ietf介绍TCP的文档--1981年
TCP-tutorial
TCP header
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Port | Destination Port |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Acknowledgment Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Data | |U|A|P|R|S|F| |
| Offset| Reserved |R|C|S|S|Y|I| Window |
| | |G|K|H|T|N|N| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Checksum | Urgent Pointer |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| data |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
https://tools.ietf.org/html/rfc793#section-3.1
rfc3168 更改后flag为8位添加了ECE、CWR
rfc3540 实验性的改为9位，添加了NS
TCP段头
握手&挥手
三次握手&四次挥手
除了ACK flag之外 其他flag均会占用一个seq号
四次挥手也可以是三次挥手 被断开方 的两次合成一次，参见TCPdump例子 http80
TCP状态转换图
+---------+ ---------\ active OPEN
| CLOSED | \ -----------
+---------+<---------\ \ create TCB
| ^ \ \ snd SYN
passive OPEN | | CLOSE \ \
------------ | | ---------- \ \
create TCB | | delete TCB \ \
V | \ \
+---------+ CLOSE | \
| LISTEN | ---------- | |
+---------+ delete TCB | |
rcv SYN | | SEND | |
----------- | | ------- | V
+---------+ snd SYN,ACK / \ snd SYN +---------+
| |<----------------- ------------------>| |
| SYN | rcv SYN | SYN |
| RCVD |<-----------------------------------------------| SENT |
| | snd ACK | |
| |------------------ -------------------| |
+---------+ rcv ACK of SYN \ / rcv SYN,ACK +---------+
| -------------- | | -----------
| x | | snd ACK
| V V
| CLOSE +---------+
| ------- | ESTAB |
| snd FIN +---------+
| CLOSE | | rcv FIN
V ------- | | -------
+---------+ snd FIN / \ snd ACK +---------+
| FIN |<----------------- ------------------>| CLOSE |
| WAIT-1 |------------------ | WAIT |
+---------+ rcv FIN \ +---------+
| rcv ACK of FIN ------- | CLOSE |
| -------------- snd ACK | ------- |
V x V snd FIN V
+---------+ +---------+ +---------+
|FINWAIT-2| | CLOSING | | LAST-ACK|
+---------+ +---------+ +---------+
| rcv ACK of FIN | rcv ACK of FIN |
| rcv FIN -------------- | Timeout=2MSL -------------- |
| ------- x V ------------ x V
\ snd ACK +---------+delete TCB +---------+
------------------------>|TIME WAIT|------------------>| CLOSED |
+---------+ +---------+
TCP Connection State Diagram
https://tools.ietf.org/html/rfc793#section-3.2
955px-Tcp_state_diagram_fixed_new.svg.png
TCPdump例子
tcpdump -nn -i lo tcp port 22
16:33:19.056443 IP 127.0.0.1.47856 > 127.0.0.1.22: Flags [S], seq 2920794456, win 43690, options [mss 65495,sackOK,TS val 613933140 ecr 0,nop,wscale 7], length 0
16:33:19.056457 IP 127.0.0.1.22 > 127.0.0.1.47856: Flags [S.], seq 1035505223, ack 2920794457, win 43690, options [mss 65495,sackOK,TS val 613933140 ecr 613933140,nop,wscale 7], length 0
16:33:19.056468 IP 127.0.0.1.47856 > 127.0.0.1.22: Flags [.], ack 1, win 342, options [nop,nop,TS val 613933140 ecr 613933140], length 0
16:33:19.056743 IP 127.0.0.1.47856 > 127.0.0.1.22: Flags [P.], seq 1:22, ack 1, win 342, options [nop,nop,TS val 613933140 ecr 613933140], length 21
16:33:19.056779 IP 127.0.0.1.22 > 127.0.0.1.47856: Flags [.], ack 22, win 342, options [nop,nop,TS val 613933140 ecr 613933140], length 0
16:33:19.064438 IP 127.0.0.1.22 > 127.0.0.1.47856: Flags [P.], seq 1:22, ack 22, win 342, options [nop,nop,TS val 613933148 ecr 613933140], length 21
16:33:19.064472 IP 127.0.0.1.47856 > 127.0.0.1.22: Flags [.], ack 22, win 342, options [nop,nop,TS val 613933148 ecr 613933148], length 0
16:33:19.064880 IP 127.0.0.1.47856 > 127.0.0.1.22: Flags [P.], seq 22:1518, ack 22, win 342, options [nop,nop,TS val 613933148 ecr 613933148], length 1496
16:33:19.065839 IP 127.0.0.1.22 > 127.0.0.1.47856: Flags [P.], seq 22:1302, ack 1518, win 1365, options [nop,nop,TS val 613933149 ecr 613933148], length 1280
...
