αα½ααααΈα’αααααΆααα’ααααααΆ αααα»ααααααααΆααΆ αααα»αααΉαααΆαααΆαααααΎααααααααααααΆαααααααα FunCorpα ααΎαααααΌα α’αααααααααααα αααααΆαα’αα»ααααααααΆααααααααααααααααααΎααααΆααααα αααααΆααα·αααα ααααα½αααααα½αααΆαααΆα ααααα... ααΆααΆααααααΆααααα½ααααα»αααΆαααΆαααααααααΆααααααΈαα½αααααα‘ααααΈααααΆ ααα»αααααααααΆααα·αααα α αΆαααΆα αααααΌαααααΎαααααα’ααααααααααααααΆααααααααΆαα αα·ααα αα αααααΆααΏααααΎαα‘αΎαααΎαααααΆαα
αα αααα»αα’αααααααααααα»αααΉααα·ααΆαα’αααΈα§αααααααααΎααααΆααα ααα½αααΈααααα’αΆα ααααΌαααΆαααααΎααΎααααΈαα·αα·αααααΎαααααΆααΈαααΌααΌαααααΆαααααα·αααααΆα’αααΈααααα·ααααα·ααΆααααααααα·ααΈαα αααα»αααααααΆααααααα αΆαααααΆαα
ααΆααααααααααΎαααα αΆαααααΆα
ααΆααααααΆ αααααα·ααΈααααΌαααΆαααΆααααααα ααΎαααΆαααΈαααααΆαααααααΆαα½αααΉαααΆααααααΆααα’ααΈαααΊαα·αααααα’α αα αααα»αααα·ααΆααΆαααα·αααααααα’αΆααααα α’αααΈααααα ααααΆαα·ααααΌααα ααΌα αααααααααααα’αααααααΌαααΆααααααααααα·ααΈαα αααα»αααααααααααααΆααααααΆαααα·αααα’α αα ααΎααΈαα»α α§αααααααααΎααααΆααααΉααα½ααααα»ααα·α αα ααΆαααααΆααααααααααΎαααααααααααααα tc.
tc(abbr α ααΈααΆααααααααααα
ααΆα
ααα) α’αα»ααααΆαα±ααα’αααααααααα
ααΆααααααααααΆααααααΌααααα
αααααααΆααα
αααα»αααααααααα α§αααααααααΎααααΆαααααααΆααααααααΆαα’ααα
αΆααα α’αααα’αΆα
α’αΆαααααααα’αααΈαα½αααα
ααΌαααΎαααααΎαααΆααααΆαααΈαααα’αααΌαα
ααΎαααΆαααΈααα (αααα»αααΆαααααΎ
ncat -l 127.0.0.1 12345 -k -c 'xargs -n1 -i echo "Response: {}"'
ααΎααααΈαααα αΆααααα’α·αα’αααΈαααααααΆααΆααα’αααα ααα αΆαααΈαα½ααααα’αααααααααααΆααααΆαααΈαααααα αα·ααααΆαααΈααα αααα»αααΆααααααααααααΈα Python ααΆαααααααααααΎααααΎ ααΆαααααΎααααα αα ααΆαααααΆαααΈαααα’αααΌααααααΎαα
ααΌααααααα’αα·αα·αα
#!/bin/python
import socket
import time
HOST = '127.0.0.1'
PORT = 12345
BUFFER_SIZE = 1024
MESSAGE = "Testn"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
t1 = time.time()
print "[time before connection: %.5f]" % t1
s.connect((HOST, PORT))
print "[time after connection, before sending: %.5f]" % time.time()
s.send(MESSAGE)
print "[time after sending, before receiving: %.5f]" % time.time()
data = s.recv(BUFFER_SIZE)
print "[time after receiving, before closing: %.5f]" % time.time()
s.close()
t2 = time.time()
print "[time after closing: %.5f]" % t2
print "[total duration: %.5f]" % (t2 - t1)
print data
ααΌαααΎαααααΎαααΆαααΆ α αΎαααΎαα ααΆα ααααα ααΎα ααα»α αααααΆαα lo αα·αα ααα 12345:
[user@host ~]# python client.py
[time before connection: 1578652979.44837]
[time after connection, before sending: 1578652979.44889]
[time after sending, before receiving: 1578652979.44894]
[time after receiving, before closing: 1578652979.45922]
[time after closing: 1578652979.45928]
[total duration: 0.01091]
Response: Test
ααααααα ααααααΆα
[user@host ~]# tcpdump -i lo -nn port 12345
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
10:42:59.448601 IP 127.0.0.1.54054 > 127.0.0.1.12345: Flags [S], seq 3383332866, win 43690, options [mss 65495,sackOK,TS val 606325685 ecr 0,nop,wscale 7], length 0
10:42:59.448612 IP 127.0.0.1.12345 > 127.0.0.1.54054: Flags [S.], seq 2584700178, ack 3383332867, win 43690, options [mss 65495,sackOK,TS val 606325685 ecr 606325685,nop,wscale 7], length 0
10:42:59.448622 IP 127.0.0.1.54054 > 127.0.0.1.12345: Flags [.], ack 1, win 342, options [nop,nop,TS val 606325685 ecr 606325685], length 0
10:42:59.448923 IP 127.0.0.1.54054 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 606325685 ecr 606325685], length 5
10:42:59.448930 IP 127.0.0.1.12345 > 127.0.0.1.54054: Flags [.], ack 6, win 342, options [nop,nop,TS val 606325685 ecr 606325685], length 0
