tcpdump實驗分析

實驗準備

1. 安裝nc工具：yum install nc
2. 監聽本地網卡流量：tcpdump -i lo -n -nn tcp port 8888
3. 建立TCP/UDP連接：nc -p 1234 10.96.78.213 8888

數據包分析

• 14:07:53.220954爲時間戳，精確到微妙，加-t不顯示時間；
• 10.96.78.213.1234含義：10.96.78.213爲IP，1234爲端口，加-n -nn顯示IP，默認顯示域名或hostname；
• 10.96.78.213.1234 > 10.96.78.213.8888 爲數據流向；
• Flags含義：S（SYN請求） . （ACK確認包） P（消息發送） F（FIN包，表示正常關閉連接，沒有數據丟失） R（RST包，表示強制關閉連接，可能丟失數據）
• win 342爲華東窗口大小；
• length 0爲數據包大小；

//建立TCP連接
14:07:53.220954 IP 10.96.78.213.1234 > 10.96.78.213.8888: Flags [S], seq 1057661546, win 43690, options [mss 65495,sackOK,TS val 1879360564 ecr 0,nop,wscale 7], length 0
14:01:06.103599 IP 10.96.78.213.8888 > 10.96.78.213.1234: Flags [S.], seq 2496367938, ack 1057661547, win 43690, options [mss 65495,sackOK,TS val 1879360564 ecr 1879360564,nop,wscale 7], length 0
14:07:53.221003 IP 10.96.78.213.1234 > 10.96.78.213.8888: Flags [.], ack 1, win 342, options [nop,nop,TS val 1879360564 ecr 1879360564], length 0

//客戶端發送請求
14:08:18.802016 IP 10.96.78.213.1234 > 10.96.78.213.8888: Flags [P.], seq 1:7, ack 1, win 342, options [nop,nop,TS val 1879386145 ecr 1879360564], length 6
14:08:18.802041 IP 10.96.78.213.8888 > 10.96.78.213.1234: Flags [.], ack 7, win 342, options [nop,nop,TS val 1879386145 ecr 1879386145], length 0
//服務端發送響應
14:08:18.802683 IP 10.96.78.213.8888 > 10.96.78.213.1234: Flags [P.], seq 1:107, ack 7, win 342, options [nop,nop,TS val 1879386146 ecr 1879386145], length 106
14:08:18.802695 IP 10.96.78.213.1234 > 10.96.78.213.8888: Flags [.], ack 107, win 342, options [nop,nop,TS val 1879386146 ecr 1879386146], length 0

//服務端主動關閉連接
14:08:18.802800 IP 10.96.78.213.8888 > 10.96.78.213.1234: Flags [F.], seq 107, ack 7, win 342, options [nop,nop,TS val 1879386146 ecr 1879386146], length 0
14:08:18.842051 IP 10.96.78.213.1234 > 10.96.78.213.8888: Flags [.], ack 108, win 342, options [nop,nop,TS val 1879386186 ecr 1879386146], length 0
//客戶端主動關閉連接
14:20:49.874086 IP 10.96.78.213.1234 > 10.96.78.213.8888: Flags [F.], seq 7, ack 108, win 342, options [nop,nop,TS val 1880137218 ecr 1879386146], length 0
//客戶端強制關閉連接
14:20:49.874107 IP 10.96.78.213.8888 > 10.96.78.213.1234: Flags [R], seq 2496368046, win 0, length 0

參考：

1. nc使用：https://www.ifmicro.com/記錄/2017/12/12/netcat-usage/