16:33:34.759533 IP 127.0.0.1.47856 > 127.0.0.1.22: Flags [.], ack 3030, win 1445, options [nop,nop,TS val 613948843 ecr 613948843], length 0
16:33:34.759565 IP 127.0.0.1.22 > 127.0.0.1.47856: Flags [P.], seq 3030:3102, ack 2570, win 1412, options [nop,nop,TS val 613948843 ecr 613948843], length 72
16:33:34.759571 IP 127.0.0.1.47856 > 127.0.0.1.22: Flags [.], ack 3102, win 1445, options [nop,nop,TS val 613948843 ecr 613948843], length 0
16:33:34.759658 IP 127.0.0.1.47856 > 127.0.0.1.22: Flags [P.], seq 2570:2606, ack 3102, win 1445, options [nop,nop,TS val 613948843 ecr 613948843], length 36
16:33:34.759693 IP 127.0.0.1.47856 > 127.0.0.1.22: Flags [P.], seq 2606:2666, ack 3102, win 1445, options [nop,nop,TS val 613948843 ecr 613948843], length 60
16:33:34.759729 IP 127.0.0.1.47856 > 127.0.0.1.22: Flags [F.], seq 2666, ack 3102, win 1445, options [nop,nop,TS val 613948843 ecr 613948843], length 0
16:33:34.759729 IP 127.0.0.1.22 > 127.0.0.1.47856: Flags [.], ack 2666, win 1412, options [nop,nop,TS val 613948843 ecr 613948843], length 0
16:33:34.762466 IP 127.0.0.1.22 > 127.0.0.1.47856: Flags [F.], seq 3102, ack 2667, win 1412, options [nop,nop,TS val 613948846 ecr 613948843], length 0
16:33:34.762477 IP 127.0.0.1.47856 > 127.0.0.1.22: Flags [.], ack 3103, win 1445, options [nop,nop,TS val 613948846 ecr 613948846], length 0
tcpdump -nn -i lo tcp port 22
------------------------------------
17:01:21.076487 IP 127.0.0.1.58560 > 127.0.0.1.80: Flags [S], seq 3448648225, win 43690, options [mss 65495,sackOK,TS val 615615160 ecr 0,nop,wscale 7], length 0
17:01:21.076502 IP 127.0.0.1.80 > 127.0.0.1.58560: Flags [S.], seq 82888595, ack 3448648226, win 43690, options [mss 65495,sackOK,TS val 615615160 ecr 615615160,nop,wscale 7], length 0
17:01:21.076512 IP 127.0.0.1.58560 > 127.0.0.1.80: Flags [.], ack 1, win 342, options [nop,nop,TS val 615615160 ecr 615615160], length 0
17:01:21.076578 IP 127.0.0.1.58560 > 127.0.0.1.80: Flags [P.], seq 1:74, ack 1, win 342, options [nop,nop,TS val 615615160 ecr 615615160], length 73: HTTP: GET / HTTP/1.1
17:01:21.076585 IP 127.0.0.1.80 > 127.0.0.1.58560: Flags [.], ack 74, win 342, options [nop,nop,TS val 615615160 ecr 615615160], length 0
17:01:21.081596 IP 127.0.0.1.80 > 127.0.0.1.58560: Flags [P.], seq 1:256, ack 74, win 342, options [nop,nop,TS val 615615165 ecr 615615160], length 255: HTTP: HTTP/1.1 404
17:01:21.081608 IP 127.0.0.1.58560 > 127.0.0.1.80: Flags [.], ack 256, win 350, options [nop,nop,TS val 615615165 ecr 615615165], length 0
17:01:21.081756 IP 127.0.0.1.58560 > 127.0.0.1.80: Flags [F.], seq 74, ack 256, win 350, options [nop,nop,TS val 615615165 ecr 615615165], length 0
17:01:21.082855 IP 127.0.0.1.80 > 127.0.0.1.58560: Flags [F.], seq 256, ack 75, win 342, options [nop,nop,TS val 615615166 ecr 615615165], length 0
17:01:21.082864 IP 127.0.0.1.58560 > 127.0.0.1.80: Flags [.], ack 257, win 350, options [nop,nop,TS val 615615166 ecr 615615166], length 0
