简单的tcpdump抓包说明
安装tcpdump
yum install tcpdump -y
最好设置一下网卡的混杂模式
参考文档
https://blog.csdn.net/weixin_37127253/article/details/84308131
ifconfig eth0 promisc
开启端口监听
#注意iptables放行端口访问
nohup python -m SimpleHTTPServer 88 &
tcpdum监听流量信息
tcpdump -vvv -i ens33 -p tcp port 88
telnet主机查看telnet流量特征
telnet 10.1.1.10 88
连接后不要输入任何信息,查看抓包结果
tcpdump: listening on ens33, link-type EN10MB (Ethernet), capture size 262144 bytes
05:41:28.949213 IP (tos 0x0, ttl 128, id 56061, offset 0, flags [DF], proto TCP (6), length 52)
10.1.1.1.53120 > localhost.localdomain.kerberos: Flags [S], cksum 0x1ec2 (correct), seq 1105931661, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
05:41:28.949262 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 52)
localhost.localdomain.kerberos > 10.1.1.1.53120: Flags [S.], cksum 0x1633 (incorrect -> 0x8c23), seq 275712768, ack 1105931662, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0
05:41:28.949437 IP (tos 0x0, ttl 128, id 56062, offset 0, flags [DF], proto TCP (6), length 40)
10.1.1.1.53120 > localhost.localdomain.kerberos: Flags [.], cksum 0x2efc (correct), seq 1, ack 1, win 4106, length 0
可以看到如下过程
- 10.1.1.1向服务器发送了syn包,对应标志Flags [S]
- 服务器答复10.1.1.1 syn和ack包,对应标志为Flags [S.]
- 10.1.1.1答复服务器ack包,对应标志为Flags [.]
一次curl访问的完整连接抓包
访问服务器命令
curl 10.1.1.10:88
抓包结果
05:59:40.288219 IP (tos 0x0, ttl 128, id 56124, offset 0, flags [DF], proto TCP (6), length 52)
10.1.1.1.54607 > localhost.localdomain.kerberos: Flags [S], cksum 0x11a4 (correct), seq 1540299512, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
05:59:40.288270 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 52)
localhost.localdomain.kerberos > 10.1.1.1.54607: Flags [S.], cksum 0x1633 (incorrect -> 0x626a), seq 1768017576, ack 1540299513, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0
05:59:40.288421 IP (tos 0x0, ttl 128, id 56125, offset 0, flags [DF], proto TCP (6), length 40)
10.1.1.1.54607 > localhost.localdomain.kerberos: Flags [.], cksum 0x0543 (correct), seq 1, ack 1, win 4106, length 0
05:59:40.300603 IP (tos 0x0, ttl 128, id 56126, offset 0, flags [DF], proto TCP (6), length 116)
10.1.1.1.54607 > localhost.localdomain.kerberos: Flags [P.], cksum 0xc9b1 (correct), seq 1:77, ack 1, win 4106, length 76
05:59:40.300716 IP (tos 0x0, ttl 64, id 16264, offset 0, flags [DF], proto TCP (6), length 40)
localhost.localdomain.kerberos > 10.1.1.1.54607: Flags [.], cksum 0x1627 (incorrect -> 0x141c), seq 1, ack 77, win 229, length 0
05:59:40.638453 IP (tos 0x0, ttl 64, id 16265, offset 0, flags [DF], proto TCP (6), length 57)
localhost.localdomain.kerberos > 10.1.1.1.54607: Flags [P.], cksum 0x1638 (incorrect -> 0x543e), seq 1:18, ack 77, win 229, length 17
05:59:40.638865 IP (tos 0x0, ttl 64, id 16266, offset 0, flags [DF], proto TCP (6), length 745)
localhost.localdomain.kerberos > 10.1.1.1.54607: Flags [FP.], cksum 0x18e8 (incorrect -> 0x8cc8), seq 18:723, ack 77, win 229, length 705
05:59:40.639007 IP (tos 0x0, ttl 128, id 56128, offset 0, flags [DF], proto TCP (6), length 40)
10.1.1.1.54607 > localhost.localdomain.kerberos: Flags [.], cksum 0x0228 (correct), seq 77, ack 723, win 4103, length 0
05:59:40.640293 IP (tos 0x0, ttl 128, id 56130, offset 0, flags [DF], proto TCP (6), length 40)
10.1.1.1.54607 > localhost.localdomain.kerberos: Flags [.], cksum 0x0227 (correct), seq 77, ack 724, win 4103, length 0
05:59:40.648738 IP (tos 0x0, ttl 128, id 56132, offset 0, flags [DF], proto TCP (6), length 40)
10.1.1.1.54607 > localhost.localdomain.kerberos: Flags [F.], cksum 0x0226 (correct), seq 77, ack 724, win 4103, length 0
05:59:40.648839 IP (tos 0x0, ttl 64, id 29339, offset 0, flags [DF], proto TCP (6), length 40)
localhost.localdomain.kerberos > 10.1.1.1.54607: Flags [.], cksum 0x1148 (correct), seq 724, ack 78, win 229, length 0
可以看到连接断开和数据发送的完整过程
附常用flag标志释义
SYN表示建立连接,
FIN表示关闭连接,
ACK表示响应,
PSH表示有 DATA数据传输,
RST表示连接重置
F : FIN - 结束; 结束会话
S : SYN - 同步; 表示开始会话请求
R : RST - 复位;中断一个连接
P : PUSH - 推送; 数据包立即发送
A : ACK - 应答