diff --git a/LDP/guide/docbook/linux-ip/advanced-routing.xml b/LDP/guide/docbook/linux-ip/advanced-routing.xml index a0cc64fc..8a252761 100644 --- a/LDP/guide/docbook/linux-ip/advanced-routing.xml +++ b/LDP/guide/docbook/linux-ip/advanced-routing.xml @@ -69,7 +69,7 @@ Leonardo calls this "dumb NAT" because the NAT performed by - iproute2 at the routing stage is stateless. + &iproute2; at the routing stage is stateless. . @@ -276,7 +276,7 @@ can assist in managing multiple Internet connections. We'll outline here some of the more common setups involving multiple Internet connections and how to manage them with iptables, - ipchains, and iproute2. One of + ipchains, and &iproute2;. One of the first distinctions you can make when planning how to use multiple Internet connections is what inbound services you expect to host and how you want to split traffic over the multiple links. @@ -512,7 +512,7 @@ Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) . - iproute2 supports the use of fwmark as a selector + &iproute2; supports the use of fwmark as a selector for rule lookups, so we can use fwmarks in the routing policy database to cause packets to be conditionally routed based on that fwmark. This can lead to great complexity if a machine has multiple @@ -522,7 +522,7 @@ Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) A convention I find sensible is to use the same number for a routing table and fwmark where possible. This simplifies the maintenance of - the systems which are using iproute2 and fwmark, + the systems which are using &iproute2; and fwmark, especially if the table identifier and fwmark are set in a configuration file with the same variable name. Since we are testing this on the command line, we'll just make sure that we can @@ -620,7 +620,7 @@ Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) we'll discuss how this client IP would reach each of the services published on &masq-gw;'s two public networks. The IPs used for the services will be 67.17.28.10 and 205.254.211.17. - Now, whether you are using NAT with iproute2 or + Now, whether you are using NAT with &iproute2; or with iptables, you'll run across the problem here outlined. Here is the flow of the packet through &masq-gw; to the server and back to the client. @@ -639,7 +639,7 @@ Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) packet is accepted, rewritten, and routed; from 64.70.12.210 to 192.168.100.17; if iptables DNAT, packet is rewritten in PREROUTING chain of nat table, then - routed; if iproute2, packet is routed and + routed; if &iproute2;, packet is routed and rewritten simultaneously @@ -661,7 +661,7 @@ Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) routing decision is made; default route (via 205.254.211.254) is - selected; if iproute2 is used, packet is + selected; if &iproute2; is used, packet is also rewritten from 67.17.28.10 to 64.70.12.210 @@ -706,7 +706,7 @@ Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) Multiple Internet links, inbound traffic; using - <command>iproute2</command> only + &iproute2; only <footnote> <para> This example makes no reference to packet filtering. If you are diff --git a/LDP/guide/docbook/linux-ip/basic.xml b/LDP/guide/docbook/linux-ip/basic.xml index 795e35dc..82f3cf35 100644 --- a/LDP/guide/docbook/linux-ip/basic.xml +++ b/LDP/guide/docbook/linux-ip/basic.xml @@ -405,14 +405,6 @@ round-trip min/avg/max/mdev = 0.238/0.238/0.238/0.000 ms</computeroutput> </para> <example id="ex-basic-ping-non-local"> <title>Testing reachability of non-local hosts - - - - - - - - [root@tristan]# ping -R -c 1 -n 205.254.211.254 PING 205.254.211.254 (205.254.211.254) from 192.168.99.35 : 56(84) bytes of data. @@ -421,50 +413,59 @@ round-trip min/avg/max/mdev = 0.238/0.238/0.238/0.000 ms 1 packets transmitted, 0 packets received, 100% packet loss PING 205.254.211.254 (205.254.211.254) from 192.168.99.35 : 56(84) bytes of data. 64 bytes from 205.254.211.254: icmp_seq=0 ttl=255 time=238 usec -RR: 192.168.99.35 - 205.254.211.179 +RR: 192.168.99.35 + 205.254.211.179 + 205.254.211.254 205.254.211.254 - 205.254.211.254 - 192.168.99.254 - 192.168.99.35 + 192.168.99.254 + 192.168.99.35 --- 192.168.99.254 ping statistics --- 1 packets transmitted, 1 packets received, 0% packet loss round-trip min/avg/max/mdev = 0.238/0.238/0.238/0.000 ms - - - As the packet passes through the IP stack on &tristan;, - before hitting the ethernet, &tristan; adds its IP to the - list of IPs in the option field in the header. - + + + As the