win ssh
No. Time Source Destination Protocol Length Info
54 3.328900 192.168.1.5 server TCP 66 7296 → 22 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM=1
55 3.340809 server 192.168.1.5 TCP 66 22 → 7296 [SYN, ACK] Seq=0 Ack=1 Win=29200 Len=0 MSS=1452 SACK_PERM=1 WS=128
56 3.340963 192.168.1.5 server TCP 54 7296 → 22 [ACK] Seq=1 Ack=1 Win=66560 Len=0
60 3.374195 server 192.168.1.5 TCP 54 22 → 7296 [ACK] Seq=22 Ack=51 Win=29312 Len=0
61 3.375277 server 192.168.1.5 TCP 54 22 → 7296 [ACK] Seq=22 Ack=1467 Win=32128 Len=0
67 3.417948 server 192.168.1.5 TCP 54 22 → 7296 [ACK] Seq=1926 Ack=1599 Win=32128 Len=0
75 3.518039 192.168.1.5 server TCP 54 7296 → 22 [ACK] Seq=1851 Ack=2662 Win=66048 Len=0
80 3.541054 server 192.168.1.5 TCP 54 22 → 7296 [ACK] Seq=2730 Ack=2083 Win=34944 Len=0
83 3.542043 192.168.1.5 server TCP 54 7296 → 22 [ACK] Seq=2151 Ack=2834 Win=65792 Len=0
86 3.566366 192.168.1.5 server TCP 54 7296 → 22 [ACK] Seq=2151 Ack=3130 Win=65536 Len=0
90 5.121779 192.168.1.5 server TCP 54 7296 → 22 [ACK] Seq=2203 Ack=3182 Win=65536 Len=0
95 5.376090 192.168.1.5 server TCP 54 7296 → 22 [ACK] Seq=2255 Ack=3234 Win=65280 Len=0
98 5.613360 192.168.1.5 server TCP 54 7296 → 22 [ACK] Seq=2307 Ack=3286 Win=65280 Len=0
101 5.840700 192.168.1.5 server TCP 54 7296 → 22 [ACK] Seq=2359 Ack=3338 Win=65280 Len=0
105 6.062845 192.168.1.5 server TCP 54 7296 → 22 [ACK] Seq=2411 Ack=3578 Win=66560 Len=0
109 6.073960 server 192.168.1.5 TCP 54 22 → 7296 [ACK] Seq=3578 Ack=2515 Win=34944 Len=0
110 6.078529 server 192.168.1.5 TCP 54 22 → 7296 [FIN, ACK] Seq=3578 Ack=2583 Win=34944 Len=0
111 6.078593 192.168.1.5 server TCP 54 7296 → 22 [ACK] Seq=2583 Ack=3579 Win=66560 Len=0
112 6.093820 192.168.1.5 server TCP 54 7296 → 22 [FIN, ACK] Seq=2583 Ack=3579 Win=66560 Len=0
113 6.106376 server 192.168.1.5 TCP 54 22 → 7296 [ACK] Seq=3579 Ack=2584 Win=34944 Len=0
No. Time Source Destination Protocol Length Info
36 7.820080 203.208.40.45 192.168.1.5 TCP 54 443 → 9437 [FIN, ACK] Seq=1 Ack=1 Win=265 Len=0
37 7.820161 192.168.1.5 203.208.40.45 TCP 54 9437 → 443 [ACK] Seq=1 Ack=2 Win=516 Len=0
38 7.820363 192.168.1.5 203.208.40.45 TCP 54 9437 → 443 [FIN, ACK] Seq=1 Ack=2 Win=516 Len=0
39 7.854788 203.208.40.45 192.168.1.5 TCP 54 443 → 9437 [ACK] Seq=2 Ack=2 Win=265 Len=0
win
No. Time Source Destination Protocol Length Info
77 7.986197 192.168.1.5 114.118.30.249 TCP 66 10066 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM=1
78 7.993200 114.118.30.249 192.168.1.5 TCP 66 80 → 10066 [SYN, ACK] Seq=0 Ack=1 Win=14600 Len=0 MSS=1380 SACK_PERM=1 WS=128
79 7.993311 192.168.1.5 114.118.30.249 TCP 54 10066 → 80 [ACK] Seq=1 Ack=1 Win=66048 Len=0
80 7.993627 192.168.1.5 114.118.30.249 HTTP 485 GET /img/logo.png HTTP/1.1
82 8.000105 114.118.30.249 192.168.1.5 TCP 54 80 → 10066 [ACK] Seq=1 Ack=432 Win=15744 Len=0
83 8.001430 114.118.30.249 192.168.1.5 TCP 1434 80 → 10066 [ACK] Seq=1 Ack=432 Win=15744 Len=1380 [TCP segment of a reassembled PDU]
