我有一个使用 Ubuntu Server 18.04 的虚拟机管理程序。有一些虚拟机由 VirtualBox 提供支持。我已经设置了 iptables 和 iproute2,以便虚拟机上的 Internet 可以通过“仅主机适配器”工作
vboxnet0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.11.11.11 netmask 255.255.255.255 broadcast 0.0.0.0
inet6 fe80::800:27ff:fe00:0 prefixlen 64 scopeid 0x20<link>
ether 0a:00:27:00:00:00 txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 72648 bytes 3266388 (3.2 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
vboxnet1: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
inet 10.11.11.11 netmask 255.255.255.255 broadcast 0.0.0.0
ether 0a:00:27:00:00:01 txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
vboxnet2: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.11.11.11 netmask 255.255.255.255 broadcast 0.0.0.0
inet6 fe80::800:27ff:fe00:2 prefixlen 64 scopeid 0x20<link>
ether 0a:00:27:00:00:02 txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 92219 bytes 10396788 (10.3 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
我什至可以嗅探虚拟机的流量
root@hypervisor:~# tcpdump -n -i vboxnet0 port 8642
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vboxnet0, link-type EN10MB (Ethernet), capture size 262144 bytes
12:31:43.676271 IP 188.17.218.126.1971 > 78.29.xx.xx.8642: Flags [P.], seq 3363265001:3363265037, ack 1117219726, win 1026, length 36
12:31:43.676407 IP 78.29.xx.xx.8642 > 188.17.218.126.1971: Flags [.], ack 36, win 501, length 0
12:31:48.673973 IP 188.17.218.126.1971 > 78.29.xx.xx.8642: Flags [P.], seq 36:72, ack 1, win 1026, length 36
12:31:48.674050 IP 78.29.xx.xx.8642 > 188.17.218.126.1971: Flags [.], ack 72, win 501, length 0
12:31:53.675466 IP 188.17.218.126.1971 > 78.29.xx.xx.8642: Flags [P.], seq 72:108, ack 1, win 1026, length 36
12:31:53.675547 IP 78.29.xx.xx.8642 > 188.17.218.126.1971: Flags [.], ack 108, win 501, length 0
^C
6 packets captured
6 packets received by filter
0 packets dropped by kernel
78.29.xx.xx 是虚拟机
但是,如果与 VM 相关,hypervisor 的 ifconfig 不会统计流量
有没有可以统计所有流量的包?