 支持的補丁.(補丁可以在 [14]kernel series 2.2.x IPv6 patches找到).
將核心同 USAGI 的擴展一起編譯.
只推薦熟悉核心編譯和IPv6的用戶使用. 參照: [15]USAGI project / FAQ.
IPv6-ready network devices
不是所有的設備都有能力傳輸IPv6數據包, 這裡有一個現狀表: [16] IPv6+Linux-status-kernel.html#transport.
現階段不會支持IPv6的連結
* Serial Line IP (SLIP, [17]RFC 1055), should be better called now to SLIPv4, device named: slX * Parallel Line IP (PLIP), same like SLIP, device names: plipX * ISDN with encapsulation rawip, device names: isdnX
在將來都不會支持IPv6的設備
* ISDN with encapsulation syncppp, device names: ipppX (design issue of the ipppd, will be merged into more general PPP layer in kernel series 2.5.x)
4.2 IPv6-ready 網路設定工具
別扯太遠了, 如果您有一個正在運行IPv6的核心,怎麼會沒有設定的工具呢? 安 裝包裡早就有幾個這樣的工具了.
net-tools package
net-tools package 包含一些工具如: ifconfig ,route. 這些可以令您在界面 上設定IPv6. 在命令行(shell) 用ifocnig -? 或 route -? 查看諸如IPv6 或 inet6.如果有,則說明具備IPv6設定能力.
輸入以下命令進行檢查: ______________________________________________________________
# /sbin/ifconfig -? 2>& 1|grep -qw 'inet6' && echo "utility 'ifconfig' is?IPv6-ready" ______________________________________________________________
也可以使用route: ______________________________________________________________
# /sbin/route -? 2>& 1|grep -qw 'inet6' && echo "utility 'route' is IPv6-ready" ______________________________________________________________
iproute package
Alexey N. Kuznetsov (Linux 網路代碼現階段的維護者) 寫了一個tool-set可 以通過netlink 設備來設定網路.它可以比net-tool提供更多的功能, 但沒有多 少文檔並且它不是為膽小的人設計的. ______________________________________________________________
# /sbin/ip 2>&1 |grep -qw 'inet6' && echo "utility 'ip' is IPv6-ready" ______________________________________________________________
如果沒有找到 /sbin/ip 那麼我極力推薦您安裝iproute package. * 可以在您的發行版中找到(如果有的話) * 在 [18]Original FTP source下載並編譯它. * 直接可以安裝的RPM包: [19]RPMfind/iproute (推薦編譯 SRPMS )
4.3 IPv6-ready 測試/調式 程式
在為IPv6準備好了系統後,您可以用IPv6進行網路通訊. 首先您必需學習如何用 嗅探程式來檢查IPv6數據包. 強烈推薦這樣做,因為 在debugging/troubleshooting 中有利於快速診斷.
IPv6 ping
這個程式一般在iputils包裡, 用來測試簡單傳輸發送 ICMPv6 回應請求並等 待ICMPv6 回應包.