84 8.001430 114.118.30.249 192.168.1.5 TCP 1434 80 → 10066 [ACK] Seq=1381 Ack=432 Win=15744 Len=1380 [TCP segment of a reassembled PDU]
85 8.001498 192.168.1.5 114.118.30.249 TCP 54 10066 → 80 [ACK] Seq=432 Ack=2761 Win=66048 Len=0
86 8.003195 114.118.30.249 192.168.1.5 TCP 1434 80 → 10066 [ACK] Seq=2761 Ack=432 Win=15744 Len=1380 [TCP segment of a reassembled PDU]
87 8.004030 114.118.30.249 192.168.1.5 HTTP 652 HTTP/1.1 200 OK (PNG)[Malformed Packet]
89 8.004737 192.168.1.5 114.118.30.249 TCP 54 10066 → 80 [ACK] Seq=432 Ack=4739 Win=66048 Len=0
122 10.625847 192.168.1.5 114.118.30.249 TCP 54 10066 → 80 [FIN, ACK] Seq=432 Ack=4739 Win=66048 Len=0
123 10.632870 114.118.30.249 192.168.1.5 TCP 54 80 → 10066 [FIN, ACK] Seq=4739 Ack=433 Win=15744 Len=0
124 10.632957 192.168.1.5 114.118.30.249 TCP 54 10066 → 80 [ACK] Seq=433 Ack=4740 Win=66048 Len=0
win ssh Linux 对应
tcpdump tcp port 22 and host home.locale
19:25:17.294680 IP 106.39.148.90.37905 > iZ8vb1f3933yqt0quaupitZ.ssh: Flags [S], seq 2726217605, win 64240, options [mss 1452,nop,wscale 8,nop,nop,sackOK], length 0
19:25:17.294768 IP iZ8vb1f3933yqt0quaupitZ.ssh > 106.39.148.90.37905: Flags [S.], seq 2628977182, ack 2726217606, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0
19:25:17.307126 IP home.locale.37905 > iZ8vb1f3933yqt0quaupitZ.ssh: Flags [.], ack 1, win 260, length 0
19:25:17.957249 IP iZ8vb1f3933yqt0quaupitZ.ssh > home.locale.37905: Flags [P.], seq 2834:2998, ack 2151, win 273, length 164
19:25:17.965110 IP home.locale.37905 > iZ8vb1f3933yqt0quaupitZ.ssh: Flags [.], ack 2834, win 257, length 0
19:25:17.979164 IP iZ8vb1f3933yqt0quaupitZ.ssh > home.locale.37905: Flags [P.], seq 2998:3130, ack 2151, win 273, length 132
19:25:17.989123 IP home.locale.37905 > iZ8vb1f3933yqt0quaupitZ.ssh: Flags [.], ack 3130, win 256, length 0
19:25:24.316207 IP home.locale.37905 > iZ8vb1f3933yqt0quaupitZ.ssh: Flags [F.], seq 2151, ack 3130, win 256, length 0
19:25:24.319033 IP iZ8vb1f3933yqt0quaupitZ.ssh > home.locale.37905: Flags [F.], seq 3130, ack 2152, win 273, length 0
19:25:24.330195 IP home.locale.37905 > iZ8vb1f3933yqt0quaupitZ.ssh: Flags [.], ack 3131, win 256, length 0
-------------------------------------------------------------------
win
No. Time Source Destination Protocol Length Info
1121 38.559702 192.168.1.5 iZ8vb1f3933yqt0quaupitZ.ssh TCP 66 11790 → 22 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM=1
1122 38.570949 iZ8vb1f3933yqt0quaupitZ.ssh 192.168.1.5 TCP 66 22 → 11790 [SYN, ACK] Seq=0 Ack=1 Win=29200 Len=0 MSS=1452 SACK_PERM=1 WS=128
1123 38.571455 192.168.1.5 iZ8vb1f3933yqt0quaupitZ.ssh TCP 54 11790 → 22 [ACK] Seq=1 Ack=1 Win=66560 Len=0
1128 38.637119 iZ8vb1f3933yqt0quaupitZ.ssh 192.168.1.5 TCP 54 22 → 11790 [ACK] Seq=22 Ack=51 Win=29312 Len=0
1129 38.638046 iZ8vb1f3933yqt0quaupitZ.ssh 192.168.1.5 TCP 54 22 → 11790 [ACK] Seq=22 Ack=1467 Win=32128 Len=0
