我有一个带有 raspberry-pi 的 ad-hoc IPv4 网络。现在这些节点彼此相邻,每当我尝试从 10.0.0.4 ping 到 10.0.0.6 时,这就是输出。
PING 10.0.0.6 (10.0.0.6) 56(84) bytes of data.
From 10.0.0.4 icmp_seq=1 Destination Host Unreachable
From 10.0.0.4 icmp_seq=2 Destination Host Unreachable
From 10.0.0.4 icmp_seq=3 Destination Host Unreachable
两个设备上的路由看起来都很好,这些是它们的 iwconfig、路由、arp 输出:
在 10.0.0.4 上
pi@pi-raspberry4:~$ route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.1.254 0.0.0.0 UG 0 0 0 wdongle
10.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0 wboard
169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 wboard
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 wdongle
pi@pi-raspberry4:~$ arp -n
Address HWtype HWaddress Flags Mask Iface
10.0.0.1 (incomplete) wboard
192.168.1.7 ether 28:39:26:c6:2e:af C wdongle
10.0.0.6 (incomplete) wboard
10.0.0.2 (incomplete) wboard
10.0.0.16 (incomplete) wboard
192.168.1.254 ether cc:7b:35:0d:7c:f8 C wdongle
10.0.0.15 (incomplete) wboard
10.0.0.12 (incomplete) wboard
pi@pi-raspberry4:~$ iwconfig
wdongle IEEE 802.11bgn ESSID:"tplinktest" Nickname:"<WIFI@REALTEK>"
Mode:Managed Frequency:2.412 GHz Access Point: 14:CC:20:64:C7:10
Bit Rate:300 Mb/s Sensitivity:0/0
Retry:off RTS thr:off Fragment thr:off
Power Management:off
Link Quality=98/100 Signal level=64/100 Noise level=0/100
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:0 Missed beacon:0
lo no wireless extensions.
wboard IEEE 802.11bgn ESSID:"RPiAdHocNetwork"
Mode:Ad-Hoc Frequency:2.437 GHz Cell: 9A:29:92:92:6B:6C
Tx-Power=31 dBm
Retry short limit:7 RTS thr=1 B Fragment thr:off
Power Management:on
eth0 no wireless extensions.
ip6tnl0 no wireless extensions.
在 10.0.0.6 上
pi@pi-raspberry6:/etc$ route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.1.254 0.0.0.0 UG 0 0 0 wdongle
0.0.0.0 0.0.0.0 0.0.0.0 U 1002 0 0 eth0
10.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0 wboard
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 wboard
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 wdongle
pi@pi-raspberry6:/etc$ arp -n
Address HWtype HWaddress Flags Mask Iface
10.0.0.2 ether b8:27:eb:c6:8b:41 C wboard
192.168.1.254 ether cc:7b:35:0d:7c:f8 C wdongle
10.0.0.1 (incomplete) wboard
10.0.0.15 (incomplete) wboard
10.0.0.4 (incomplete) wboard
192.168.1.7 ether 28:39:26:c6:2e:af C wdongle
pi@pi-raspberry6:/etc$ iwconfig
wdongle IEEE 802.11bgn ESSID:"tplinktest" Nickname:"<WIFI@REALTEK>"
Mode:Managed Frequency:2.412 GHz Access Point: 14:CC:20:64:C7:10
Bit Rate:300 Mb/s Sensitivity:0/0
Retry:off RTS thr:off Fragment thr:off
Power Management:off
Link Quality=100/100 Signal level=75/100 Noise level=0/100
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:0 Missed beacon:0
lo no wireless extensions.
wboard IEEE 802.11bgn ESSID:"RPiAdHocNetwork"
Mode:Ad-Hoc Frequency:2.437 GHz Cell: 9A:29:92:92:6B:6C
Tx-Power=31 dBm
Retry short limit:7 RTS thr=1 B Fragment thr:off
Power Management:on
eth0 no wireless extensions.
ip6tnl0 no wireless extensions.
我的问题:可能是什么原因造成的以及如何解决? (除非硬件有故障)
注意:我的网络目前由4个树莓派组成(其中一个是3B+其余3B)。它们中的每一个都通过板卡 NIC 位于 ad-hoc 网络中,并通过外部加密狗位于我的家庭网络中。节点 10.0.0.4 -6 - 15 正在运行 Ubuntu 16.04.4 LTS,节点 10.0.0.2 可能有 rpis 的 NOOBS 发行版(我没有找到 lsb_release )
唯一似乎相互交互的节点是 10.0.0.2 和 10.0.0.6。之前我正在运行一些 iperf 实验,它们每个传输了大约 1 Gb 的数据,但突然一些节点消失并且无法访问(即 10.0.0.4 和 10.0.0.15)
答案1
原来问题是sshguard
我不知道 sshguard 正在运行,并且在树莓派之间进行了一些失败的尝试。在失败的登录尝试日志中存在以下行:
Blocking 192.168.1.7:4 for >630secs: 40 danger in 4 attacks over 2 seconds (all: 40d in 1 abuses over 2s)
sshguard 似乎阻止了来自可疑攻击者的所有 ipv4 流量,结果发现我就是攻击者