Маршруты через туннель стоят в таблице, трафик уходит в никуда, роутер об этом не знает.

interface Tunnel0
 tunnel source Gi0/0
 tunnel destination 203.0.113.1
 keepalive 10 3

show interface Tunnel0 | include keepalive|line protocol
debug tunnel keepalive

ping 10.0.0.2 source Tunnel0
traceroute 10.0.0.2 source Tunnel0

ethtool -k eth0 | grep -E "tcp-segmentation|generic-segmentation|large-receive"

tcp-segmentation-offload: on
generic-segmentation-offload: on
large-receive-offload: on

ethtool -K eth0 tso off gso off lro off gro off

ethtool -K eth0 tso on gso on gro on

В реальной жизни это редкость. Достаточно один раз перепутать порт или скопировать конфиг - и access внезапно начинает вести себя как trunk.

interface GigabitEthernet1/0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 switchport nonegotiate

interface GigabitEthernet1/0/10
 switchport mode access
 switchport access vlan 20
 switchport nonegotiate

show interfaces Gi1/0/24 switchport

whois -h whois.radb.net -- "-i origin AS64512" | grep route

#!/bin/bash
TARGET="8.8.8.8"
SNAPSHOT="/var/lib/bgp_check/aspath.snap"
LOG="/var/log/aspath_changes.log"
BOT_TOKEN="ваш_токен"
CHAT_ID="ваш_chat_id"

mkdir -p "$(dirname "$SNAPSHOT")"

get_aspath() {
  traceroute -n -q 1 -w 2 "$1" 2>/dev/null \
    | awk 'NR>1 && $2 != "*" {print $2}' \
    | while read -r hop; do
        asn=$(whois -h whois.cymru.com " -v $hop" 2>/dev/null \
          | awk 'NR>1 {print $1}' | head -1)
        echo -n "AS${asn} "
      done
  echo
}

CURRENT=$(get_aspath "$TARGET")

if [ ! -f "$SNAPSHOT" ]; then
  echo "$CURRENT" > "$SNAPSHOT"
  echo "Baseline saved: $CURRENT"
  exit 0
fi

PREVIOUS=$(cat "$SNAPSHOT")

if [ "$CURRENT" != "$PREVIOUS" ]; then
  MSG="⚠️ AS-path до $TARGET изменился на $(hostname)\nБыло: $PREVIOUS\nСтало: $CURRENT"
  echo "$(date) $MSG" >> "$LOG"
  curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
    -d chat_id="${CHAT_ID}" \
    -d text="$MSG"
  echo "$CURRENT" > "$SNAPSHOT"
else
  echo "$(date) AS-path без изменений: $CURRENT" >> "$LOG"
fi

*/30 * * * * /usr/local/bin/aspath_monitor.sh

grep "изменился" /var/log/aspath_changes.log

dig +dnssec sigok.verteiltesysteme.net @127.0.0.1

dig sigfail.verteiltesysteme.net @127.0.0.1

dig dnssec-failed.org @127.0.0.1

#!/bin/bash
RESOLVERS=("127.0.0.1" "1.1.1.1" "8.8.8.8" "9.9.9.9")
VALID_DOMAIN="sigok.verteiltesysteme.net"
BROKEN_DOMAIN="sigfail.verteiltesysteme.net"
LOG="/var/log/dnssec_check.log"

echo "=== DNSSEC check $(date) ===" >> "$LOG"

for resolver in "${RESOLVERS[@]}"; do
  valid_ad=$(dig +dnssec +time=3 "$VALID_DOMAIN" @"$resolver" 2>/dev/null \
    | grep "flags:" | grep -c " ad ")

  broken_status=$(dig +time=3 "$BROKEN_DOMAIN" @"$resolver" 2>/dev/null \
    | grep "status:" | awk -F'[,:]' '{print $2}' | tr -d ' ')

  if [ "$valid_ad" -eq 1 ] && [ "$broken_status" = "SERVFAIL" ]; then
    result="OK"
  elif [ "$valid_ad" -eq 0 ]; then
    result="FAIL: не возвращает AD флаг"
  else
    result="FAIL: принимает сломанные подписи ($broken_status)"
  fi

  echo "$resolver: $result" | tee -a "$LOG"
done

0 * * * * /usr/local/bin/check_dnssec.sh

ss -tunp 'dport = :53 and not dst 127.0.0.0/8'

#!/bin/bash
IFACE=${1:-eth0}
LOG="/var/log/dns_bypass.log"
LOCAL_RESOLVER="127.0.0.53"

tcpdump -i "$IFACE" -n -l \
  "udp port 53 and not dst $LOCAL_RESOLVER and not src $LOCAL_RESOLVER" 2>/dev/null \
  | while read -r line; do
      dst_ip=$(echo "$line" | grep -oP '\d+\.\d+\.\d+\.\d+(?=\.53)' | head -1)
      [ -z "$dst_ip" ] && continue

      ts=$(date '+%Y-%m-%d %H:%M:%S')

      conns=$(ss -tunp "dport = :53 and dst $dst_ip" 2>/dev/null \
        | awk 'NR>1 {print $NF}' | sort -u)

      echo "$ts -> $dst_ip | $conns" | tee -a "$LOG"
  done

conntrack -L -p udp --dport 53 2>/dev/null \
  | awk '{for(i=1;i<=NF;i++) if($i~/dst=/) print $i}' \
  | grep -v "dst=127\." \
  | sort | uniq -c | sort -rn

lsof -i UDP:53 -i TCP:53 -n -P \
  | awk 'NR>1 && $9 !~ /127\./ {print $1, $2, $9}' \
  | sort -u