1133 38.693734 192.168.1.5 iZ8vb1f3933yqt0quaupitZ.ssh TCP 54 11790 → 22 [ACK] Seq=1467 Ack=1302 Win=65280 Len=0
1142 39.110252 iZ8vb1f3933yqt0quaupitZ.ssh 192.168.1.5 TCP 54 22 → 11790 [ACK] Seq=1926 Ack=1599 Win=32128 Len=0
1152 39.209422 192.168.1.5 iZ8vb1f3933yqt0quaupitZ.ssh TCP 54 11790 → 22 [ACK] Seq=1851 Ack=2662 Win=66048 Len=0
1157 39.229285 iZ8vb1f3933yqt0quaupitZ.ssh 192.168.1.5 TCP 54 22 → 11790 [ACK] Seq=2730 Ack=2083 Win=34944 Len=0
1160 39.230280 192.168.1.5 iZ8vb1f3933yqt0quaupitZ.ssh TCP 54 11790 → 22 [ACK] Seq=2151 Ack=2834 Win=65792 Len=0
1166 39.254612 192.168.1.5 iZ8vb1f3933yqt0quaupitZ.ssh TCP 54 11790 → 22 [ACK] Seq=2151 Ack=3130 Win=65536 Len=0
1285 45.580801 192.168.1.5 iZ8vb1f3933yqt0quaupitZ.ssh TCP 54 11790 → 22 [FIN, ACK] Seq=2151 Ack=3130 Win=65536 Len=0
1286 45.594802 iZ8vb1f3933yqt0quaupitZ.ssh 192.168.1.5 TCP 54 22 → 11790 [FIN, ACK] Seq=3130 Ack=2152 Win=34944 Len=0
1287 45.594884 192.168.1.5 iZ8vb1f3933yqt0quaupitZ.ssh TCP 54 11790 → 22 [ACK] Seq=2152 Ack=3131 Win=65536 Len=0
加了S参数 seq和ack 都是绝对值不是相对值《TCP/IP详解卷1 18.2.5》
[root@docker1 ~]# tcpdump -S -nn -i lo tcp port 49622
17:02:14.615380 IP 127.0.0.1.59102 > 127.0.0.1.49622: Flags [S], seq 1302291407, win 43690, options [mss 65495,sackOK,TS val 368836715 ecr 0,nop,wscale 7], length 0
17:02:14.615396 IP 127.0.0.1.49622 > 127.0.0.1.59102: Flags [S.], seq 2402016855, ack 1302291408, win 43690, options [mss 65495,sackOK,TS val 368836715 ecr 368836715,nop,wscale 7], length 0
17:02:14.615411 IP 127.0.0.1.59102 > 127.0.0.1.49622: Flags [.], ack 2402016856, win 342, options [nop,nop,TS val 368836715 ecr 368836715], length 0
17:02:14.616265 IP 127.0.0.1.59102 > 127.0.0.1.49622: Flags [P.], seq 1302291408:1302291429, ack 2402016856, win 342, options [nop,nop,TS val 368836716 ecr 368836715], length 21
17:02:14.616274 IP 127.0.0.1.49622 > 127.0.0.1.59102: Flags [.], ack 1302291429, win 342, options [nop,nop,TS val 368836716 ecr 368836716], length 0
17:02:14.629182 IP 127.0.0.1.49622 > 127.0.0.1.59102: Flags [P.], seq 2402016856:2402016877, ack 1302291429, win 342, options [nop,nop,TS val 368836729 ecr 368836716], length 21
17:02:14.629230 IP 127.0.0.1.59102 > 127.0.0.1.49622: Flags [.], ack 2402016877, win 342, options [nop,nop,TS val 368836729 ecr 368836729], length 0
17:02:14.629561 IP 127.0.0.1.59102 > 127.0.0.1.49622: Flags [P.], seq 1302291429:1302292925, ack 2402016877, win 342, options [nop,nop,TS val 368836729 ecr 368836729], length 1496
17:02:14.631556 IP 127.0.0.1.49622 > 127.0.0.1.59102: Flags [P.], seq 2402016877:2402018157, ack 1302292925, win 1365, options [nop,nop,TS val 368836731 ecr 368836729], length 1280
17:02:30.278345 IP 127.0.0.1.49622 > 127.0.0.1.59102: Flags [P.], seq 2402020697:2402020769, ack 1302294605, win 1435, options [nop,nop,TS val 368852378 ecr 368852378], length 72
17:02:30.278351 IP 127.0.0.1.59102 > 127.0.0.1.49622: Flags [.], ack 2402020769, win 1445, options [nop,nop,TS val 368852378 ecr 368852378], length 0
