☰

ssh 无法建立连接

tag-icon • tag-icon networking ssh ip
ssh 无法建立连接

我有多台机器连接在同一个网络上：

  • 答：134.157.xxx.xxx
  • B：134.157.yyy.yyy
  • 通讯: 134.157.zzz.zzz

我的问题是 A 无法再连接到 C。但是：

  • A 可以 ssh 到 A 和 B
  • B 可以 ssh 到 A、B 和 C
  • C 可以 ssh 到 A、B 和 C

以下是来自 A 的一些命令输出：

~$ telnet 134.157.zzz.zzz 22
Trying 134.157.zzz.zzz...
telnet: Unable to connect to remote host: Connection timed out

~$ ping 134.157.zzz.zzz
PING 134.157.zzz.zzz (134.157.zzz.zzz) 56(84) bytes of data.
64 bytes from 134.157.zzz.zzz: icmp_seq=1 ttl=64 time=0.283 ms
64 bytes from 134.157.zzz.zzz: icmp_seq=2 ttl=64 time=0.315 ms
64 bytes from 134.157.zzz.zzz: icmp_seq=3 ttl=64 time=0.314 ms
^C
--- 134.157.zzz.zzz ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2082ms
rtt min/avg/max/mdev = 0.283/0.304/0.315/0.014 ms

~$ ssh -vvv 134.157.zzz.zzz
OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n  7 Dec 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: resolving "134.157.zzz.zzz" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to 134.157.zzz.zzz [134.157.zzz.zzz] port 22.
debug1: connect to address 134.157.zzz.zzz port 22: Connection timed out
ssh: connect to host 134.157.zzz.zzz port 22: Connection timed out

它之前已经起作用了，没有改变配置文件，重新启动 A 不会改变任何东西。

我该如何调查？

[编辑]

# on C
~$ tcpdump src 134.157.xxx.xxx -vv -i eno3
~$ tcpdump src 134.157.yyy.yyy -vv -i eno3
# on A
~$ ssh 134.157.zzz.zzz
# on B
~$ ssh 134.157.zzz.zzz

只有在 B 上启动的命令才会在 C 上产生输出。

[/编辑]

[第二次编辑]

# on A
~$ tcpdump -vv -i any dst 134.157.zzz.zzz
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
12:32:18.609219 IP (tos 0x0, ttl 64, id 24010, offset 0, flags [DF], proto TCP (6), length 60)
    AAA.33648 > 134.157.zzz.zzz.ssh: Flags [S], cksum 0xf9fc (correct), seq 3301194634, win 64240, options [mss 1460,sackOK,TS val 2209953097 ecr 0,nop,wscale 7], length 0
12:32:19.628185 IP (tos 0x0, ttl 64, id 24011, offset 0, flags [DF], proto TCP (6), length 60)
    AAA.33648 > 134.157.zzz.zzz.ssh: Flags [S], cksum 0xf601 (correct), seq 3301194634, win 64240, options [mss 1460,sackOK,TS val 2209954116 ecr 0,nop,wscale 7], length 0
12:32:21.676188 IP (tos 0x0, ttl 64, id 24012, offset 0, flags [DF], proto TCP (6), length 60)
    AAA.33648 > 134.157.zzz.zzz.ssh: Flags [S], cksum 0xee01 (correct), seq 3301194634, win 64240, options [mss 1460,sackOK,TS val 2209956164 ecr 0,nop,wscale 7], length 0
# and so on until timeout

[/第二次编辑]

[第三次编辑]

# on A
~$ arp -an # contains 134.157.zzz.zzz with correct hardware address
~$ arp -d 134.157.yyy.yyy # success
~$ arp -d 134.157.zzz.zzz # error (see below)
SIOCDARP(dontpub): Network is unreachable
# on C
~$ arp -an # does not contain 134.157.xxx.xxx
~$ arp -s 134.157.xxx.xxx aa:aa:aa:aa:aa:aa # adds it, but solves nothing
~$

[/第三次编辑]

[第四次编辑]

# After a while running
# tcpdump -vv -i any dst 134.157.zzz.zzz
# on A, I finally got
13:19:09.716711 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 134.157.zzz.zzz tell 134.157.mmm.mmm, length 46
13:23:55.162747 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 134.157.zzz.zzz tell 134.157.nnn.nnn, length 46
13:29:59.119983 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 134.157.zzz.zzz tell 134.157.nnn.nnn, length 46
# which is strange...

[/第四次编辑]

答案1

由于 ICMP 在 A 和 C 之间工作，因此该问题很可能发生在堆栈的较高层。由于 B 可以到达 C，因此不太可能发生在应用层。

我猜测是防火墙限制。

为了验证这一点，我将使用 tcpdump 或类似程序来查看接收和发送了哪些数据包 - 首先在 C 上使用 tcpdump 来查看它是否从 A 接收数据包，然后再反向操作。

答案2

我终于找到了问题所在：A 上的网络掩码错误（255.255.255.128 而不是 255.255.255.0）。我们更新网络时可能没有注意到这一点。

相关内容