用法: ______________________________________________________________
# ping6 < hostwithipv6address ># ping6 < ipv6address ># ping6 [-I < device >] < link-local-ipv6address > ______________________________________________________________
例子: ______________________________________________________________
# ping6 -c 1 ::1PING ::1(::1) from ::1 : 56 data bytes64 bytes from ::1: icmp_seq=0 hops=64 time=292 usec--- ::1 ping statistics ---1 packets transmitted, 1 packets received, 0% packet lossround-trip min/avg/max/mdev = 0.292/0.292/0.292/0.000 ms ______________________________________________________________
提示 ping6必需有適當的root權限才能使用, 如果不是root組用戶,使用時可能 產生問題:
1.ping6 不在用戶的路徑當中 (probably, because ping6 is generally stored in /usr/sbin -> add path (not really recommended)
2.ping6 不能被正確執行, 通常沒有適當的權限 chmod u+s /usr/sbin/ping6
為ping6指定界面
用local-addresses 作為ping6 目標必需指定一個界面. 否則核心將不知道數據 包發往哪個設備. 在沒有指定的情況下會有這樣的輸出: ______________________________________________________________
# ping6 fe80::212:34ff:fe12:3456connect: Invalid argument ______________________________________________________________
為ping6指定界面的結果: ______________________________________________________________
# ping6 -I eth0 -c 1 fe80::2e0:18ff:fe90:9205PING fe80::212:23ff:fe12:3456(fe80::212:23ff:fe12:3456) from?fe80::212:34ff:fe12:3478 eth0: 56 data bytes64 bytes from fe80::212:23ff:fe12:3456: icmp_seq=0 hops=64 time=445 usec--- fe80::2e0:18ff:fe90:9205 ping statistics ---1 packets transmitted, 1 packets received, 0% packet loss round-trip?min/avg/max/mdev = 0.445/0.445/0.445/0.000 ms ______________________________________________________________
Ping6 to multicast addresses(多播地址)
一個發現IPv6-active hosts 的比較有趣的機制: ______________________________________________________________
# ping6 -I eth0 ff02::1 PING ff02::1(ff02::1) from fe80:::2ab:cdff:feef:0123 eth0: 56 data bytes64 bytes from ::1: icmp_seq=1 ttl=64 time=0.104 ms64 bytes from fe80::212:34ff:fe12:3450: icmp_seq=1 ttl=64 time=0.549 ms (DUP!) ______________________________________________________________
與IPv4不同的是, ping 的回應在廣播地址中是可以屏蔽的,目前只有IPv6防火牆 可以做到.
IPv6 traceroute6
這個程式一般在iputils包裡, 和IPv4的traceroute程式相似, 但與當前版本不 同的是IPv6不能正確地使用ICMP echo-request. 看下面這個例子: ______________________________________________________________
# traceroute6 www.6bone.nettraceroute to 6bone.net (3ffe:b00:c18:1::10) from 3ffe:ffff:0000:f101::2, 30?hops max, 16 byte packets 1 localipv6gateway (3ffe:ffff:0000:f101::1) 1.354 ms 1.566 ms 0.407 ms 2 swi6T1-T0.ipv6.switch.ch (3ffe:2000:0:400::1) 90.431 ms 91.956 ms 92.377 ms 3 3ffe:2000:0:1::132 (3ffe:2000:0:1::132) 118.945 ms 107.982 ms 114.557 ms 4 3ffe:c00:8023:2b::2 (3ffe:c00:8023:2b::2) 968.468 ms 993.392 ms 973.441 ms 5 3ffe:2e00:e:c::3 (3ffe:2e00:e:c::3) 507.784 ms 505.549 ms 508.928 ms 6 www.6bone.net (3ffe:b00:c18:1::10) 1265.85 ms * 1304.74 ms ______________________________________________________________
IPv6 tracepath6
這個程式一般在iputils包裡, 它用來追蹤MTU的路徑.看下面的例子: ______________________________________________________________
# tracepath6 www.6bone.net 1?: [LOCALHOST] pmtu 1480 1: 3ffe:401::2c0:33ff:fe02:14 150.705ms 2: 3ffe:b00:c18::5 267.864ms 3: 3ffe:b00:c18::5 asymm 2 266.145ms pmtu 1280 3: 3ffe:3900:5::2 asymm 4 346.632ms 4: 3ffe:28ff:ffff:4::3 asymm 5 365.965ms 5: 3ffe:1cff:0:ee::2 asymm 4 534.704ms 6: 3ffe:3800::1:1 asymm 4 578.126ms !NResume: pmtu 1280 ______________________________________________________________
IPv6 tcpdump
在Linux作業系統中 tcpdump 是主要的數據包捕獲工具.IPv6支持 3.6 的版本.
tcpdump用於降低數據包雜訊的參數: * icmp6: 過濾本地ICMPv6通訊. * ip6: 過濾本地IPv6通訊.(包括 ICMPv6) * proto ipv6: filters tunneled IPv6-in-IPv4 traffic * not port ssh: 在遠程SSH會話中禁止SSH數據包的顯示. to suppress displaying SSH packets for running tcpdump in a remote SSH session
使用命令行參數也可以從一個數據包中捕獲/列印資訊. * "-s 512": 增加捕獲限定為512 bytes. * "-vv": 詳細列印. * "-n": 不將地址轉換成名稱,在名稱服務有問題時可以用到.