17:02:30.278472 IP 127.0.0.1.59102 > 127.0.0.1.49622: Flags [P.], seq 1302294605:1302294641, ack 2402020769, win 1445, options [nop,nop,TS val 368852378 ecr 368852378], length 36
17:02:30.278490 IP 127.0.0.1.59102 > 127.0.0.1.49622: Flags [P.], seq 1302294641:1302294701, ack 2402020769, win 1445, options [nop,nop,TS val 368852378 ecr 368852378], length 60
17:02:30.278519 IP 127.0.0.1.59102 > 127.0.0.1.49622: Flags [F.], seq 1302294701, ack 2402020769, win 1445, options [nop,nop,TS val 368852378 ecr 368852378], length 0
17:02:30.279378 IP 127.0.0.1.49622 > 127.0.0.1.59102: Flags [.], ack 1302294702, win 1435, options [nop,nop,TS val 368852379 ecr 368852378], length 0
17:02:30.285183 IP 127.0.0.1.49622 > 127.0.0.1.59102: Flags [F.], seq 2402020769, ack 1302294702, win 1435, options [nop,nop,TS val 368852385 ecr 368852378], length 0
17:02:30.285198 IP 127.0.0.1.59102 > 127.0.0.1.49622: Flags [.], ack 2402020770, win 1445, options [nop,nop,TS val 368852385 ecr 368852385], length 0
http80
[root@docker1 ~]# tcpdump -S -nn -i lo tcp port 80
17:13:48.790784 IP 127.0.0.1.53418 > 127.0.0.1.80: Flags [S], seq 2488569500, win 43690, options [mss 65495,sackOK,TS val 369530891 ecr 0,nop,wscale 7], length 0
17:13:48.790799 IP 127.0.0.1.80 > 127.0.0.1.53418: Flags [S.], seq 496941970, ack 2488569501, win 43690, options [mss 65495,sackOK,TS val 369530891 ecr 369530891,nop,wscale 7], length 0
17:13:48.790813 IP 127.0.0.1.53418 > 127.0.0.1.80: Flags [.], ack 496941971, win 342, options [nop,nop,TS val 369530891 ecr 369530891], length 0
17:13:48.790882 IP 127.0.0.1.53418 > 127.0.0.1.80: Flags [P.], seq 2488569501:2488569574, ack 496941971, win 342, options [nop,nop,TS val 369530891 ecr 369530891], length 73: HTTP: GET / HTTP/1.1
17:13:48.790895 IP 127.0.0.1.80 > 127.0.0.1.53418: Flags [.], ack 2488569574, win 342, options [nop,nop,TS val 369530891 ecr 369530891], length 0
17:13:48.792032 IP 127.0.0.1.80 > 127.0.0.1.53418: Flags [P.], seq 496941971:496947120, ack 2488569574, win 342, options [nop,nop,TS val 369530892 ecr 369530891], length 5149: HTTP: HTTP/1.1 403 Forbidden
17:13:48.792042 IP 127.0.0.1.53418 > 127.0.0.1.80: Flags [.], ack 496947120, win 1365, options [nop,nop,TS val 369530892 ecr 369530892], length 0
17:13:48.792535 IP 127.0.0.1.53418 > 127.0.0.1.80: Flags [F.], seq 2488569574, ack 496947120, win 1365, options [nop,nop,TS val 369530892 ecr 369530892], length 0
17:13:48.792595 IP 127.0.0.1.80 > 127.0.0.1.53418: Flags [F.], seq 496947120, ack 2488569575, win 342, options [nop,nop,TS val 369530892 ecr 369530892], length 0
17:13:48.792605 IP 127.0.0.1.53418 > 127.0.0.1.80: Flags [.], ack 496947121, win 1365, options [nop,nop,TS val 369530892 ecr 369530892], length 0
其他参照 https://www.jianshu.com/p/29868fb82890
https://en.wikipedia.org/wiki/Transmission_Control_Protocol
https://zh.wikipedia.org/zh-cn/%E4%BC%A0%E8%BE%93%E6%8E%A7%E5%88%B6%E5%8D%8F%E8%AE%AE
网友评论