抓包分析connect函数

                connect用于连接指定的socket，连上的情况我们就不说了，这里来说说连不上的情况。

 

#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include <errno.h>
#include <malloc.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <sys/ioctl.h>
#include <stdarg.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <signal.h>
#include <netinet/tcp.h>
#define MAXLINE 4096


int main()
{
   int sockfd;
   struct sockaddr_in servaddr;
   char sendbuf[66495]="1";

   sockfd=socket(AF_INET,SOCK_STREAM,0);
   bzero(&servaddr,sizeof(servaddr));
   servaddr.sin_family=AF_INET;
   servaddr.sin_port=htons(8888);
   servaddr.sin_addr.s_addr = inet_addr("192.3.4.5");


   int ret=connect(sockfd,(struct sockaddr *)&servaddr,sizeof(servaddr));
   printf("ret=%d\n",ret);

   write(sockfd,sendbuf,sizeof(sendbuf));

   getchar();
   close(sockfd);
   return 0;
}

这里我们先指定一个不可达的ip地址，用tcpdump查看抓包情况。

 

 

[root@localhost test]# tcpdump -iany port 8888 -Xnlps0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
16:20:17.857611 IP 192.168.1.8.51444 > 2.2.2.2.ddi-tcp-1: Flags [S], seq 1607598904, win 14600, options [mss 1460,sackOK,TS val 2274614580 ecr 0,nop,wscale 7], length 0
	0x0000:  4500 003c de0c 4000 4006 96fb c0a8 0108  E..<..@.@.......
	0x0010:  0202 0202 c8f4 22b8 5fd2 0338 0000 0000  ......"._..8....
	0x0020:  a002 3908 95c4 0000 0204 05b4 0402 080a  ..9.............
	0x0030:  8793 dd34 0000 0000 0103 0307            ...4........
16:20:18.856760 IP 192.168.1.8.51444 > 2.2.2.2.ddi-tcp-1: Flags [S], seq 1607598904, win 14600, options [mss 1460,sackOK,TS val 2274615580 ecr 0,nop,wscale 7], length 0
	0x0000:  4500 003c de0d 4000 4006 96fa c0a8 0108  E..<..@.@.......
	0x0010:  0202 0202 c8f4 22b8 5fd2 0338 0000 0000  ......"._..8....
	0x0020:  a002 3908 91dc 0000 0204 05b4 0402 080a  ..9.............
	0x0030:  8793 e11c 0000 0000 0103 0307            ............
16:20:20.856712 IP 192.168.1.8.51444 > 2.2.2.2.ddi-tcp-1: Flags [S], seq 1607598904, win 14600, options [mss 1460,sackOK,TS val 2274617580 ecr 0,nop,wscale 7], length 0
	0x0000:  4500 003c de0e 4000 4006 96f9 c0a8 0108  E..<..@.@.......
	0x0010:  0202 0202 c8f4 22b8 5fd2 0338 0000 0000  ......"._..8....
	0x0020:  a002 3908 8a0c 0000 0204 05b4 0402 080a  ..9.............
	0x0030:  8793 e8ec 0000 0000 0103 0307            ............
16:20:24.856745 IP 192.168.1.8.51444 > 2.2.2.2.ddi-tcp-1: Flags [S], seq 1607598904, win 14600, options [mss 1460,sackOK,TS val 2274621580 ecr 0,nop,wscale 7], length 0
	0x0000:  4500 003c de0f 4000 4006 96f8 c0a8 0108  E..<..@.@.......
	0x0010:  0202 0202 c8f4 22b8 5fd2 0338 0000 0000  ......"._..8....
	0x0020:  a002 3908 7a6c 0000 0204 05b4 0402 080a  ..9.zl..........
	0x0030:  8793 f88c 0000 0000 0103 0307            ............
16:20:32.856835 IP 192.168.1.8.51444 > 2.2.2.2.ddi-tcp-1: Flags [S], seq 1607598904, win 14600, options [mss 1460,sackOK,TS val 2274629580 ecr 0,nop,wscale 7], length 0
	0x0000:  4500 003c de10 4000 4006 96f7 c0a8 0108  E..<..@.@.......
	0x0010:  0202 0202 c8f4 22b8 5fd2 0338 0000 0000  ......"._..8....
	0x0020:  a002 3908 5b2c 0000 0204 05b4 0402 080a  ..9.[,..........
	0x0030:  8794 17cc 0000 0000 0103 0307            ............
16:20:48.856746 IP 192.168.1.8.51444 > 2.2.2.2.ddi-tcp-1: Flags [S], seq 1607598904, win 14600, options [mss 1460,sackOK,TS val 2274645580 ecr 0,nop,wscale 7], length 0
	0x0000:  4500 003c de11 4000 4006 96f6 c0a8 0108  E..<..@.@.......
	0x0010:  0202 0202 c8f4 22b8 5fd2 0338 0000 0000  ......"._..8....
	0x0020:  a002 3908 1cac 0000 0204 05b4 0402 080a  ..9.............
	0x0030:  8794 564c 0000 0000 0103 0307            ..VL........

 

可以看到当访问不可达的IP地址时，发送超时重传了，这也是tcp的特性之一。

 

将上述IP地址改成可达的，如：127.0.0.1，用tcpdump查看抓包情况。

 

[root@localhost test]# tcpdump -iany port 8888 -Xnlps0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
16:22:18.519619 IP 127.0.0.1.41966 > 127.0.0.1.ddi-tcp-1: Flags [S], seq 403372410, win 65495, options [mss 65495,sackOK,TS val 2274735242 ecr 0,nop,wscale 7], length 0
	0x0000:  4500 003c 4df0 4000 4006 eec9 7f00 0001  E..<M.@.@.......
	0x0010:  7f00 0001 a3ee 22b8 180a f97a 0000 0000  ......"....z....
	0x0020:  a002 ffd7 3bb6 0000 0204 ffd7 0402 080a  ....;...........
	0x0030:  8795 b48a 0000 0000 0103 0307            ............
16:22:18.519633 IP 127.0.0.1.ddi-tcp-1 > 127.0.0.1.41966: Flags [R.], seq 0, ack 403372411, win 0, length 0
	0x0000:  4500 0028 0000 4000 4006 3cce 7f00 0001  E..(..@.@.<.....
	0x0010:  7f00 0001 22b8 a3ee 0000 0000 180a f97b  ...."..........{
	0x0020:  5014 0000 d9a1 0000                      P.......

因为没有本地服务端在端口8888监听，所以直接返回RST。