IPv6 ping to 3ffe:ffff:100:f101::1 native over a local link ______________________________________________________________
# tcpdump -t -n -i eth0 -s 512 -vv ip6 or proto ipv6tcpdump: listening on eth03ffe:ffff:100:f101:2e0:18ff:fe90:9205 > 3ffe:ffff:100:f101::1: icmp6: echo?request (len 64, hlim 64)3ffe:ffff:100:f101::1 > 3ffe:ffff:100:f101:2e0:18ff:fe90:9205: icmp6: echo?reply (len 64, hlim 64) ______________________________________________________________
IPv6 ping to 3ffe:ffff:100::1 routed through an IPv6-in-IPv4-tunnel
1.2.3.4和5.6.7.8是遂道的終點(這些都是例子). ______________________________________________________________
# tcpdump -t -n -i ppp0 -s 512 -vv ip6 or proto ipv6tcpdump: listening on ppp01.2.3.4 > 5.6.7.8: 2002:ffff:f5f8::1 > 3ffe:ffff:100::1: icmp6: echo request?(len 64, hlim 64) (DF) (ttl 64, id 0, len 124)5.6.7.8 > 1.2.3.4: 3ffe:ffff:100::1 > 2002:ffff:f5f8::1: icmp6: echo reply (len?64, hlim 61) (ttl 23, id 29887, len 124)1.2.3.4 > 5.6.7.8: 2002:ffff:f5f8::1 > 3ffe:ffff:100::1: icmp6: echo request?(len 64, hlim 64) (DF) (ttl 64, id 0, len 124)5.6.7.8 > 1.2.3.4: 3ffe:ffff:100::1 > 2002:ffff:f5f8::1: icmp6: echo reply (len?64, hlim 61) (ttl 23, id 29919, len 124) ______________________________________________________________
4.4 IPv6-ready programs(能和IPv6協同工作的程式)
在當前的發行版中已經包含了能和IPv6協同工作的程式(服務端/客戶端) 參照: [20]IPv6+Linux-Status-Distribution. 或者檢查 [21] http://www.bieringer.de/linux/IPv6/status/IPv6+Linux-status-apps.html 一些可用程式的線索: [22]IPv6 & Linux - HowTo - Part 3或 [23]IPv6 & Linux - HowTo - Part 4.
4.5 IPv6-ready 客戶端程式 (selection)
想要進行下面的測試, 您的作業系統必需擁有IPv6能力. 有些例子是真實地連結 了6bone的情況下做的.
檢查DNS對IPv6地址的解析能力
因為這幾年Domain Name System (DNS)安全的不斷升級, 它們中的大部份都具備 了對IPv6 地址類型AAAA的解析能力. (新的類型A6 只有BIND9和更高的版本支 持)檢查DNS對IPv6地址的解析能力: ______________________________________________________________
# host -t AAAA www.join.uni-muenster.de ______________________________________________________________
將得到下面的結果: ______________________________________________________________
www.join.uni-muenster.de. is an alias for ns.join.uni-muenster.de.ns.join.uni-muenster.de. has AAAA address 3ffe:400:10:100:201:2ff:feb5:3806 ______________________________________________________________
IPv6-ready telnet clients
IPv6-ready telnet 客戶端. 對它進行一個簡單的測試: ______________________________________________________________
$ telnet 3ffe:400:100::1 80Trying 3ffe:400:100::1...Connected to 3ffe:400:100::1.Escape character is '^]'.HEAD / HTTP/1.0HTTP/1.1 200 OKDate: Sun, 16 Dec 2001 16:07:21GMT Server: Apache/2.0.28 (Unix)Last-Modified: Wed, 01 Aug 2001 21:34:42 GMTETag: "3f02-a4d-b1b3e080"Accept-Ranges: bytesContent-Length: 2637Connection: closeContent-Type: text/html; charset=ISO-8859-1Connection closed by foreign host. ______________________________________________________________
如果telnet只出現"cannot resolve hostname", 說明作業系統的IPv6還未激活.