10:42:59.459118 IP 127.0.0.1.12345 > 127.0.0.1.54054: Flags [P.], seq 1:15, ack 6, win 342, options [nop,nop,TS val 606325696 ecr 606325685], length 14
10:42:59.459213 IP 127.0.0.1.54054 > 127.0.0.1.12345: Flags [.], ack 15, win 342, options [nop,nop,TS val 606325696 ecr 606325696], length 0
10:42:59.459268 IP 127.0.0.1.54054 > 127.0.0.1.12345: Flags [F.], seq 6, ack 15, win 342, options [nop,nop,TS val 606325696 ecr 606325696], length 0
10:42:59.460184 IP 127.0.0.1.12345 > 127.0.0.1.54054: Flags [F.], seq 15, ack 7, win 342, options [nop,nop,TS val 606325697 ecr 606325696], length 0
10:42:59.460196 IP 127.0.0.1.54054 > 127.0.0.1.12345: Flags [.], ack 16, win 342, options [nop,nop,TS val 606325697 ecr 606325697], length 0
α’αααΈααααααααΆαααΊαααααααΆαα ααΆαα αΆααααααΈααααΌα PSH / ACK αα·α ACK αααα»αααΆαααααΎαααααΈααα - αααααΊααΆααΆαααααΆααααααΌαααααΎαα·αααΆαααααΎααααααΆαα’αα·αα·αααα·ααααΆαααΈαααα αΎα FIN / ACK αα·α ACK ααΈααα - αααα ααααΆααααααΆααα
ααΆααααααΆααααααα ααααααααΆα
α₯α‘αΌαααααααααααΆααααααΆααααααα 500 ααΈααΈαα·ααΆααΈα
tc qdisc add dev lo root netem delay 500ms
ααΎαααΎαααααΎαααΆααααΆαααΈαααααα α αΎαααΎαααΆααααααΈααααααααΎαααΆααααααα 2 αα·ααΆααΈα
[user@host ~]# ./client.py
[time before connection: 1578662612.71044]
[time after connection, before sending: 1578662613.71059]
[time after sending, before receiving: 1578662613.71065]
[time after receiving, before closing: 1578662614.72011]
[time after closing: 1578662614.72019]
[total duration: 2.00974]
Response: Test
ααΎααΆαα’αααΈαα αααα»αα ααΆα ααα? αααααΎαα
ααααααα ααααααΆα
13:23:33.210520 IP 127.0.0.1.58694 > 127.0.0.1.12345: Flags [S], seq 1720950927, win 43690, options [mss 65495,sackOK,TS val 615958947 ecr 0,nop,wscale 7], length 0
13:23:33.710554 IP 127.0.0.1.12345 > 127.0.0.1.58694: Flags [S.], seq 1801168125, ack 1720950928, win 43690, options [mss 65495,sackOK,TS val 615959447 ecr 615958947,nop,wscale 7], length 0
13:23:34.210590 IP 127.0.0.1.58694 > 127.0.0.1.12345: Flags [.], ack 1, win 342, options [nop,nop,TS val 615959947 ecr 615959447], length 0
13:23:34.210657 IP 127.0.0.1.58694 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 615959947 ecr 615959447], length 5
13:23:34.710680 IP 127.0.0.1.12345 > 127.0.0.1.58694: Flags [.], ack 6, win 342, options [nop,nop,TS val 615960447 ecr 615959947], length 0
13:23:34.719371 IP 127.0.0.1.12345 > 127.0.0.1.58694: Flags [P.], seq 1:15, ack 6, win 342, options [nop,nop,TS val 615960456 ecr 615959947], length 14
13:23:35.220106 IP 127.0.0.1.58694 > 127.0.0.1.12345: Flags [.], ack 15, win 342, options [nop,nop,TS val 615960957 ecr 615960456], length 0
13:23:35.220188 IP 127.0.0.1.58694 > 127.0.0.1.12345: Flags [F.], seq 6, ack 15, win 342, options [nop,nop,TS val 615960957 ecr 615960456], length 0
13:23:35.720994 IP 127.0.0.1.12345 > 127.0.0.1.58694: Flags [F.], seq 15, ack 7, win 342, options [nop,nop,TS val 615961457 ecr 615960957], length 0
13:23:36.221025 IP 127.0.0.1.58694 > 127.0.0.1.12345: Flags [.], ack 16, win 342, options [nop,nop,TS val 615961957 ecr 615961457], length 0
α’αααα’αΆα ααΎαααΎαααΆααΆαααΊααααΆααααααααΉααα»αααααΆαααααααΆααα·ααΆααΈααΆαααα α‘αΎααα αααα»αα’αααααααααααΆααααΆαααΈαααααααα·ααααΆαααΈαααα ααααααααααΆαα₯αα·ααΆαααα½αα±ααα αΆααα’αΆααααααααΆαααα ααααα·αααΎααΆαααΊααααΆαααΆααααα αααΎαα ααΊαααα αΆααααααΎααααααΌααααα αα TCP αα½αα ααα½αα‘αΎααα·αα αααααααΌαααΆααααααΆαααααα 1 αα·ααΆααΈ α αΎαααΎαα ααΆα ααα (αααα»αααΉααα·ααααα αΆαααααααααααα’αα·αα·αααα ααΆααΆα 4 αα·ααΆααΈαααααααΉααα»ααααα»αααααααααα»α):
