Tcpdump packet capture and port view operations

1. tcpdump;

After nginx is enabled, port 80 is occupied. Run the command tcpdump TCP port 80.

The result is as follows:

[[email protected] ~]$ sudo tcpdump tcp port 80[sudo] password for syswj: tcpdump: verbose output suppressed, use -v or -vv for full protocol decodelistening on Auto_eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

When a large package is captured using tcpdump, it will be displayed on the screen:

1. Use the Telnet IP port number on Windows to connect to the nginx server running port 80 on Linux.

tcpdump: verbose output suppressed, use -v or -vv for full protocol decodelistening on Auto_eth0, link-type EN10MB (Ethernet), capture size 65535 bytes14:14:23.406697 IP 192.168.137.1.7352 > 192.168.137.128.http: Flags [S], seq 322176964, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 014:14:23.406740 IP 192.168.137.128.http > 192.168.137.1.7352: Flags [S.], seq 300095102, ack 322176965, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 6], length 014:14:23.406992 IP 192.168.137.1.7352 > 192.168.137.128.http: Flags [.], ack 1, win 256, length 0

This is the three handshakes of TCP

2. Exit Telnet on Windows:

14:16:37.910069 IP 192.168.137.1.7360 > 192.168.137.128.http: Flags [F.], seq 1, ack 1, win 256, length 014:16:37.910194 IP 192.168.137.128.http > 192.168.137.1.7360: Flags [F.], seq 1, ack 2, win 229, length 014:16:37.910854 IP 192.168.137.1.7360 > 192.168.137.128.http: Flags [.], ack 2, win 256, length 0

The client sends a fin End message to the server. After the server receives the message,

3. Go to http: 192.168.137.128 on the web page (Windows)

When entering:

[sudo] password for syswj: tcpdump: verbose output suppressed, use -v or -vv for full protocol decodelistening on Auto_eth0, link-type EN10MB (Ethernet), capture size 65535 bytes14:23:09.504575 IP 192.168.137.1.rtps-dd-mt > 192.168.137.128.http: Flags [S], seq 4063271087, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 014:23:09.504610 IP 192.168.137.128.http > 192.168.137.1.rtps-dd-mt: Flags [S.], seq 1526809447, ack 4063271088, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 6], length 014:23:09.504867 IP 192.168.137.1.rtps-dd-mt > 192.168.137.128.http: Flags [.], ack 1, win 1024, length 0

The same as the three handshakes above.

Close the page and wait for a while:

14:24:09.565990 IP 192.168.137.128.http > 192.168.137.1.rtps-dd-mt: Flags [F.], seq 1, ack 1, win 229, length 014:24:09.566290 IP 192.168.137.1.rtps-dd-mt > 192.168.137.128.http: Flags [.], ack 2, win 1024, length 0

After a while:

14:25:32.242143 IP 192.168.137.1.rtps-dd-mt > 192.168.137.128.http: Flags [F.], seq 1, ack 2, win 1024, length 014:25:32.242248 IP 192.168.137.128.http > 192.168.137.1.rtps-dd-mt: Flags [R], seq 1526809449, win 0, length 0

-- The server has closed the connection because of timeout. At this time, the client sends a message to the server, and the server does not recognize the client. Therefore, an RST packet is returned.

Some commands about the Port:

Lsof-I: Port Number ---- view port Process Information

Process for disabling a Port:

First use lsof-I: port number to find out the process of this port, find the PID, then kill-9 PID, close the process

Or directly: Fuser-K 80/tcp

View the port process:

Netstat-anp | grep 80

 

 

Zookeeper

Tcpdump packet capture and port view operations