packet passes through the IP stack on &tristan;, + before hitting the ethernet, &tristan; adds its IP to the + list of IPs in the option field in the header. + - - - This is &masq-gw;'s public IP address. - + + + This is &masq-gw;'s public IP address. + - - - Our intended destination! (Anybody know why there are - two entries in the record route output?) - + + + Our intended destination! (Anybody know why there are + two entries in the record route output?) + - - - This is &masq-gw;'s private IP address. - + + + This is &masq-gw;'s private IP address. + - - - And finally, &tristan; will add its IP to the option field - in the header of the IP packet just before the packet - reaches the calling ping program. - + + + And finally, &tristan; will add its IP to the option field + in the header of the IP packet just before the packet + reaches the calling ping program. + - By testing reachability of the local network 192.168.99.0/24 and diff --git a/LDP/guide/docbook/linux-ip/ether.xml b/LDP/guide/docbook/linux-ip/ether.xml index fc82c9af..6da3872e 100644 --- a/LDP/guide/docbook/linux-ip/ether.xml +++ b/LDP/guide/docbook/linux-ip/ether.xml @@ -19,7 +19,7 @@ net/ipv4/conf/$DEV/medium_id, and net/ipv4/conf/$DEV/hidden. For even finer control of ARP requests than is available in stock kernels, - there are kernel and iproute2 patches. + there are kernel and &iproute2; patches. Bridging, once the realm of hardware devices, can also be performed by a @@ -203,7 +203,7 @@ To display the ARP cache, the venerable and cross-platform arp admirably dispatches its duty. As with many of - the iproute2 tools, more information is available + the &iproute2; tools, more information is available via ip neighbor than with arp. below illustrates the differences in the output between the output of these two different tools. @@ -307,73 +307,74 @@ ARP cache timeout - - - - - - - - [root@tristan]# ip neighbor show 192.168.99.7 -192.168.99.7 dev eth0 lladdr 00:80:c8:e8:1e:fc nud reachable +192.168.99.7 dev eth0 lladdr 00:80:c8:e8:1e:fc nud reachable [root@tristan]# ip neighbor show 192.168.99.7 -192.168.99.7 dev eth0 lladdr 00:80:c8:e8:1e:fc nud stale +192.168.99.7 dev eth0 lladdr 00:80:c8:e8:1e:fc nud stale [root@tristan]# ip neighbor show 192.168.99.7 -192.168.99.7 dev eth0 lladdr 00:80:c8:e8:1e:fc nud delay +192.168.99.7 dev eth0 lladdr 00:80:c8:e8:1e:fc nud delay [root@tristan]# ip neighbor show 192.168.99.7 -192.168.99.7 dev eth0 lladdr 00:80:c8:e8:1e:fc nud probe +192.168.99.7 dev eth0 lladdr 00:80:c8:e8:1e:fc nud probe [root@tristan]# ip neighbor show 192.168.99.7 -192.168.99.7 dev eth0 nud incomplete +192.168.99.7 dev eth0 nud incomplete - - - Before the entry has expired for 192.168.99.7, but after the - host has been disconnected from the network. During this - time, &tristan; will continue to send out ethernet frames with - the destination frame address set to the link layer address - according to this entry. - + + + Before the entry has expired for 192.168.99.7, but after the + host has been disconnected from the network. During this + time, &tristan; will continue to send out ethernet frames with + the destination frame address set to the link layer address + according to this entry. + - - - It has been gc_stale_time seconds since - the entry has been verified, so the state has changed to - stale. - + + + It has been gc_stale_time seconds since + the entry has been verified, so the state has changed to + stale. + - - - This entry in the neighbor table has been requested. Because - the entry was in a stale state, the link layer address was - used, but now the kernel needs to verify the accuracy of the - data. The kernel will soon send an ARP request for the - destination IP address. - + + + This entry in the neighbor table has been requested. + Because the entry was in a stale state, the link layer + address was used, but now the kernel needs to verify + the accuracy of the data. The kernel will soon send + an ARP request for the destination IP address. + - - - The kernel is actively performing address resolution for the - entry. It will send a total of - ucast_solicit frames to the last known - link layer address to attempt to verify reachability of the - address. Failing this, it will send - mcast_solicit broadcast frames before - altering the ARP cache state and returning an error to any - higher layer services. - + + + The kernel is actively performing address resolution for the + entry. It will send a total of + ucast_solicit frames to the last known + link layer address to attempt to verify reachability of the + address. Failing this, it will send + mcast_solicit broadcast frames before + altering the ARP cache state and returning an error to any + higher layer services. + - - - After all attempts to reach the destination address have - failed, the entry will appear in the neighbor table in this - state. - + + + After all attempts to reach the destination address have + failed, the entry will appear in the neighbor table in this + state. + - The remaining neighbor table flags are visible when inital ARP diff --git a/LDP/guide/docbook/linux-ip/intro.xml b/LDP/guide/docbook/linux-ip/intro.xml index 837ee7df..c2f6955d 100644 --- a/LDP/guide/docbook/linux-ip/intro.xml +++ b/LDP/guide/docbook/linux-ip/intro.xml @@ -146,13 +146,13 @@ example of the difference between linux only tools and generally available unix-like tools is the difference between the traditional ifconfig and route commands, - available under most variants of unix, and the iproute2 + available under most variants of unix, and the &iproute2; command suite, written specificially for linux. Because this guide concerns itself with the features, strengths, and - peculiarities of IP networking with linux, the iproute2 - command suite assumes a prominent role. The iproute2 + peculiarities of IP networking with linux, the &iproute2; + command suite assumes a prominent role. The &iproute2; tools expose the strength, flexibility and potential of the linux networking stack. diff --git a/LDP/guide/docbook/linux-ip/links.xml b/LDP/guide/docbook/linux-ip/links.xml index e0188b21..8bca950d 100644 --- a/LDP/guide/docbook/linux-ip/links.xml +++ b/LDP/guide/docbook/linux-ip/links.xml @@ -217,7 +217,7 @@ - If your copy of iproute2 did not get packaged + If your copy of &iproute2; did not get packaged with ip-cref.ps or if you prefer online HTML, the command reference is available in toto as @@ -233,9 +233,9 @@ Julian Anastasov has been working on many aspects of traffic - control and advanced routing with the iproute2 + control and advanced routing with the &iproute2; package. He has provided a large number of patches to - iproute2 and some documentation with + &iproute2; and some documentation with for the linux virtual server (LVS) in addition to a great deal of code for LVS. See his main @@ -648,7 +648,7 @@ - The iproute2 package provides command-line + The &iproute2; package provides command-line support for the full functionality of the linux IP stack. This package, written by Alexey Kuznetsov, is available here and is diff --git a/LDP/guide/docbook/linux-ip/linux-ip.css b/LDP/guide/docbook/linux-ip/linux-ip.css index bba0adeb..008728d0 100644 --- a/LDP/guide/docbook/linux-ip/linux-ip.css +++ b/LDP/guide/docbook/linux-ip/linux-ip.css @@ -3,39 +3,62 @@ a:visited { color: #009900 ; text-decoration: none ; } a:hover { color: #009900 ; text-decoration: underline ; } a:active { color: #009900 ; text-decoration: underline ; } +a.local:link { color: #009900 ; text-decoration: none ; } +a.local:visited { color: #009900 ; text-decoration: none ; } +a.local:hover { color: #009900 ; text-decoration: underline ; } +a.local:active { color: #009900 ; text-decoration: underline ; } + a.nonlocal:link { color: #0000ff ; text-decoration: none ; } a.nonlocal:visited { color: #0000ff ; text-decoration: none ; } a.nonlocal:hover { color: #0000ff ; text-decoration: underline ; } a.nonlocal:active { color: #0000ff ; text-decoration: underline ; } BODY { - color: black ; - font-size: 1.0em ; - font-family: "New Century Schoolbook", Times, serif ; + color : black ; +/* font-size : 1.0em ; */ + font-family : "New Century Schoolbook", Times, serif ; +} + +/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */ +/* */ +/* variable list attributes */ +/* */ +/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */ + +div.variablelist { + margin : 1em 5% 1em 5% ; } .variablelist .term { - font-weight: bold ; + font-weight : bold ; +} + +.variablelist .emphasis { + font-weight : bold ; } p.copyright { - padding-left: 1.0em ; - padding-right: 1.0em ; - margin: 0em 0% 0.2em 0% ; - font-size: 0.7em ; - font-family: Verdana, Arial, Helvetica ; - text-align: right ; - color: #808080 ; + padding-left : 1.0em ; + padding-right : 1.0em ; + margin : 0em 0% 0.2em 0% ; + font-size : 0.7em ; + font-family : Verdana, Arial, Helvetica ; + text-align : right ; + color : #808080 ; } .revhistory { + padding-left : 0.5em ; + padding-right : 0.5em ; + margin : 0em 0% 0.2em 