openssh
openssh已經支持IPv6, 但必需對它用以下的參數進行編譯後才能使用: * --without-ipv4-default: the client tries an IPv6 connect first automatically and fall back to IPv4 if not working * --with-ipv4-default: default connection is IPv4, IPv6 connection must be force like following example shows: ______________________________________________________________
$ ssh -6 ::1user@::1's password: ******[user@ipv6host user]$ ______________________________________________________________
如果您的ssh不能對 -6 進行反應, 可能作業系統的IPv6還未激活,或ssh的版本 太低.
ssh.com
他們的客戶/服務端程式是免費的.
IPv6-ready web 流覽器
目前支持IPv6的web 流覽器列表: [24]IPv6+Linux-status-apps.html#HTTP.
這些流覽器大部份都存在問題: * 如果 proxy(代理)只支持IPv4, IPv6的請求將會失敗. 方法: 升級proxy * Automatic proxy settings (*.pac) 不能對IPv6的不同請求進行適當的處 理 (written in Java-script and well hard coded in source like to be seen in Maxilla source code).
一些早期的版本不能對IPv6地址進行正確的操作, 如: [25] http://[3ffe:400:100::1]/
一個小測試,顯示在沒有代理的情況下的 URL 和 流覽器.
URLs for testing
測試IPv6最方便的方法是訪問: [26]http://www.kame.net/. 如果海龜是活動 的, 說明連接是通過IPv6進行的, 它不動的話, 說明連接是通過IPv4進行的.
4.6 IPv6-ready server 程式
包括:sshd, httpd, telnetd,
5. 設定interfaces(界面)
5.1 不同的網路設備
一個節點存在不同的網路設備, 可以對它們進行如下分類: * Physically bounded, like eth0, tr0 * Virtually existing, like ppp0, tun0, tap0, sit0, isdn0, ippp0
Physically bounded(物理綁定)
包括 Ethernet 或者 Token-Ring 它們不需要特別的處理.
Virtually bounded(虛擬綁定)
需要特別的支持.
IPv6-in-IPv4 tunnel interfaces
這個interfaces(界面)也稱作sitx, sit 是"Simple Internet Transition" 的 縮寫. 它可以將IPv6的數據包塞進IPv4, 通過IPv4到達另一個地點.
sit0 不能使用在專用的tunnels 上.
5.1.2.2. PPP interfaces
PPP interfaces 從IPv6 enabled PPP daemon 那裡獲得 IPv6 的能力.
5.1.2.3. ISDN HDLC interfaces
具有IP封裝的HDLC IPv6 能力以經包含在核心當中.
5.1.2.4. ISDN PPP interfaces
目前不支持 ISDN PPP interfaces (ippp) aren't IPv6 enabled by kernel. Also there are also no plans to do that because in kernel 2.5.+ they will be replaced by a more generic ppp interface layer.
5.1.2.5. SLIP + PLIP
目前不支持Like mentioned earlier, this interfaces don't support IPv6 transport (sending is OK, but dispatching on receiving don't work).
5.1.2.6. Ether-tap device
Ether-tap devices使用自動的設定.在使用之前先將 "ethertap" 模組掛進來.
5.1.2.7. tun devices
就連我都還沒試過呢! Currently not tested by me.
5.1.2.8. ATM
01/2002: vanilla的核心目前不支持, USAGI 的擴展支持ATM-IPv6
5.1.2.9. 其它的
我漏掉了什麼?
