使用tcpdump分析TCP三次握手

技术上必须对APP设备进行监控，必须对TCP协议、长连接等技术进行研究。网上找到不少资料来验证握手和挥手的例子，总结如下：

TCP/IP的数据封装图

为测试方便，使用python写网络连接。

client端连接

from socket import *
import time
 
addr = ('127.0.0.1', 9988)
client = socket(AF_INET, SOCK_STREAM)
client.connect(addr)

客户端发送数据

from socket import *  
import time  
   
addr = ('127.0.0.1', 9988)  
client = socket(AF_INET, SOCK_STREAM)  
client.connect(addr)  
data = "something you want to send"
client.sendall(bytes(data,encoding="utf-8"))

服务端

import socket
import sys
import os
addr = ('127.0.0.1', 9988)
server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server.bind(addr)
server.listen(10)
 
while True:
        connection, address = server.accept()
        print 'connection ip:', address

因为客户端和服务端都在同一服务器上运行，所以tcpdump 抓取回环网口的包。

命令：tcpdump -i lo port 9988 -S

连接抓包数据如下：

 -S打印绝对序列号

[root@iZ94m4komqtZ ~]# tcpdump -i lo port 9988 -S
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 65535 bytes
15:21:51.232541 IP localhost.53491 > localhost.nsesrvr: Flags [S], seq 4148256350, win 32792, options [mss 16396,sackOK,TS val 219442371 ecr 0,nop,wscale 7], length 0
15:21:51.232559 IP localhost.nsesrvr > localhost.53491: Flags [S.], seq 2654314821, ack 4148256351, win 32768, options [mss 16396,sackOK,TS val 219442371 ecr 219442371,nop,wscale 7], length 0
15:21:51.232572 IP localhost.53491 > localhost.nsesrvr: Flags [.], ack 2654314822, win 257, options [nop,nop,TS val 219442371 ecr 219442371], length 0
15:21:51.232756 IP localhost.nsesrvr > localhost.53458: Flags [F.], seq 3755233851, ack 568739121, win 256, options [nop,nop,TS val 219442371 ecr 219410140], length 0
15:21:51.232767 IP localhost.53458 > localhost.nsesrvr: Flags [.], ack 3755233852, win 257, options [nop,nop,TS val 219442371 ecr 219442371], length 0

[root@iZ94m4komqtZ ~]# tcpdump -i lo port 9988
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 65535 bytes
15:19:40.518488 IP localhost.53458 > localhost.nsesrvr: Flags [S], seq 568739119, win 32792, options [mss 16396,sackOK,TS val 219311657 ecr 0,nop,wscale 7], length 0
15:19:40.518506 IP localhost.nsesrvr > localhost.53458: Flags [S.], seq 3755233850, ack 568739120, win 32768, options [mss 16396,sackOK,TS val 219311657 ecr 219311657,nop,wscale 7], length 0
15:19:40.518516 IP localhost.53458 > localhost.nsesrvr: Flags [.], ack 1, win 257, options [nop,nop,TS val 219311657 ecr 219311657], length 0
15:19:40.518624 IP localhost.nsesrvr > localhost.53336: Flags [F.], seq 3236710803, ack 2675123021, win 256, options [nop,nop,TS val 219311657 ecr 218876156], length 0
15:19:40.518635 IP localhost.53336 > localhost.nsesrvr: Flags [R], seq 2675123021, win 0, length 0

第三条抓包记录中ack是增量数，通过-S后输出绝对值。

完整的连接退出抓包记录（客户端先退出）

15:35:36.184553 IP localhost.53723 > localhost.nsesrvr: Flags [S], seq 601334489, win 32792, options [mss 16396,sackOK,TS val 220267323 ecr 0,nop,wscale 7], length 0
15:35:36.184572 IP localhost.nsesrvr > localhost.53723: Flags [S.], seq 2424896127, ack 601334490, win 32768, options [mss 16396,sackOK,TS val 220267323 ecr 220267323,nop,wscale 7], length 0
15:35:36.184584 IP localhost.53723 > localhost.nsesrvr: Flags [.], ack 2424896128, win 257, options [nop,nop,TS val 220267323 ecr 220267323], length 0

15:41:56.774680 IP localhost.53723 > localhost.nsesrvr: Flags [F.], seq 601334490, ack 2424896128, win 257, options [nop,nop,TS val 220647913 ecr 220267323], length 0
15:41:56.775271 IP localhost.nsesrvr > localhost.53723: Flags [.], ack 601334491, win 256, options [nop,nop,TS val 220647914 ecr 220647913], length 0
15:42:30.798666 IP localhost.nsesrvr > localhost.53723: Flags [F.], seq 2424896128, ack 601334491, win 256, options [nop,nop,TS val 220681937 ecr 220647913], length 0
15:42:30.798701 IP localhost.53723 > localhost.nsesrvr: Flags [.], ack 2424896129, win 257, options [nop,nop,TS val 220681937 ecr 220681937], length 0

