tcpdump抓包以及連接埠查看的一些操作

標籤：style   http   io   os   for   sp   div   on   linux   

1.tcpdump；

      nginx開啟後會佔用80連接埠，此時執行命令：tcpdump tcp port 80 

         結果如下：

[[email protected] ~]$ sudo tcpdump tcp port 80[sudo] password for syswj: tcpdump: verbose output suppressed, use -v or -vv for full protocol decodelistening on Auto_eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

  採用tcpdump抓到大包會顯示到螢幕上：

1.在windows上通過telnet     ip    連接埠號碼  來串連linux上80連接埠啟動並執行nginx伺服器

      

tcpdump: verbose output suppressed, use -v or -vv for full protocol decodelistening on Auto_eth0, link-type EN10MB (Ethernet), capture size 65535 bytes14:14:23.406697 IP 192.168.137.1.7352 > 192.168.137.128.http: Flags [S], seq 322176964, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 014:14:23.406740 IP 192.168.137.128.http > 192.168.137.1.7352: Flags [S.], seq 300095102, ack 322176965, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 6], length 014:14:23.406992 IP 192.168.137.1.7352 > 192.168.137.128.http: Flags [.], ack 1, win 256, length 0

這就是tcp的3次握手經過

2.退出windows上的telnet後：

14:16:37.910069 IP 192.168.137.1.7360 > 192.168.137.128.http: Flags [F.], seq 1, ack 1, win 256, length 014:16:37.910194 IP 192.168.137.128.http > 192.168.137.1.7360: Flags [F.], seq 1, ack 2, win 229, length 014:16:37.910854 IP 192.168.137.1.7360 > 192.168.137.128.http: Flags [.], ack 2, win 256, length 0

用戶端跟伺服器發送一個FIN結束報文，伺服器收到後，

3.在網頁上(windows)進入http:192.168.137.128

  進入的時候：

[sudo] password for syswj: tcpdump: verbose output suppressed, use -v or -vv for full protocol decodelistening on Auto_eth0, link-type EN10MB (Ethernet), capture size 65535 bytes14:23:09.504575 IP 192.168.137.1.rtps-dd-mt > 192.168.137.128.http: Flags [S], seq 4063271087, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 014:23:09.504610 IP 192.168.137.128.http > 192.168.137.1.rtps-dd-mt: Flags [S.], seq 1526809447, ack 4063271088, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 6], length 014:23:09.504867 IP 192.168.137.1.rtps-dd-mt > 192.168.137.128.http: Flags [.], ack 1, win 1024, length 0

  也是和上面一樣的3次握手

 關閉頁面，等待一段時間後：

14:24:09.565990 IP 192.168.137.128.http > 192.168.137.1.rtps-dd-mt: Flags [F.], seq 1, ack 1, win 229, length 014:24:09.566290 IP 192.168.137.1.rtps-dd-mt > 192.168.137.128.http: Flags [.], ack 2, win 1024, length 0

 再等待一段時間後： 

14:25:32.242143 IP 192.168.137.1.rtps-dd-mt > 192.168.137.128.http: Flags [F.], seq 1, ack 2, win 1024, length 014:25:32.242248 IP 192.168.137.128.http > 192.168.137.1.rtps-dd-mt: Flags [R], seq 1526809449, win 0, length 0

--因為逾時的原因伺服器已經關閉了這個串連，此時用戶端再向伺服器發送資訊，伺服器根本不識別這個用戶端，所以返回一個RST報文

關於連接埠的一些命令：

lsof  -i  :連接埠號碼    ----查看連接埠進程資訊

關閉某個連接埠的進程：

  先用lsof -i:連接埠號碼 查出這個連接埠的進程，找出pid，然後kill -9 pid，關閉進程

  或者 直接: fuser -k 80/tcp     

查看連接埠進程：

  netstat -anp | grep 80

 

   

 

         



tcpdump抓包以及連接埠查看的一些操作