0% ; + font-size : 0.5em ; +/* font-family : Verdana, Arial, Helvetica ; */ + text-align : right ; + color : #808080 ; +} + +.calloutlist { padding-left: 0.5em ; padding-right: 0.5em ; margin: 0em 0% 0.2em 0% ; - font-size: 0.5em ; -/* font-family: Verdana, Arial, Helvetica ; */ - text-align: right ; - color: #808080 ; } - - diff --git a/LDP/guide/docbook/linux-ip/linux-ip.xml b/LDP/guide/docbook/linux-ip/linux-ip.xml index cb1e1cc9..54dcb07b 100644 --- a/LDP/guide/docbook/linux-ip/linux-ip.xml +++ b/LDP/guide/docbook/linux-ip/linux-ip.xml @@ -17,6 +17,12 @@ + local" > + main" > + src" > + fwmark" > + iproute2" > + wan-gw' > full NAT or stateless NAT, is available under kernel 2.2 and kernel 2.4 via the - iproute2 userspace interface. Available only under + &iproute2; userspace interface. Available only under kernel 2.4, destination NAT (DNAT) is an important derivative of full NAT. DNAT configuration from userspace is accomplished @@ -138,7 +138,7 @@ Providing inbound services via NAT can be accomplished in several different ways. Two common techniques are to use - iproute2 NAT and netfilter DNAT. + &iproute2; NAT and netfilter DNAT. Less common (and possibly less desirable) one can use port redirection tools. Depending on which tool is employed, different characteristics of a packet can trigger the address @@ -146,7 +146,7 @@ The simplest form of NAT under linux is - iproute2 NAT. + &iproute2; NAT. This type of NAT requires two matching commands, one to cause the kernel to rewrite the inbound packets (ip route add nat $NATIP via $REAL) @@ -155,7 +155,7 @@ retain no state for connections. It will simply transform any packets passing through. By contrast, netfilter is capable of retaining state on connections passing through the router and selecting packets more - granularly than is possible with only iproute2 tools. + granularly than is possible with only &iproute2; tools. Before the advent of the netfilter engine in the linux kernel, there @@ -256,15 +256,15 @@ NAT. It involves rewriting addresses passing through a routing device: outbound packets will undergo source address rewriting and inbound packets will undergo destination address rewriting. The - iproute2 suite of tools provides the two commands + &iproute2; suite of tools provides the two commands required to configure the kernel to perform network address translation on packets passing through the machine. This section will cover only stateless NAT, which can only be accomplished under linux with the - iproute2 tools, although it can be + &iproute2; tools, although it can be simulated with netfilter. - Creating an iproute2 NAT mapping has the side + Creating an &iproute2; NAT mapping has the side effect of causing the kernel to answer ARP requests for the NAT IP. For more detail on ARP filtering, suppression and conditional ARP, see . This can be considered alternatively a @@ -277,8 +277,8 @@ Whether or not it is using a packet filter, a linux machine can perform - NAT using the iproute2 suite of tools. This chapter - will document the use of iproute2 tools for NAT with + NAT using the &iproute2; suite of tools. This chapter + will document the use of &iproute2; tools for NAT with a simple example and an explanation of the required commands, then an example of @@ -467,7 +467,7 @@
- <command>iproute2</command> NAT with Multiple Private + <title>&iproute2; NAT with Multiple Private Networks Naturally, NAT introduces a complexity to the network in which it is @@ -550,7 +550,7 @@
- Using a packet filter with <command>iproute2</command> NAT + Using a packet filter with &iproute2; NAT Because NAT rewrites the packet as it passes through your linux box, packet filtering can become complex. With attentiveness to the @@ -574,11 +574,11 @@ Let's examine the IP addresses on a packet traversing each of the input, forward and output chains in an ipchains - installation as it is operated upon by the iproute2 + installation as it is operated upon by the &iproute2; NAT code. - Filtering an <command>iproute2</command> NAT packet with + <title>Filtering an &iproute2; NAT packet with <command>ipchains</command> @@ -733,10 +733,10 @@ These rules are the minimum set of ipchains rules needed to support a NAT'd TCP service. This concludes our discussion of - publishing a service to the world with iproute2 based + publishing a service to the world with &iproute2; based NAT and protecting the service with ipchains. As you can see, the complexity of supporting NAT with - iproute2 can be