5.2 Bringing interfaces up/down(設定界面的開/關)
使用 "ip"
使用方法: ______________________________________________________________
# ip link set dev <interface> up# ip link set dev <interface> down ______________________________________________________________
例子: ______________________________________________________________
# ip link set dev eth0 up# ip link set dev eth0 down ______________________________________________________________
使用 "ifconfig"
使用方法: ______________________________________________________________
# /sbin/ifconfig <interface> up# /sbin/ifconfig <interface> down ______________________________________________________________
例子: ______________________________________________________________
# /sbin/ifconfig eth0 up# /sbin/ifconfig eth0 down ______________________________________________________________
6. 設定IPv6地址
6.1 列印當前的IPv6地址
使用 "ip"
使用方法: ______________________________________________________________
# /sbin/ip -6 addr show dev <interface> ______________________________________________________________
例子:一個靜態的主機地址 ______________________________________________________________
# /sbin/ip -6 addr show dev eth02: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_ fast qlen 100inet6 fe80::210:a4ff:fee3:9566/10 scope linkinet6 3ffe:ffff:0:f101::1/64 scope globalinet6 fec0:0:0:f101::1/64 scope site ______________________________________________________________
自動設定的地址和它的存活時間: ______________________________________________________________
# /sbin/ip -6 addr show dev eth03: eth0: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc pfifo_fast qlen? 100inet6 2002:d950:f5f8:f101:2e0:18ff:fe90:9205/64 scope global dynamicvalid_lft 16sec preferred_lft 6secinet6 3ffe:400:100:f101:2e0:18ff:fe90:9205/64 scope global dynamicvalid_lft 2591997sec preferred_lft 604797sec inet6 fe80::2e0:18ff:fe90:9205/10? scope link ______________________________________________________________
使用 "ifconfig"
使用方法: ______________________________________________________________
# /sbin/ifconfig <interface> ______________________________________________________________
例子, 它只列印IPv6地址: ______________________________________________________________
# /sbin/ifconfig eth0 |grep "inet6 addr:"inet6 addr: fe80::210:a4ff:fee3:9566/10 Scope:Linkinet6 addr: 3ffe:ffff:0:f101::1/64 Scope:Globalinet6 addr: fec0:0:0:f101::1/64 Scope:Site ______________________________________________________________
6.2 增加一個IPv6地址
其原理同IPv4的"IP ALIAS"(IP別名)相同
使用 "ip"
使用方法: ______________________________________________________________
# /sbin/ip -6 addr add <ipv6address>/<prefixlength> dev <interface> ______________________________________________________________
例子: ______________________________________________________________
# /sbin/ip -6 addr add 3ffe:ffff:0:f101::1/64 dev eth0 ______________________________________________________________
使用 "ifconfig"
使用方法: ______________________________________________________________
# /sbin/ifconfig <interface> inet6 add <ipv6address>/<prefixlength> ______________________________________________________________
例子: ______________________________________________________________
# /sbin/ifconfig eth0 inet6 add 3ffe:ffff:0:f101::1/64 ______________________________________________________________
6.3 移除IPv6地址
這個不常用, 不要用它移除不存在的地址, 一些早期的核心會因為受不了而掛 掉.
使用 "ip"
使用方法: ______________________________________________________________
# /sbin/ip -6 addr del <ipv6address>/<prefixlength> dev <interface> ______________________________________________________________
例子: ______________________________________________________________
# /sbin/ip -6 addr del 3ffe:ffff:0:f101::1/64 dev eth0 ______________________________________________________________
使用 "ifconfig"
使用方法: ______________________________________________________________
# /sbin/ifconfig <interface> inet6 del <ipv6address>/<prefixlength> ______________________________________________________________
例子: ______________________________________________________________
# /sbin/ifconfig eth0 inet6 del 3ffe:ffff:0:f101::1/64 ______________________________________________________________
7. 設定IPv6路由
7.1 列印現有的路由
使用"ip"
使用方法: ______________________________________________________________
# /sbin/ip -6 route show [dev <device>] ______________________________________________________________
例子: ______________________________________________________________
# /sbin/ip -6 route show dev eth03ffe:ffff:0:f101::/64 proto kernel metric 256 mtu 1500 advmss 1440fe80::/10 proto kernel metric 256 mtu 1500 advmss 1440ff00::/8 proto kernel metric 256 mtu 1500 advmss 1440default proto kernel metric 256 mtu 1500 advmss 1440 ______________________________________________________________
使用 "route"
使用方法: ______________________________________________________________
最新评论