服务端先退出

15:44:54.833534 IP localhost.53878 > localhost.nsesrvr: Flags [S], seq 4112302445, win 32792, options [mss 16396,sackOK,TS val 220825972 ecr 0,nop,wscale 7], length 0
15:44:54.833552 IP localhost.nsesrvr > localhost.53878: Flags [S.], seq 200030957, ack 4112302446, win 32768, options [mss 16396,sackOK,TS val 220825972 ecr 220825972,nop,wscale 7], length 0
15:44:54.833563 IP localhost.53878 > localhost.nsesrvr: Flags [.], ack 200030958, win 257, options [nop,nop,TS val 220825972 ecr 220825972], length 0
15:45:09.036623 IP localhost.nsesrvr > localhost.53878: Flags [F.], seq 200030958, ack 4112302446, win 256, options [nop,nop,TS val 220840175 ecr 220825972], length 0
15:45:09.037282 IP localhost.53878 > localhost.nsesrvr: Flags [.], ack 200030959, win 257, options [nop,nop,TS val 220840176 ecr 220840175], length 0
15:45:17.106697 IP localhost.53878 > localhost.nsesrvr: Flags [F.], seq 4112302446, ack 200030959, win 257, options [nop,nop,TS val 220848245 ecr 220840175], length 0
15:45:17.106732 IP localhost.nsesrvr > localhost.53878: Flags [.], ack 4112302447, win 256, options [nop,nop,TS val 220848245 ecr 220848245], length 0

连接以及发送数据抓包记录

15:55:31.882680 IP localhost.54057 > localhost.nsesrvr: Flags [S], seq 1291529141, win 32792, options [mss 16396,sackOK,TS val 221463021 ecr 0,nop,wscale 7], length 0
15:55:31.882698 IP localhost.nsesrvr > localhost.54057: Flags [S.], seq 2823375663, ack 1291529142, win 32768, options [mss 16396,sackOK,TS val 221463021 ecr 221463021,nop,wscale 7], length 0
15:55:31.882710 IP localhost.54057 > localhost.nsesrvr: Flags [.], ack 2823375664, win 257, options [nop,nop,TS val 221463021 ecr 221463021], length 0
15:59:20.756517 IP localhost.54057 > localhost.nsesrvr: Flags [P.], seq 1291529142:1291529168, ack 2823375664, win 257, options [nop,nop,TS val 221691895 ecr 221463021], length 26
15:59:20.756532 IP localhost.nsesrvr > localhost.54057: Flags [.], ack 1291529168, win 256, options [nop,nop,TS val 221691895 ecr 221691895], length 0
15:59:39.844497 IP localhost.54057 > localhost.nsesrvr: Flags [P.], seq 1291529168:1291529194, ack 2823375664, win 257, options [nop,nop,TS val 221710983 ecr 221691895], length 26
15:59:39.844511 IP localhost.nsesrvr > localhost.54057: Flags [.], ack 1291529194, win 256, options [nop,nop,TS val 221710983 ecr 221710983], length 0


15:59:49.323498 IP localhost.54057 > localhost.nsesrvr: Flags [P.], seq 1291529194:1291529220, ack 2823375664, win 257, options [nop,nop,TS val 221720462 ecr 221710983], length 26
15:59:49.323513 IP localhost.nsesrvr > localhost.54057: Flags [.], ack 1291529220, win 256, options [nop,nop,TS val 221720462 ecr 221720462], length 0

TCP拆包现象，数据包大小大于16384后开始分包发送数据。

15:59:49.323498 IP localhost.54057 > localhost.nsesrvr: Flags [P.], seq 1291529194:1291529220, ack 2823375664, win 257, options [nop,nop,TS val 221720462 ecr 221710983], length 26
15:59:49.323513 IP localhost.nsesrvr > localhost.54057: Flags [.], ack 1291529220, win 256, options [nop,nop,TS val 221720462 ecr 221720462], length 0
16:04:02.794509 IP localhost.54057 > localhost.nsesrvr: Flags [P.], seq 1291529220:1291529223, ack 2823375664, win 257, options [nop,nop,TS val 221973933 ecr 221720462], length 3
16:04:02.794524 IP localhost.nsesrvr > localhost.54057: Flags [.], ack 1291529223, win 256, options [nop,nop,TS val 221973933 ecr 221973933], length 0
16:07:24.593642 IP localhost.54057 > localhost.nsesrvr: Flags [P.], seq 1291529223:1291531407, ack 2823375664, win 257, options [nop,nop,TS val 222175732 ecr 221973933], length 2184
16:07:24.593655 IP localhost.nsesrvr > localhost.54057: Flags [.], ack 1291531407, win 384, options [nop,nop,TS val 222175732 ecr 222175732], length 0
16:08:29.714511 IP localhost.54057 > localhost.nsesrvr: Flags [.], seq 1291531407:1291547791, ack 2823375664, win 257, options [nop,nop,TS val 222240853 ecr 222175732], length 16384
16:08:29.714536 IP localhost.nsesrvr > localhost.54057: Flags [.], ack 1291547791, win 384, options [nop,nop,TS val 222240853 ecr 222240853], length 0
16:08:29.714545 IP localhost.54057 > localhost.nsesrvr: Flags [P.], seq 1291547791:1291553247, ack 2823375664, win 257, options [nop,nop,TS val 222240853 ecr 222175732], length 5456
16:08:29.714552 IP localhost.nsesrvr > localhost.54057: Flags [.], ack 1291553247, win 349, options [nop,nop,TS val 222240853 ecr 222240853], length 0

TCP包还有粘包现象，暂时没法抓包实践。