使用tcpdump测试反向代理和lvs的nat区别

关于反向代理，一个请求过来，实际反向代理服务器要和两个对象做3次握手

客户端到反向代理服务器，是一个3次握手

反向代理服务器请求后端web服务器，是一个3次握手

 

lvs的nat和反向代理不同。

lvs实际只修改数据包的目标地址，不做其它的操作。数据包的随机序列号seq等没变，实际还是客户端和后端web服务器做的3次握手

 

可以通过tcpdump抓取反向代理服务器的端口记录和后端web服务器的端口记录，看到一个请求过来之后，两个请求的seq是不一样的。

tcpdump 命令用法

-i 接网卡名 ，我这里网卡是是ens33，不是eth0,

port 接端口号 ，抓取哪个端口的数据

-vvv显示的信息多一点

查看抓取过程

可以看到Flag标志位，如果是S，表示syn。 序列号seq是个随机的值

 

 

接下来通过是研究证明，反向代理和后端web服务器，客户端和反向代理是2个3次握手

为了防止健康检查的干扰，把haproxy健康检查时间设置长一点，比如100秒，或者干脆取消健康检查

[root@linux-node1 ~]# vim /etc/haproxy/haproxy.cfg
[root@linux-node1 ~]# tail -3 /etc/haproxy/haproxy.cfg
   option httpchk  GET /index.html 
   balance  roundrobin
   server	linux-node2	10.0.1.106:8080	   check inter 100000 rise 3 fall 3 weight 1
[root@linux-node1 ~]# /etc/init.d/haproxy restart

然后客户端去访问http://10.0.1.105/test.js

 这样请求一定是发送到node2，因为反向代理做了规则设置，js为结尾的文件都指向了node2上

 

 抓取反向代理的80端口，看到seq是2964464279

[root@linux-node1 ~]# tcpdump -i ens33 port 80
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens33, link-type EN10MB (Ethernet), capture size 65535 bytes
02:39:39.219612 IP 10.0.1.72.56057 > linux-node1.example.com.http: Flags [S], seq 2964464279, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
02:39:39.219664 IP linux-node1.example.com.http > 10.0.1.72.56057: Flags [S.], seq 3532921320, ack 2964464280, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0
02:39:39.221150 IP 10.0.1.72.56057 > linux-node1.example.com.http: Flags [.], ack 1, win 16425, length 0
02:39:39.221193 IP 10.0.1.72.56059 > linux-node1.example.com.http: Flags [S], seq 1955250633, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
02:39:39.221209 IP linux-node1.example.com.http > 10.0.1.72.56059: Flags [S.], seq 127908139, ack 1955250634, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0
02:39:39.222792 IP 10.0.1.72.56059 > linux-node1.example.com.http: Flags [.], ack 1, win 16425, length 0
02:39:39.239383 IP 10.0.1.72.56057 > linux-node1.example.com.http: Flags [P.], seq 1:485, ack 1, win 16425, length 484
02:39:39.242443 IP linux-node1.example.com.http > 10.0.1.72.56057: Flags [P.], seq 1:123, ack 485, win 237, length 122
02:39:39.437364 IP 10.0.1.72.56057 > linux-node1.example.com.http: Flags [.], ack 123, win 16394, length 0
^C
9 packets captured
9 packets received by filter
0 packets dropped by kernel
[root@linux-node1 ~]# 

抓取后端web服务器的8080端口，看到seq是4209329376

[root@linux-node2 conf]# tcpdump -i ens33 port 8080 -vvv
tcpdump: listening on ens33, link-type EN10MB (Ethernet), capture size 65535 bytes
02:39:39.259521 IP (tos 0x0, ttl 64, id 35579, offset 0, flags [DF], proto TCP (6), length 60)
    10.0.1.105.52292 > linux-node2.example.com.webcache: Flags [S], cksum 0xaac9 (correct), seq 4209329376, win 29200, options [mss 1460,sackOK,TS val 446549531 ecr 0,nop,wscale 7], length 0
02:39:39.259574 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    linux-node2.example.com.webcache > 10.0.1.105.52292: Flags [S.], cksum 0x1701 (incorrect -> 0xaaf9), seq 2283093898, ack 4209329377, win 28960, options [mss 1460,sackOK,TS val 446504562 ecr 446549531,nop,wscale 7], length 0
02:39:39.260064 IP (tos 0x0, ttl 64, id 35580, offset 0, flags [DF], proto TCP (6), length 52)
    10.0.1.105.52292 > linux-node2.example.com.webcache: Flags [.], cksum 0x4a01 (correct), seq 1, ack 1, win 229, options [nop,nop,TS val 446549531 ecr 446504562], length 0
02:39:39.260236 IP (tos 0x0, ttl 64, id 35581, offset 0, flags [DF], proto TCP (6), length 534)
    10.0.1.105.52292 > linux-node2.example.com.webcache: Flags [P.], cksum 0xb821 (correct), seq 1:483, ack 1, win 229, options [nop,nop,TS val 446549532 ecr 446504562], length 482
02:39:39.260276 IP (tos 0x0, ttl 64, id 8696, offset 0, flags [DF], proto TCP (6), length 52)
    linux-node2.example.com.webcache > 10.0.1.105.52292: Flags [.], cksum 0x16f9 (incorrect -> 0x4817), seq 1, ack 483, win 235, options [nop,nop,TS val 446504563 ecr 446549532], length 0
02:39:39.260876 IP (tos 0x0, ttl 64, id 8697, offset 0, flags [DF], proto TCP (6), length 174)
    linux-node2.example.com.webcache > 10.0.1.105.52292: Flags [P.], cksum 0x1773 (incorrect -> 0x3575), seq 1:123, ack 483, win 235, options [nop,nop,TS val 446504564 ecr 446549532], length 122
02:39:39.261330 IP (tos 0x0, ttl 64, id 35582, offset 0, flags [DF], proto TCP (6), length 52)
    10.0.1.105.52292 > linux-node2.example.com.webcache: Flags [.], cksum 0x47a1 (correct), seq 483, ack 123, win 229, options [nop,nop,TS val 446549533 ecr 446504564], length 0
^C
7 packets captured
7 packets received by filter
0 packets dropped by kernel
[root@linux-node2 conf]# 

　　

 

转载于:https://www.cnblogs.com/nmap/p/6498066.html