tc qdisc change dev lo root netem delay 1s
ααααααα ααααααΆα
13:29:07.709981 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [S], seq 283338334, win 43690, options [mss 65495,sackOK,TS val 616292946 ecr 0,nop,wscale 7], length 0
13:29:08.710018 IP 127.0.0.1.12345 > 127.0.0.1.39306: Flags [S.], seq 3514208179, ack 283338335, win 43690, options [mss 65495,sackOK,TS val 616293946 ecr 616292946,nop,wscale 7], length 0
13:29:08.711094 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [S], seq 283338334, win 43690, options [mss 65495,sackOK,TS val 616293948 ecr 0,nop,wscale 7], length 0
13:29:09.710048 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [.], ack 1, win 342, options [nop,nop,TS val 616294946 ecr 616293946], length 0
13:29:09.710152 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 616294947 ecr 616293946], length 5
13:29:09.711120 IP 127.0.0.1.12345 > 127.0.0.1.39306: Flags [S.], seq 3514208179, ack 283338335, win 43690, options [mss 65495,sackOK,TS val 616294948 ecr 616292946,nop,wscale 7], length 0
13:29:10.710173 IP 127.0.0.1.12345 > 127.0.0.1.39306: Flags [.], ack 6, win 342, options [nop,nop,TS val 616295947 ecr 616294947], length 0
13:29:10.711140 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [.], ack 1, win 342, options [nop,nop,TS val 616295948 ecr 616293946], length 0
13:29:10.714782 IP 127.0.0.1.12345 > 127.0.0.1.39306: Flags [P.], seq 1:15, ack 6, win 342, options [nop,nop,TS val 616295951 ecr 616294947], length 14
13:29:11.714819 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [.], ack 15, win 342, options [nop,nop,TS val 616296951 ecr 616295951], length 0
13:29:11.714893 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [F.], seq 6, ack 15, win 342, options [nop,nop,TS val 616296951 ecr 616295951], length 0
13:29:12.715562 IP 127.0.0.1.12345 > 127.0.0.1.39306: Flags [F.], seq 15, ack 7, win 342, options [nop,nop,TS val 616297952 ecr 616296951], length 0
13:29:13.715596 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [.], ack 16, win 342, options [nop,nop,TS val 616298952 ecr 616297952], length 0
ααΆα’αΆα ααααΌαααΆαααααΎαααΎαααΆαααΆαααΈααααααααΆαααααΎαααα αα SYN ααΈαααα αΎααααΆαααΈαααααΆαααααΎ SYN / ACK ααΈαααα
ααααααααΈααΎαααααααα ααΆααααααΆαααα’αΆα ααααΌαααΆαααααααα ααΆαααααΆα αα»αααΆαα ααα αΆα αα·αααααΆαααααα (ααΆαα½αααααααααααΆαααααα ααααααααΆααα»α)α αααααααΌαααΆαααααΎααΌα ααΆαααααα:
tc qdisc change dev lo root netem delay 500ms 400ms 50 distribution normal
αα ααΈαααααΎαααΆααααααααΆααααααΆααααα αααααααΈ 100 αα 900 αα·ααααΈαα·ααΆααΈ αααααααΉαααααΌαααΆαααααΎαααΎαααααα ααΆαααΆαα ααα αΆαααααααΆ α αΎαααΆααΉαααΆαααΆαααΆααααΆααααααααΆ 50% ααΆαα½αααΉαααααααααααΆαααααααααΆαααααα ααααααααΆααα»αα
α’ααααααα ααααΆααΆαααααααααΆααααΎαααΆαα αααα»αααΆααααααααΆααααΌαααααααα»αααΆαααααΎ αααααα, α αΎαβαααααΆααβαα ααΆαααααΆααααααΌα. α’ααααααααααΆααααααααΆααΆαααααααΊααΆααααααα ααΌα αααααααα»αααααΆααααααααααααΆααΆαα αααΎαααα delαααα’αΆα ααααΌαααΆαααααΎααΎααααΈαα»αααΆααααααα
ααΆαααΆααααααααα αα
α₯α‘αΌαααα α
αΌαααΎαααααΆααΆαααααΎααΆαααΆααααααααα
ααααααααΆαα ααΌα
αααα’αΆα
ααΎαααΎαααΈα―αααΆα αααα’αΆα
ααααΌαααΆαααααΎααΆαααΈαα·ααΈα ααΆαααΆααααααααα
ααααααααΆααααα
αααααααΆαα½αααΉαααααΌααΆαααΈααΈαααα½αα
ααα½α αααααααΎαααααααααΆαα Markov αααααα 2, 3 α¬ 4 ααΎααααΈααααΆααΆαααΆααααααααα
ααααααααΆα α¬ααααΎααααΌ Elliott-Gilbert α αα
αααα»αα’ααααααααα»αααΉααα·α
αΆαααΆαα·ααΈααΆαααααααααΌα (ααΆαααααααα»ααα·αα
