用tcpdump 分析如何建立与关闭tcp连接

according to preview article  【并发服务器系列】3 epoll模型

I use tcpdump to analyze how tcp build up a connection, send a message ,and close the connection. (code are available in the preview article.)

 client(172.18.70.159) use a random port 49538 to connection server(172.18.70.149:54321)

now I print out the client's captured:

  1 sudo tcpdump port 54321

 2 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

 3 listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes

 4 

 5 

 6 19:29:52.674854 IP bogon.49538 > bogon.54321: Flags [S], seq 2303324334, win 5840, options [mss 1460,sackOK,TS val 6717463 ecr 0,nop,wscale 5], length 0

 7 19:29:52.675309 IP bogon.54321 > bogon.49538: Flags [S.], seq 2402310477, ack 2303324335, win 5792, options [mss 1460,sackOK,TS val 3494999994 ecr 6717463,nop,wscale 6], length 0

 8 19:29:52.675351 IP bogon.49538 > bogon.54321: Flags [.], ack 1, win 183, options [nop,nop,TS val 6717464 ecr 3494999994], length 0

 9 



19:29:52.676059 IP bogon.49538 > bogon.54321: Flags [P.], seq 1:34, ack 1, win 183, options [nop,nop,TS val 6717464 ecr 3494999994], length 33

 19:29:52.676489 IP bogon.54321 > bogon.49538: Flags [.], ack 34, win 91, options [nop,nop,TS val 3494999995 ecr 6717464], length 0

 19:29:52.676517 IP bogon.54321 > bogon.49538: Flags [P.], seq 1:30, ack 34, win 91, options [nop,nop,TS val 3494999995 ecr 6717464], length 29





12 
19:29:52.676526 IP bogon.49538 > bogon.54321: Flags [.], ack 30, win 183, options [nop,nop,TS val 6717464 ecr 3494999995], length 0

 19:29:52.676591 IP bogon.54321 > bogon.49538: Flags [F.], seq 30, ack 34, win 91, options [nop,nop,TS val 3494999995 ecr 6717464], length 0

 19:29:52.677302 IP bogon.49538 > bogon.54321: Flags [F.], seq 34, ack 31, win 183, options [nop,nop,TS val 6717464 ecr 3494999995], length 0

 19:29:52.677641 IP bogon.54321 > bogon.49538: Flags [.], ack 35, win 91, options [nop,nop,TS val 3494999996 ecr 6717464], length 0

line 6,7,8(first 3 lines) is how the connection build (called three handshakes).

line  9,10,11 (middle 3 lines ) is how message send.

line 12,13,14,15 (last 4 lines)  is how conncetion close.(called four handshakes)

 here is server's capture:

 1 19:30:49.882720 IP bogon.49538 > bogon.54321: Flags [S], seq 2303324334, win 5840, options [mss 1460,sackOK,TS val 6717463 ecr 0,nop,wscale 5], length 0
 2 19:30:49.882771 IP bogon.54321 > bogon.49538: Flags [S.], seq 2402310477, ack 2303324335, win 5792, options [mss 1460,sackOK,TS val 3494999994 ecr 6717463,nop,wscale 6], length 0
 3 19:30:49.883168 IP bogon.49538 > bogon.54321: Flags [.], ack 1, win 183, options [nop,nop,TS val 6717464 ecr 3494999994], length 0
 4 
 5 
 6 19:30:49.883888 IP bogon.49538 > bogon.54321: Flags [P.], seq 1:34, ack 1, win 183, options [nop,nop,TS val 6717464 ecr 3494999994], length 33
 7 19:30:49.883917 IP bogon.54321 > bogon.49538: Flags [.], ack 34, win 91, options [nop,nop,TS val 3494999995 ecr 6717464], length 0
 8 19:30:49.883986 IP bogon.54321 > bogon.49538: Flags [P.], seq 1:30, ack 34, win 91, options [nop,nop,TS val 3494999995 ecr 6717464], length 29
 9 
 
 19:30:49.884028 IP bogon.54321 > bogon.49538: Flags [F.], seq 30, ack 34, win 91, options [nop,nop,TS val 3494999995 ecr 6717464], length 0
 19:30:49.884355 IP bogon.49538 > bogon.54321: Flags [.], ack 30, win 183, options [nop,nop,TS val 6717464 ecr 3494999995], length 0
 19:30:49.885115 IP bogon.49538 > bogon.54321: Flags [F.], seq 34, ack 31, win 183, options [nop,nop,TS val 6717464 ecr 3494999995], length 0

 19:30:49.885139 IP bogon.54321 > bogon.49538: Flags [.], ack 35, win 91, options [nop,nop,TS val 3494999996 ecr 6717464], length 0 

what does S . P F mean ?

S SYN ---- sys number

F FIN ---- finished sending message

P PSH --- send message to app 

R RST --- connection RST

.     --- all above set 0

analyse:

three handshakes to build up a connection

• client(172.18.70.159) send a SYN to server(172.18.70.149)'s port(54321)
• server send another SYN to client , in the same time use ack+1 to confirm the client's SYN
• client confirm back server SYN with ack+1

four handshakes to close a connection

• server send to client a FIN
• client confirm back server SYN with ack+1
• client send to server a FIN
• server confirm back client SYN with ack+1

from line 11 we can see server send the FIN to client (code:close(events[n].data.fd);  //chat_server.cpp)

dengwei@dengwei-desktop:~/Desktop$ ./chat 172.18.70.149
chat client start 172.18.70.149 
 write finished msg:     hello, this is client  
 iwrite =  33 
 ----> receive msg_content:     Hi this is server 

 ireadback =  29  

message send and receive:

• length 33 was sent by client ( a message struct with content: hello, this is client) --- first of middle 3 lines
• a confim in the middle
• length 29 was received from server to ( a message struct with content: Hi thi is server) --- last of middle 3 lines

Operating System:

[dengwei@localhost ~]$ uname -a

Linux localhost.localdomain 2.6.35.14-106.fc14.i686 #1 SMP Wed Nov 23 13:57:33 UTC 2011 i686 i686 i386 GNU/Linux

 

EOF