*/10 * * * * lsof -i UDP:53 -n -P | awk 'NR>1 && $9 !~ /127\./ {print $1,$2,$9}' >> /var/log/dns_bypass.log

ip route show | awk '/via/ {print $3}' | sort -u

#!/bin/bash
LOG="/var/log/nexthop_check.log"
BOT_TOKEN="ваш_токен"
CHAT_ID="ваш_chat_id"

echo "=== Next-hop check $(date) ===" >> "$LOG"

ip route show | awk '/via/ {print $3, $5}' | sort -u \
  | while read -r nexthop iface; do
      [ -z "$iface" ] && iface=$(ip route get "$nexthop" 2>/dev/null | awk '{print $3}' | head -1)
      [ -z "$iface" ] && continue

      result=$(arping -c 2 -W 1 -I "$iface" "$nexthop" 2>/dev/null \
        | grep -c "bytes from")

      if [ "$result" -eq 0 ]; then
        msg="⚠️ Next-hop $nexthop ($iface) не отвечает на ARP на $(hostname)"
        echo "$(date '+%Y-%m-%d %H:%M:%S') FAIL: $nexthop via $iface" >> "$LOG"
        curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
          -d chat_id="${CHAT_ID}" \
          -d text="$msg" &>/dev/null
      else
        echo "$(date '+%Y-%m-%d %H:%M:%S') OK: $nexthop via $iface" >> "$LOG"
      fi
  done

ip -6 route show | awk '/via/ {print $3, $5}' | sort -u \
  | while read -r nexthop iface; do
      result=$(ndisc6 -q -r 2 "$nexthop" "$iface" 2>/dev/null | grep -c "from")
      [ "$result" -eq 0 ] && echo "FAIL IPv6: $nexthop via $iface"
  done

*/5 * * * * /usr/local/bin/check_nexthop.sh

grep "FAIL" /var/log/nexthop_check.log | tail -20

cat /proc/net/igmp

awk 'NR>1 && $1 !~ /^[0-9]/ {iface=$1}
     NR>1 && $1 ~ /^[0-9]/ {
       hex=$2
       printf "%s: %d.%d.%d.%d\n", iface,
         strtonum("0x"substr(hex,7,2)),
         strtonum("0x"substr(hex,5,2)),
         strtonum("0x"substr(hex,3,2)),
         strtonum("0x"substr(hex,1,2))
     }' /proc/net/igmp

#!/bin/bash
SNAPSHOT="/var/lib/igmp_check/groups.snap"
LOG="/var/log/igmp_changes.log"
BOT_TOKEN="ваш_токен"
CHAT_ID="ваш_chat_id"

mkdir -p "$(dirname "$SNAPSHOT")"

parse_igmp() {
  awk 'NR>1 && $1 !~ /^[0-9]/ {iface=$1}
       NR>1 && $1 ~ /^[0-9]/ {
         hex=$2
         printf "%s %d.%d.%d.%d\n", iface,
           strtonum("0x"substr(hex,7,2)),
           strtonum("0x"substr(hex,5,2)),
           strtonum("0x"substr(hex,3,2)),
           strtonum("0x"substr(hex,1,2))
       }' /proc/net/igmp | sort
}

CURRENT=$(parse_igmp)

if [ ! -f "$SNAPSHOT" ]; then
  echo "$CURRENT" > "$SNAPSHOT"
  echo "Baseline saved"
  exit 0
fi

PREVIOUS=$(cat "$SNAPSHOT")
NEW=$(comm -13 <(echo "$PREVIOUS") <(echo "$CURRENT"))
GONE=$(comm -23 <(echo "$PREVIOUS") <(echo "$CURRENT"))

if [ -n "$NEW" ] || [ -n "$GONE" ]; then
  msg="⚠️ IGMP изменения на $(hostname)"
  [ -n "$NEW" ] && msg="$msg\nНовые группы: $NEW"
  [ -n "$GONE" ] && msg="$msg\nУшли группы: $GONE"
  echo "$(date) $msg" >> "$LOG"
  curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
    -d chat_id="${CHAT_ID}" \
    -d text="$msg" &>/dev/null
  echo "$CURRENT" > "$SNAPSHOT"
fi

*/5 * * * * /usr/local/bin/igmp_monitor.sh

show cdp neighbors
show cdp neighbors detail
show lldp neighbors
show lldp neighbors detail

lldp run

/ip neighbor print
/ip neighbor print detail

/ip neighbor print where interface=ether1

apt install lldpd
systemctl start lldpd

lldpcli show neighbors
lldpcli show neighbors details

tcpdump -i eth0 -v ether proto 0x88cc

lldpcli -f json show neighbors

/tool torch interface=ether1

/tool torch interface=ether1 ip-protocol=tcp
/tool torch interface=ether1 ip-protocol=udp port=53

/tool torch interface=ether1 src-address=192.168.1.100
/tool torch interface=ether1 dst-address=8.8.8.8

/tool torch interface=ether1 src-address=192.168.1.0/24 ip-protocol=tcp port=443

Сразу понятно, кто жрёт канал.

/tool sniffer start
/tool sniffer packet print
/tool sniffer stop

/tool sniffer set filter-interface=ether1 file-name=capture.pcap
/tool sniffer start