αααΆαααααα»α) α αΎαα’αααα’αΆα
α’αΆαα’αααΈα’αααααα
α αΌαααααΎα±ααααΆααααα 50% αααααα ααααααααΆααααααΆαααααΆαααααα 25%α
tc qdisc add dev lo root netem loss 50% 25%
ααΆα’αα»αα, tcpdump ααΉαβαα·αβα’αΆα βαααα αΆαβα±ααβααΎαβααΎαβα αααΆααβααΈβααΆαβααΆααβαααβαααα ααβααααααΆαβαα ααΎαβααααΆααβααβαααααβααΆβααΆβαα·αβααΆβααααΎαβααΆαα α αΎααααααααΆααααΎαααΆαααααααΈααααααΎαα‘αΎα αα·ααα·ααααα·ααααααααΉααα½αααΎααααααααααΆααααΏααααα client.py (α’αΆα ααααΌαααΆααααα ααααααΆαα α¬αααα ααααΆαααα»ααααααα 20 αα·ααΆααΈ) ααααΌα ααΆααΆαααΎαα‘αΎααααααα αααααααΌαααααα
[user@host ~]# netstat -s | grep retransmited; sleep 10; netstat -s | grep retransmited
17147 segments retransmited
17185 segments retransmited
ααΆααααααααααααααααΆαααααααα αα
ααααααααΈααΎααΆαααΆααααααααα ααααααααΆα α’αααα’αΆα αααααααααΎααΆαααΌα ααΆααααα ααααααααΆαα ααα‘ααααααΆαααΉαααα α‘αΎααα ααΈααΆαααααα ααααααααΆαα αααααα α αΌαααααΎα±ααααΌα ααΆααααα ααααααααΆαααΆαα½αααΉαααααΌααΆαααΈααΈαα 50% αα·ααααααααΆαααααΆααααααα
tc qdisc change dev lo root netem corrupt 50%
ααΎαααααΎαααΆαααααααΈαα’αα·αα·αα (ααααΆαα’αααΈαα½αα±ααα αΆααα’αΆαααααααα ααΈαααααααα»ααααααΆα αααΆαααα 2 αα·ααΆααΈααΎααααΈαααα αα) ααΎαα ααΆα αααα
ααααααα ααααααΆα
[user@host ~]# tcpdump -i lo -nn port 12345
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
10:20:54.812434 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [S], seq 2023663770, win 43690, options [mss 65495,sackOK,TS val 1037001049 ecr 0,nop,wscale 7], length 0
10:20:54.812449 IP 127.0.0.1.12345 > 127.0.0.1.43666: Flags [S.], seq 2104268044, ack 2023663771, win 43690, options [mss 65495,sackOK,TS val 1037001049 ecr 1037001049,nop,wscale 7], length 0
10:20:54.812458 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [.], ack 1, win 342, options [nop,nop,TS val 1037001049 ecr 1037001049], length 0
10:20:54.812509 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 1037001049 ecr 1037001049], length 5
10:20:55.013093 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 1037001250 ecr 1037001049], length 5
10:20:55.013122 IP 127.0.0.1.12345 > 127.0.0.1.43666: Flags [.], ack 6, win 342, options [nop,nop,TS val 1037001250 ecr 1037001250], length 0
10:20:55.014681 IP 127.0.0.1.12345 > 127.0.0.1.43666: Flags [P.], seq 1:15, ack 6, win 342, options [nop,nop,TS val 1037001251 ecr 1037001250], length 14
10:20:55.014745 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [.], ack 15, win 340, options [nop,nop,TS val 1037001251 ecr 1037001251], length 0
10:20:55.014823 IP 127.0.0.1.43666 > 127.0.0.5.12345: Flags [F.], seq 2023663776, ack 2104268059, win 342, options [nop,nop,TS val 1037001251 ecr 1037001251], length 0
10:20:55.214088 IP 127.0.0.1.12345 > 127.0.0.1.43666: Flags [P.], seq 1:15, ack 6, win 342, options [nop,unknown-65 0x0a3dcf62eb3d,[bad opt]>
10:20:55.416087 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [F.], seq 6, ack 15, win 342, options [nop,nop,TS val 1037001653 ecr 1037001251], length 0
10:20:55.416804 IP 127.0.0.1.12345 > 127.0.0.1.43666: Flags [F.], seq 15, ack 7, win 342, options [nop,nop,TS val 1037001653 ecr 1037001653], length 0
10:20:55.416818 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [.], ack 16, win 343, options [nop,nop,TS val 1037001653 ecr 1037001653], length 0
10:20:56.147086 IP 127.0.0.1.12345 > 127.0.0.1.43666: Flags [F.], seq 15, ack 7, win 342, options [nop,nop,TS val 1037002384 ecr 1037001653], length 0
