TCP

Rothschil 2020-05-08 21:02:00
Linux,TCP

1. OSI 7层参考模型

2. TCP/IP 协议

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

[root@hadoop /proc/1359/fd]$ exec 9<> /dev/tcp/wwww.baidu.com/80
[root@hadoop /proc/1359/fd]$ echo -e "GET / HTTP/1.0\n" 1>& 9
[root@hadoop /proc/1359/fd]$ cat 0<& 9
HTTP/1.1 200 OK
Date: Sat, 25 Apr 2020 07:44:13 GMT
Server: Apache
Last-Modified: Tue, 12 Jan 2010 13:48:00 GMT
ETag: "51-47cf7e6ee8400"
Accept-Ranges: bytes
Content-Length: 81
Cache-Control: max-age=86400
Expires: Sun, 26 Apr 2020 07:44:13 GMT
Connection: Close
Content-Type: text/html

<html>
<meta http-equiv="refresh" content="0;url=http://www.baidu.com/">
</html>
[root@hadoop /proc/1359/fd]$


2.1. tdpdump抓包

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

[root@hadoop /root]$ tcpdump -n -i eno16777736 port 80
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eno16777736, link-type EN10MB (Ethernet), capture size 262144 bytes
02:02:56.161647 IP 192.168.125.128.47368 > 123.125.114.144.http: Flags [S], seq 2810959639, win 29200, options [mss 1460,sackOK,TS val 9980193 ecr 0,nop,wscale 7], length 0
02:02:56.205554 IP 123.125.114.144.http > 192.168.125.128.47368: Flags [S.], seq 279651079, ack 2810959640, win 64240, options [mss 1460], length 0
02:02:56.205595 IP 192.168.125.128.47368 > 123.125.114.144.http: Flags [.], ack 1, win 29200, length 0
02:02:56.205776 IP 192.168.125.128.47368 > 123.125.114.144.http: Flags [P.], seq 1:79, ack 1, win 29200, length 78: HTTP: GET / HTTP/1.1
02:02:56.206031 IP 123.125.114.144.http > 192.168.125.128.47368: Flags [.], ack 79, win 64240, length 0
02:02:56.250332 IP 123.125.114.144.http > 192.168.125.128.47368: Flags [P.], seq 1:474, ack 79, win 64240, length 473: HTTP: HTTP/1.1 302 Found
02:02:56.250420 IP 192.168.125.128.47368 > 123.125.114.144.http: Flags [.], ack 474, win 30016, length 0
02:02:56.250893 IP 192.168.125.128.47368 > 123.125.114.144.http: Flags [F.], seq 79, ack 474, win 30016, length 0
02:02:56.251203 IP 123.125.114.144.http > 192.168.125.128.47368: Flags [.], ack 80, win 64239, length 0
02:02:56.293274 IP 123.125.114.144.http > 192.168.125.128.47368: Flags [FP.], seq 474, ack 80, win 64239, length 0
02:02:56.293313 IP 192.168.125.128.47368 > 123.125.114.144.http: Flags [.], ack 475, win 30016, length 0
^C
11 packets captured
11 packets received by filter
0 packets dropped by kernel


1
[root@hadoop /proc/1359/fd]$ arp -d 192.168.125.2 && curl wwww.baidu.com
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
[root@hadoop /root]$ tcpdump -nn -i eno16777736 port 80 or arp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eno16777736, link-type EN10MB (Ethernet), capture size 262144 bytes
02:07:29.260601 ARP, Request who-has 192.168.125.2 tell 192.168.125.128, length 28
02:07:29.260938 ARP, Reply 192.168.125.2 is-at 00:50:56:f5:5f:6a, length 46
02:07:29.273875 IP 192.168.125.128.47372 > 123.125.114.144.80: Flags [S], seq 3601189424, win 29200, options [mss 1460,sackOK,TS val 10253305 ecr 0,nop,wscale 7], length 0
02:07:29.312217 IP 123.125.114.144.80 > 192.168.125.128.47372: Flags [S.], seq 764753765, ack 3601189425, win 64240, options [mss 1460], length 0
02:07:29.312244 IP 192.168.125.128.47372 > 123.125.114.144.80: Flags [.], ack 1, win 29200, length 0
02:07:29.312510 IP 192.168.125.128.47372 > 123.125.114.144.80: Flags [P.], seq 1:79, ack 1, win 29200, length 78: HTTP: GET / HTTP/1.1
02:07:29.312779 IP 123.125.114.144.80 > 192.168.125.128.47372: Flags [.], ack 79, win 64240, length 0
02:07:29.356759 IP 123.125.114.144.80 > 192.168.125.128.47372: Flags [P.], seq 1:474, ack 79, win 64240, length 473: HTTP: HTTP/1.1 302 Found
02:07:29.356778 IP 192.168.125.128.47372 > 123.125.114.144.80: Flags [.], ack 474, win 30016, length 0
02:07:29.357065 IP 192.168.125.128.47372 > 123.125.114.144.80: Flags [F.], seq 79, ack 474, win 30016, length 0
02:07:29.357339 IP 123.125.114.144.80 > 192.168.125.128.47372: Flags [.], ack 80, win 64239, length 0
02:07:29.398222 IP 123.125.114.144.80 > 192.168.125.128.47372: Flags [FP.], seq 474, ack 80, win 64239, length 0
02:07:29.398245 IP 192.168.125.128.47372 > 123.125.114.144.80: Flags [.], ack 475, win 30016, length 0

13 packets captured
13 packets received by filter
0 packets dropped by kernel
[root@hadoop /root]$