substantial, which is why we'll + &iproute2; can be substantial, which is why we'll examine the benefits of inbound NAT (DNAT) with netfilter in the next section. @@ -756,7 +756,7 @@ In a devilishly subtle difference, netfilter DNAT does not cause the kernel to answer ARP requests for the NAT IP, where - iproute2 NAT automatically begins answering ARP + &iproute2; NAT automatically begins answering ARP requests for the NAT IP. If the NAT IP is in a locally @@ -799,7 +799,7 @@ Full network address translation, as performed with - iproute2 can be simulated with both netfilter + &iproute2; can be simulated with both netfilter SNAT and DNAT, with the potential benefit (and attendent resource consumption) of connection tracking. @@ -842,7 +842,7 @@ PAT address translation has one important benefit over NAT (with the - iproute2 tools). Let's assume that you have only + &iproute2; tools). Let's assume that you have only five public IP addresses for which you have paid dearly. Additionally, let's assume that you want to run services on standard ports. You had hoped to connect four SMTP servers, two SSH servers and five HTTP servers. diff --git a/LDP/guide/docbook/linux-ip/pat.xml b/LDP/guide/docbook/linux-ip/pat.xml index 393dbd1c..70755604 100644 --- a/LDP/guide/docbook/linux-ip/pat.xml +++ b/LDP/guide/docbook/linux-ip/pat.xml @@ -24,7 +24,7 @@ PAT address translation has one important benefit over NAT (with the - iproute2 tools). Let's assume that you have only + &iproute2; tools). Let's assume that you have only five public IP addresses for which you have paid dearly. Additionally, let's assume that you want to run services on standard ports. You had hoped to connect four SMTP servers, two SSH servers and five HTTP servers. diff --git a/LDP/guide/docbook/linux-ip/scripts.xml b/LDP/guide/docbook/linux-ip/scripts.xml index 1f8bdf25..17b7fe77 100644 --- a/LDP/guide/docbook/linux-ip/scripts.xml +++ b/LDP/guide/docbook/linux-ip/scripts.xml @@ -16,8 +16,8 @@ enable it in your 2.4 kernel. If you require more control than afforded by the kernel proxy ARP functionality and you wish to recompile - iproute2 and your kernel, you can use the - iproute2 extension, + &iproute2; and your kernel, you can use the + &iproute2; extension, ip arp. Otherwise, you might try this script. diff --git a/LDP/guide/docbook/linux-ip/tools-ethernet.xml b/LDP/guide/docbook/linux-ip/tools-ethernet.xml index 10db7032..124cdfa9 100644 --- a/LDP/guide/docbook/linux-ip/tools-ethernet.xml +++ b/LDP/guide/docbook/linux-ip/tools-ethernet.xml @@ -241,7 +241,7 @@ Received 2 response(s) @@ -518,9 +518,9 @@ default via 192.168.99.254 dev eth0 Using <command>ip link set</command> to change the MTU Changing the MTU on an interface is a classical example of an - operation which, prior to the arrival of iproute2 + operation which, prior to the arrival of &iproute2; one could only accomplish with the ifconfig - command. Since iproute2 has separate + command. Since &iproute2; has separate utilities for managing the link layer, addressing, routing, and other IP-related objects, it becomes clear even with the command-line utilities that the MTU is really a function of @@ -590,7 +590,7 @@ default via 192.168.99.254 dev eth0 Alternatively, one can set the broadcast address to a different value, which as Alexey remarks as an aside in the - iproute2 manual will "break networking." + &iproute2; manual will "break networking." Changing the ethernet broadcast address implies that no conventionally configured host will answer broadcast ARP frames transmitted onto the ethernet. Since conventional ARP requests @@ -671,7 +671,7 @@ default via 192.168.99.254 dev eth0 --> - Part of the iproute2 command suite, ip + Part of the &iproute2; command suite, ip neighbor provides a command line interface to display the neighbor table (ARP cache), @@ -681,7 +681,7 @@ default via 192.168.99.254 dev eth0 entries and remove a large number of entries. - For peculiarities and commonalities of the iproute2 + For peculiarities and commonalities of the &iproute2; tools, refer to . diff --git a/LDP/guide/docbook/linux-ip/tools-ip-management.xml b/LDP/guide/docbook/linux-ip/tools-ip-management.xml index d9ade0fe..a34fa7a9 100644 --- a/LDP/guide/docbook/linux-ip/tools-ip-management.xml +++ b/LDP/guide/docbook/linux-ip/tools-ip-management.xml @@ -38,7 +38,7 @@ traditional utility for IP management. We will also examine the newer and more flexible ip address, a key - part of the iproute2 package. + part of the &iproute2; package.