10:20:56.147101 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [.], ack 16, win 342, options [nop,nop,TS val 1037002384 ecr 1037001653], length 0
ααΆα’αΆα ααααΌαααΆαααααΎαααΎαααΆαααα ααααααααΆααα½αα ααα½αααααΌαααΆαααααΎααααα αΎαααααααα α αΎαααΆααααα αααα½αααΆαα½αααΉααα·ααααααααααΆαααααΌα α αααααΎα [nop,unknown-65 0x0a3dcf62eb3d, [αααααΎααα·αααα’]>. ααα»ααααααΏαααααΆααααΊααΆαα ααΈαααα ααα’αααΈααααααααΆαααααΎαααΆαααΆαααααΉαααααΌα - TCP ααΆααααΌααααΆαααΉαααΆααα·α αα ααααααΆα
ααΆαα αααααααα ααααααααΆα
ααΎα’αααα’αΆα ααααΎα’αααΈαααααΆαα½α ααααΆαα? α§ααΆα ααα αααααααααΎααααΆαααΆααααα αααΆαααααΆαααΆααααααααα ααααααααΆα - ααΆαα αααααααα ααααααααΆαα ααΆαααβαααααΆβαααβααβααβα’αΆαα»ααααα 2 αααΆαβαααα ααααΌααΆαααΈααΈαα αα·αβααΆαβααΆααβααΆααααα
tc qdisc change dev lo root netem duplicate 50% 25%
ααΆαααααΆααααααΌαααααΆαααααααα αα
α’αααα’αΆα ααΆααααααΆαααΈααα·ααΈα
ααΆααΎαααααΌα αααα αααα½αα ααα½αααααΌαααΆαααααΎααααΆαα αα αααααΆαα½αααΉαααΆααααααΆαααααααααΆααααααΆααα α§ααΆα αααααΈα―αααΆαα
tc qdisc change dev lo root netem delay 10ms reorder 25% 50%
ααΆαα½αααΉαααααΌααΆαααΈααΈαααα 25% (αα·αααΆαααΆααααΆααααααααΆαα 50%) αααα ααααααααΆαααΉαααααΌαααΆαααααΎααααΆαα αα αααααΉαααααΌαααΆαααααΎααΆαα½αααΉαααΆααααααΆαααα 10 αα·ααααΈαα·ααΆααΈα
αα·ααΈααΆαααααααΈααΈαααΊαα ααααααααΆαααααα ααααααααΆα Nth ααααΌαααΆαααααΎααααΆααααΆαα½αααΉαααααΌααΆαααΈααΈαααααααΆααααααα±αα (αα·αααααΆαααααα) α αΎααα αααααΆαα½αααΉαααΆααααααΆαααααααααΆααααααα±ααα α§ααΆα αααααΈα―αααΆαα
tc qdisc change dev lo root netem delay 10ms reorder 25% 50% gap 5
ααΆαααααα ααααΈααααΆαααΆαα±ααΆα 25% αααα»αααΆαααααΎααααα·ααααααΆαααα
ααΆαααααΆααααααΌαααααα·ααααααΌα
ααΆααααααΆαα
αααααααΈααααααααααα½ααααααα
αα
tc qdisc change dev lo root netem rate 56kbit
αααα»ααααααΉαααααΎααααΎααα»ααα·α localhost ααΊα
αΆααααΌα
ααΆααΆαααΎαα’ααΈαααΊαααααΆαααααααΌααΉαα α
ααΌαααααα ααααααααΈααΎααΆααααααα’ααααΆαααΈα α’αααααα’αΆα
ααααΆααααΆαααααΌαα·ααΈααΆααααααΆααααααααααα ααααααααααααΎααααααΆαααααα
ααααααααΆα ααα ααααα‘αΆ αα·ααααααααΎααααααΆαααααα‘αΆα α§ααΆα ααααααα’αΆα
ααααΌαααΆααααααααααΎ
tc qdisc change dev lo root netem rate 56kbit 0 48 5
αααααααααΎααΆαα’αααααααααΆααααααΆαα
α ααα»α ααααΆαααα½αααααα αααα»ααααααΆαααΆααααααα αααααα½ααααααααα·ααΈααΊα’αααααα αααααΊααααΆααααΆαα ααΈααααααα αααα»αααααααααα ααα αΆα αα ααααααααααΆαααααα½αααααΌαααΆααα·α ααααΆααααααααααααααααΌαααααααααααα’ααααααααααΆααααα α¬αααα‘ααααα α»ααα ααΆααα’αα·αα·αα α αΎααααα»αααααΈααΆααααα αα½αααΆααααΆαααααααα½α αααα αΆαααΆαααααΎααα α¬ααΆααααααΆααα ααΉαααααΌαααΆααααααΎαα‘αΎαα
ααΆααα·ααΈααΆα
αααΎαααΎααααΈααααΎααΆα α§ααΆα ααα ααααΎααΆαααααααααααααααα·αααααΎααα α¬ααααΆαααα
ααααΎαααΆααααααααΎα§αααααααααΆααααα α»α ααΆααα
ααα»α
ααααα
ααααααααααΉαααααΌα α αΎαααααααααααΎαααΆα (ααααααα ααααΆαα·ααΈαααααααααααααα»α)α ααα»αααααα½ααααα»αα
ααααα
αααΆαααααα»αααΊ α
ααααααααΆααααααΎα α¬αααΆαααΈαα ααΆααΉααα½αααΎααααα»αααΏαααα
αααααΆααααΆααααα αΆα ααΎαααΉα firewall port 12345 α αΎαααααΎαααΆα client script ααααααΎαα α’αααβα’αΆα βαααααΆααααααΎαβαααα ααβα ααβαα βα αααβαααβαα βα’αααβααααΎ α¬βαααα ααβα αΌαβαα βα’αααβααα½αα αα αααα»αα§ααΆα ααααααααααα»α αααα ααααααααΆαα αΌαααΉαααααΌαααΆααααααΆααααααΎα (ααΎαααααΎαααααααααΆαα INPUT αα·ααααααΎα --dport) αααα ααααααααΆαααααααα’αΆα ααΆ DROP ααα·ααα α¬ααα·αααααΆαα½αααΉαααα TCP RST α¬ααΆαα½ααααΆαααΈα ICMP ααααα·αα’αΆα αα αααααΆα (ααΆααα·α α₯αα·ααΆααααααΆαααΎαααΊ icmp-port-αα·αα’αΆα αα αααααΆααα αΎαααΆααααΆαα±ααΆαααααΎααΆαααααΎααααααααα icmp-net-αα·αα’αΆα αα αααααΆαα, icmp-proto-αα·αα’αΆα αα αααααΆαα, icmp-net-α αΆαααΆαα ΠΈ icmp-host-α αΆαααΆαα).
