首页 > 代码库 > tcpdump抓包以及端口查看的一些操作

tcpdump抓包以及端口查看的一些操作

1.tcpdump;

      nginx开启后会占用80端口,此时执行命令:tcpdump tcp port 80 

         结果如下:

[syswj@host ~]$ sudo tcpdump tcp port 80
[sudo] password for syswj: 
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on Auto_eth0, link-type EN10MB (Ethernet), capture size 65535 bytes


  采用tcpdump抓到大包会显示到屏幕上:

1.在windows上通过telnet     ip    端口号  来连接linux上80端口运行的nginx服务器

      

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on Auto_eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
14:14:23.406697 IP 192.168.137.1.7352 > 192.168.137.128.http: Flags [S], seq 322176964, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
14:14:23.406740 IP 192.168.137.128.http > 192.168.137.1.7352: Flags [S.], seq 300095102, ack 322176965, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 6], length 0
14:14:23.406992 IP 192.168.137.1.7352 > 192.168.137.128.http: Flags [.], ack 1, win 256, length 0

这就是tcp的3次握手经过

2.退出windows上的telnet后:

14:16:37.910069 IP 192.168.137.1.7360 > 192.168.137.128.http: Flags [F.], seq 1, ack 1, win 256, length 0
14:16:37.910194 IP 192.168.137.128.http > 192.168.137.1.7360: Flags [F.], seq 1, ack 2, win 229, length 0
14:16:37.910854 IP 192.168.137.1.7360 > 192.168.137.128.http: Flags [.], ack 2, win 256, length 0

客户端跟服务器发送一个FIN结束报文,服务器收到后,


3.在网页上(windows)进入http:192.168.137.128

  进入的时候:

[sudo] password for syswj: 
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on Auto_eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
14:23:09.504575 IP 192.168.137.1.rtps-dd-mt > 192.168.137.128.http: Flags [S], seq 4063271087, win 65535, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
14:23:09.504610 IP 192.168.137.128.http > 192.168.137.1.rtps-dd-mt: Flags [S.], seq 1526809447, ack 4063271088, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 6], length 0
14:23:09.504867 IP 192.168.137.1.rtps-dd-mt > 192.168.137.128.http: Flags [.], ack 1, win 1024, length 0

  也是和上面一样的3次握手

 关闭页面,等待一段时间后:

14:24:09.565990 IP 192.168.137.128.http > 192.168.137.1.rtps-dd-mt: Flags [F.], seq 1, ack 1, win 229, length 0
14:24:09.566290 IP 192.168.137.1.rtps-dd-mt > 192.168.137.128.http: Flags [.], ack 2, win 1024, length 0

 再等待一段时间后: 

14:25:32.242143 IP 192.168.137.1.rtps-dd-mt > 192.168.137.128.http: Flags [F.], seq 1, ack 2, win 1024, length 0
14:25:32.242248 IP 192.168.137.128.http > 192.168.137.1.rtps-dd-mt: Flags [R], seq 1526809449, win 0, length 0

--因为超时的原因服务器已经关闭了这个连接,此时客户端再向服务器发送信息,服务器根本不识别这个客户端,所以返回一个RST报文


关于端口的一些命令:

lsof  -i  :端口号    ----查看端口进程信息

关闭某个端口的进程:

  先用lsof -i:端口号 查出这个端口的进程,找出pid,然后kill -9 pid,关闭进程

  或者 直接: fuser -k 80/tcp     

查看端口进程:

  netstat -anp | grep 80



 

   



 

         




tcpdump抓包以及端口查看的一些操作