<command>ifconfig</command> @@ -348,7 +348,7 @@ lo Link encap:Local Loopback
<command>ip address</command> - Part of the iproute2 suite, ip + Part of the &iproute2; suite, ip address can list the IP addresses affiliated with @@ -601,7 +601,7 @@ lo Link encap:Local Loopback As you can see, the ip address utility provides a wealth of information and a great deal of control over the IPs associated with each device. For more detailed information about - the iproute2 package and included tools, see + the &iproute2; package and included tools, see .
diff --git a/LDP/guide/docbook/linux-ip/tools-ip-routing.xml b/LDP/guide/docbook/linux-ip/tools-ip-routing.xml index e8387fbe..85adb10d 100644 --- a/LDP/guide/docbook/linux-ip/tools-ip-routing.xml +++ b/LDP/guide/docbook/linux-ip/tools-ip-routing.xml @@ -37,7 +37,7 @@ on to the increasingly used ip route and ip rule tools which are part of the - iproute2 package. + &iproute2; package.
<command>route</command> @@ -631,7 +631,7 @@ Destination Gateway Genmask Flags Metric Ref Use Iface
<command>ip route</command> - Another part of the iproute2 suite of tools for IP + Another part of the &iproute2; suite of tools for IP management, ip route provides management tools for manipulating any of the routing tables. Operations include @@ -655,7 +655,7 @@ Destination Gateway Genmask Flags Metric Ref Use Iface the parameter. - Fortunately, as mentioned earlier, the iproute2 + Fortunately, as mentioned earlier, the &iproute2; suite of tools does not rely on DNS for any operation so, the ubiquitous switch in previous examples will not be required in any example here. @@ -1108,7 +1108,7 @@ local 127.0.0.0/8 dev lo proto kernel scope host src 127.0.0.1 There are other options to the ip route add - documented in Alexey's thorough iproute2 + documented in Alexey's thorough &iproute2; documentation. For further research, I'd suggested acquiring and reading this manual. @@ -1144,7 +1144,7 @@ local 127.0.0.0/8 dev lo proto kernel scope host src 127.0.0.1ip route add nat is only half of the solution. You must understand that performing NAT - with iproute2 involves one component to rewrite + with &iproute2; involves one component to rewrite the inbound packet (ip route add nat), and another command to rewrite the outbound packet (ip rule add @@ -1154,8 +1154,8 @@ local 127.0.0.0/8 dev lo proto kernel scope host src 127.0.0.1 Alexey documents clearly in the appendix to the - iproute2 manual that the NAT provided by the - iproute2 suite is stateless. This is distinctly + &iproute2; manual that the NAT provided by the + &iproute2; suite is stateless. This is distinctly unlike NAT with netfilter. Refer to and for a better look at the connection tracking and network address @@ -1164,9 +1164,9 @@ local 127.0.0.0/8 dev lo proto kernel scope host src 127.0.0.1 The ip route add nat command is used to rewrite the destination address of a packet from one IP or range to another - IP or range. The iproute2 tools can only operate + IP or range. The &iproute2; tools can only operate on the entire IP packet. There is no provision directly within the - iproute2 suite to support conditional rewriting + &iproute2; suite to support conditional rewriting based on the destination port of a UDP datagram or TCP segment. It's the whole packet, every packet, and nothing but the packet @@ -1198,7 +1198,7 @@ local 127.0.0.0/8 dev lo proto kernel scope host src 127.0.0.1. - Not only can iproute2 support network address + Not only can &iproute2; support network address translation for single IPs, but also for entire network ranges. The syntax is substantially similar to the syntax above, but uses a CIDR network address instead of a single IP. @@ -1222,7 +1222,7 @@ local 127.0.0.0/8 dev lo proto kernel scope host src 127.0.0.1 Again, this is only one half of the story for NAT with - iproute2. Please be certain to read + &iproute2;. Please be certain to read the section below for usage information on ip rule add nat, in addition to which @@ -1491,14 +1491,14 @@ local 127.0.0.1 from 127.0.0.1 dev lo