αααααα
ααααα·αααΎααΆαα αααΆααααΆαα½α DROP ααααααα ααααΉα "ααΆαα" α
iptables -A INPUT -p tcp --dport 12345 -j DROP
ααΎαααΎαααααΎαααΆααααΆαααΈαααααα α αΎαααΎαααΆααΆααααααα
ααααΆααααΆαααααΆαααααΆαααα
αααΆαααΈαααα αααααΎαα
ααΆα
αααααΆααα’ααααααΆα
ααααααα
ααααααΆα
[user@host ~]# tcpdump -i lo -nn port 12345
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
08:28:20.213506 IP 127.0.0.1.32856 > 127.0.0.1.12345: Flags [S], seq 3019694933, win 43690, options [mss 65495,sackOK,TS val 1203046450 ecr 0,nop,wscale 7], length 0
08:28:21.215086 IP 127.0.0.1.32856 > 127.0.0.1.12345: Flags [S], seq 3019694933, win 43690, options [mss 65495,sackOK,TS val 1203047452 ecr 0,nop,wscale 7], length 0
08:28:23.219092 IP 127.0.0.1.32856 > 127.0.0.1.12345: Flags [S], seq 3019694933, win 43690, options [mss 65495,sackOK,TS val 1203049456 ecr 0,nop,wscale 7], length 0
08:28:27.227087 IP 127.0.0.1.32856 > 127.0.0.1.12345: Flags [S], seq 3019694933, win 43690, options [mss 65495,sackOK,TS val 1203053464 ecr 0,nop,wscale 7], length 0
08:28:35.235102 IP 127.0.0.1.32856 > 127.0.0.1.12345: Flags [S], seq 3019694933, win 43690, options [mss 65495,sackOK,TS val 1203061472 ecr 0,nop,wscale 7], length 0
ααΆα’αΆα ααααΌαααΆαααααΎαααΎαααΆαααΆαααΈααααααααααΎαααα αα SYN ααΆαα½αααΉααααααααΆααΎαα‘αΎαα’α·α αααααΌααααααααα ααΌα ααααααΎαααΆαααααΎαααα α»αααΌα αα½ααα αααα»ααααΆαααΈααααααα α’αααααααΌαααααΎαα·ααΈααΆααααα α’ααααα()ααΎααααΈααααααααααααΆαααα’αα·αα·ααααΉαααααΆααΆαααααΆαααα αααΆαααΈαααα
ααΎαααα αααΆααα ααααααΆααα
iptables -D INPUT -p tcp --dport 12345 -j DROP
α’αααα’αΆα αα»αα αααΆααααΆααα’αααααα»αααααααα½αα
iptables -F
ααααα·αααΎα’ααααααα»αααααΎ Docker α αΎαα’αααααααΌαααΆααααααΆααααααΎαα ααΆα αααΆααα’αααααα αΌααα αα»αααΊαααααα α’αααα’αΆα ααααΎααΆααΆαααΌα ααΆααααααα
iptables -I DOCKER-USER -p tcp -d CONTAINER_IP -j DROP
ααα·ααα
α₯α‘αΌαααα ααΌαααααααα αααΆααααααααααααΆ ααα»ααααααΆαα½αααΉαααΆαααα·αααα
iptables -A INPUT -p tcp --dport 12345 -j REJECT
αααΆαααΈααααααα αααααααΆααααΈαα½ααα·ααΆααΈαααααΆαααα α»α [Errno 111] ααΆααααααΆααααΆαααα·ααα. αααααΎαα ααΆα ααα ICMPα
[user@host ~]# tcpdump -i lo -nn icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
08:45:32.871414 IP 127.0.0.1 > 127.0.0.1: ICMP 127.0.0.1 tcp port 12345 unreachable, length 68
08:45:33.873097 IP 127.0.0.1 > 127.0.0.1: ICMP 127.0.0.1 tcp port 12345 unreachable, length 68
ααΆα’αΆα ααααΌαααΆαααααΎαααΎαααΆα’αα·αα·ααααΆαααα½αααΈααα α ααααα·αα’αΆα α αΌαααΆαα α αΎααααααΆαααααααα αααααααα α»αα
ααα·αααααΆαα½α tcp-reset
αααααααΆααΆααααααααααααΎα --reject-with tcp-reset:
iptables -A INPUT -p tcp --dport 12345 -j REJECT --reject-with tcp-reset
αααα»αααααΈααα α’αα·αα·ααα ααααααΆαααααααΆαααα α»α ααΈαααααααααΎααααΌαααΆαααα½ααααα ααααααααΆα RSTα
[user@host ~]# tcpdump -i lo -nn port 12345
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
09:02:52.766175 IP 127.0.0.1.60658 > 127.0.0.1.12345: Flags [S], seq 1889460883, win 43690, options [mss 65495,sackOK,TS val 1205119003 ecr 0,nop,wscale 7], length 0
09:02:52.766184 IP 127.0.0.1.12345 > 127.0.0.1.60658: Flags [R.], seq 0, ack 1889460884, win 0, length 0
ααα·αααααΆαα½α icmp-host-unreachable
αααααΆααααααααααΎααα½ααααααααααααααΆααααΆαααααΎααααΆαα REJECTα
iptables -A INPUT -p tcp --dport 12345 -j REJECT --reject-with icmp-host-unreachable
αααΆαααΈααααααα αααααααΆααααΈαα½ααα·ααΆααΈαααααΆαααα α»α [Errno 113] ααααΆαααααΌααααααΆααααααΎααΆααα αΆαααααααααααΎαααΎααα αααα»αα ααΆα ααα ICMP ICMP host 127.0.0.1 αα·αα’αΆα αα αααααΆαααα.
α’αααααα’αΆα ααΆααααααααΆαααΆααααααααα·ααααααααααα α αΎααααα»αααΉααααααααΎα ααα»α ααΆααααα :)
ααΆααααααααααΎααααΎα’ααααα
ααααΆαααΆααα½ααααααΊαα αααααααααΆαααΈααααααα’αΆα ααααΆαααα αααΆαααΈααα ααα»αααααα·αα’αΆα ααααΎααααΎαα ααΆααΆαααα ααΎααααΎααΌα ααααα ααΎααααΈαααααααα ααααΎααααΈαα»αα±αααααααα αΆααααααΎαααααΆαα? ααααα·αααΎα’ααααααα‘ααααΎαα ααΆα αααααααΆαααααΆααααααααΆαα½ααααΆααααΆαααΈαααααα αα·ααααΆαααΈααα α’αααααΉααααααΆααααΎαααΆ αα ααααααααΎαααΆααααααΆαα ααΆαααααα SYN αα·α ACK ααα»ααααααααααααΌαααΆαααααΎααααΆαα ααα»αααααα αααααααΆααααααΌααα·αααααα αααα ααααααΎα α»ααααααααΉαααΆαααα PSH α ααΆααα‘αΎααααααααααααααααα·ααΎααααΈαααααΆαααΆαααααααα’αΆααααα α’αααβα’αΆα βααααΎβααααααΆαβαααβααΎααααΈβαααααΎαβαααααα ααΆβααΉαβα’αα»ααααΆαβα±ααβαααα ααβααααααΆαβααΆααα’ααβααΎαβαααβααβαααα ααβαααβααΆαβααα PSH α ααΌα αααα ααΆααααααΆααααΉαααααΌαααΆααααααΎαα‘αΎα ααα»αααααααΆαααΈααααααααΉααα·αα’αΆα ααααΎαα·αααααααα ααΆαααααΆαααΈαααααΆαααα
αααααα
αααααΆαα DROP ααΆααααααααΆααΉαααΎααα ααΌα αααα
iptables -A INPUT -p tcp --tcp-flags PSH PSH --dport 12345 -j DROP
ααΎαααααΎαααΆαα’αα·αα·αα α αΎαααΎαα ααΆα αααα
ααααααα ααααααΆα
[user@host ~]# tcpdump -i lo -nn port 12345
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
10:02:47.549498 IP 127.0.0.1.49594 > 127.0.0.1.12345: Flags [S], seq 2166014137, win 43690, options [mss 65495,sackOK,TS val 1208713786 ecr 0,nop,wscale 7], length 0
10:02:47.549510 IP 127.0.0.1.12345 > 127.0.0.1.49594: Flags [S.], seq 2341799088, ack 2166014138, win 43690, options [mss 65495,sackOK,TS val 1208713786 ecr 1208713786,nop,wscale 7], length 0
10:02:47.549520 IP 127.0.0.1.49594 > 127.0.0.1.12345: Flags [.], ack 1, win 342, options [nop,nop,TS val 1208713786 ecr 1208713786], length 0
10:02:47.549568 IP 127.0.0.1.49594 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 1208713786 ecr 1208713786], length 5
10:02:47.750084 IP 127.0.0.1.49594 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 1208713987 ecr 1208713786], length 5
10:02:47.951088 IP 127.0.0.1.49594 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 1208714188 ecr 1208713786], length 5
10:02:48.354089 IP 127.0.0.1.49594 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 1208714591 ecr 1208713786], length 5
ααΎαααΎαααΆααΆααααααΆααααααΌαααΆααααααΎαα‘αΎα α αΎαα’αα·αα·αααα·αα’αΆα ααααΎαα·αααααααα αααΆαααΈαααααΆαααα
ααα·ααα
αααα»αααααΈαααα₯αα·ααΆααααΉαααΌα ααααΆα α’αα·αα·ααααΉααα·αα’αΆα ααααΎααααΎααΆααα ααα»ααααααΉαααα½αααΆα α ααα ICMP 127.0.0.1 tcp 12345 αα·αα’αΆα α αΌαααΆα αα·ααααααΎααααααααΆαααΆαααΆααααααΌαααααΎα‘αΎααα·ααααα’α·α αααααΌααααααααα ααΆααααααααΆααΎααα ααΌα αααα
iptables -A INPUT -p tcp --tcp-flags PSH PSH --dport 12345 -j REJECT
ααα·αααααΆαα½α tcp-reset
ααΆααααααααΆααΎααα ααΌα αααα
iptables -A INPUT -p tcp --tcp-flags PSH PSH --dport 12345 -j REJECT --reject-with tcp-reset