<command>ip rule</command> - Another part of the iproute2 software package, + Another part of the &iproute2; software package, ip rule is the single tool for manipulating the routing policy database under linux (RPDB). For a fuller discussion of the RPDB, see . The RPDB can be displayed with ip rule show. Particular rules can be added and removed with (predictably, if you have been reading the sections on the other - iproute2 tools) ip rule add command and the ip rule del @@ -1683,7 +1683,7 @@ local 127.0.0.1 from 127.0.0.1 dev lo <command>ip rule add nat</command> As discussed more thoroughly in , this is the - other half of iproute2 supported network address + other half of &iproute2; supported network address translation. The two components are ip route add nat and ip rule add nat. @@ -1739,7 +1739,7 @@ local 127.0.0.1 from 127.0.0.1 dev lo
<command>ip rule del</command> - Naturally, no iproute2 tool would be complete + Naturally, no &iproute2; tool would be complete without the ability to undo what has been done. With ip rule del, individual rules can be removed from the RPDB. diff --git a/LDP/guide/docbook/linux-ip/tools-misc.xml b/LDP/guide/docbook/linux-ip/tools-misc.xml index 5eea26a9..7d9c7c88 100644 --- a/LDP/guide/docbook/linux-ip/tools-misc.xml +++ b/LDP/guide/docbook/linux-ip/tools-misc.xml @@ -80,24 +80,24 @@
- Some general remarks about <command>iproute2</command>tools + Some general remarks about &iproute2;tools This is a meant to be a collected set of thoughts which don't fit - anyplace else about the iproute2 tools. If you are + anyplace else about the &iproute2; tools. If you are reading this in search of more details about the - iproute2 tools, you should run (not walk) to your + &iproute2; tools, you should run (not walk) to your nearest command line, and execute the following command: bash -c ' gv $( locate ip-cref.ps ) '. In any case, I suggest that the reader consult the - documentation which comes with the iproute2 + documentation which comes with the &iproute2; package for canonical answers. - The iproute2 suite exposes all of the + The &iproute2; suite exposes all of the networking functionality of the linux kernel where the venerable tools (ifconfig, @@ -107,7 +107,7 @@ - Each of the iproute2 object names can be + Each of the &iproute2; object names can be shortened to the shortest unique set of characters. This means that ip route show can be abbreviated ip ro s and ip rule show can @@ -116,7 +116,7 @@ convenient shortcuts on the command line are often confusing in documentation. For this reason, I have preferred examples featuring the complete object names and action verbs. Note also - below that iproute2 accepts not only + below that &iproute2; accepts not only abbreviations but also synonyms as described in . @@ -124,25 +124,25 @@ There are some syntactic synonyms available within the - iproute2 package. See this + &iproute2; package. See this for a complete list of synonyms. - Because the iproute2 command suite is under + Because the &iproute2; command suite is under development, there may be slight differences between the output described in this documentation and that of your release of - iproute2. I have tried to focus on the - overwhelmingly common uses of the iproute2 + &iproute2;. I have tried to focus on the + overwhelmingly common uses of the &iproute2; tools rather than the ones which are under active development, and are subject to syntactic changes or new output presentations. - There are extensions to the iproute2 command + There are extensions to the &iproute2; command suite, which can alter the sets of objects or syntax available for manipulation and inspection. Where these are covered in detail in this documentation, they will be relegated to @@ -155,13 +155,13 @@ - There are some common synonyms in iproute2 syntax. + There are some common synonyms in &iproute2; syntax. Outlined below in is a list of the common synonyms. Note, that these synonyms are available in addition to the abbreviations indicated above.
- <command>iproute2</command> Synonyms + &iproute2; Synonyms @@ -192,13 +192,13 @@
- Because the iproute2 suite of tools is so tightly + Because the &iproute2; suite of tools is so tightly integrated with linux, it is not available for other operating systems. This is at once its strength and weakness. For users contemplating linux for the first time, ifconfig, netstat, and route are familiar and they feel intuitive. More experienced users and control freaks - will find the iproute2 tools attractive and perhaps + will find the &iproute2; tools attractive and perhaps indispensable.