ααΎαααΉααα½α α αΎααα αααααααΎ --reject-with tcp-reset α’αα·αα·ααααΉαααα½αααΆααααα ααααααααΆα RST ααΆααΆαααααΎααα ααΌα ααααα’αΆαααααα·αα·ααΆα’αΆα ααααΆααααααΆαα ααΆαααα½αααΆααααα ααααααααΆα RST αααααααααααΆααααααΆααααααΌαααΆααααααΎαα‘αΎαααΆααααααΆααααααααΌαααΆααα·αααααα·αααΆαααααΉααα»ααα ααααΆαααα αααααΆααααααΆα’αα·αα·αααα½αααααα½αααΆα αααααααΆααααααΆααα‘αΎααα·αααααα·αααααααα·. α αΌαααααΎαααΆαααααααΈαααααααΎα α αΎαααααΌαααααΆααααΆααΏααααα α αΎααααααΆα’αααΈαααα ααΆα αααααΉαααΎααα α
ααααααα ααααααΆα
[user@host ~]# tcpdump -i lo -nn port 12345
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
10:22:14.186269 IP 127.0.0.1.52536 > 127.0.0.1.12345: Flags [S], seq 2615137531, win 43690, options [mss 65495,sackOK,TS val 1209880423 ecr 0,nop,wscale 7], length 0
10:22:14.186284 IP 127.0.0.1.12345 > 127.0.0.1.52536: Flags [S.], seq 3999904809, ack 2615137532, win 43690, options [mss 65495,sackOK,TS val 1209880423 ecr 1209880423,nop,wscale 7], length 0
10:22:14.186293 IP 127.0.0.1.52536 > 127.0.0.1.12345: Flags [.], ack 1, win 342, options [nop,nop,TS val 1209880423 ecr 1209880423], length 0
10:22:14.186338 IP 127.0.0.1.52536 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 1209880423 ecr 1209880423], length 5
10:22:14.186344 IP 127.0.0.1.12345 > 127.0.0.1.52536: Flags [R], seq 3999904810, win 0, length 0
ααα·αααααΆαα½α icmp-host-unreachable
αααα»ααα·αααΆααΆα αααΆααα αΎααααααΆααααα»ααααααααααααΆααΌαα’αααΈαααααΆααααααααΆααΉαααΎααα ααΌα :) α’αΆαααααα·αα·ααΆααααα’αα·αα·αααααα»αααααΈαααααΉααα»αααααΆααααα·α ααααα½α ααΆαα½αααΉαααΆαααα·αααααααΆαααααα½αα αααΆαααΈααααααααΉααα·ααααααΎαααΆαα’ααααααααΆαααΆαααααΆααΆαααααΎαααα ααααααααΆαα‘αΎααα·αααα
[user@host ~]# tcpdump -i lo -nn icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
10:29:56.149202 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable, length 65
10:29:56.349107 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable, length 65
10:29:56.549117 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable, length 65
10:29:56.750125 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable, length 65
10:29:56.951130 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable, length 65
10:29:57.152107 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable, length 65
10:29:57.353115 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable, length 65
ααα ααααΈααααα·ααααΆα
ααΆαα·αα αΆαααΆα ααααα»αααΆααααααααααΌααΎααααΈααΆαααααα’ααααααααααααααΆααααααΆαα½ααααΆαααΈαααααα α¬αααΆαααΈααααα αααααααααΆαααααααααΆαααααα»αααΆαααααΎα§αααααααααΎααααΆαααααααααΆααααααΆααα αααα»αααΈαα»α α
α§αααααααααΎααααΆαααααααΆααα·ααΆααααΆαα
αααα»αα’αααααααΆααααααααΆαα
αααΎαααΆαα’αααΈαααααΆααα·αααααΆ ααΌα
ααααα’αααα’αΆα
αααααΎααααααΎαααααΆαααααα½ααα½αα
ααα½ααααααΆααααΆαααααΎααααΆααααΆα αααααααΆαααααα»ααααααααΆααααααααααΆααααα’αααΈααααααα»αααΆααααααα’αααΈ (ααΆααΆααα·αααΌααααΈαααα·α
ααΆαααα) α ααααα·αααΎα’αααααααΎα§αααααααααΎααααΆααααΆααααα α¬ααααααααααΆααααααα»αααΆαααΆααααααα
αααα»ααααα»αα αα»αααααα’ααα ααΌααααααααΈαααααα·αααααΆααα ααΎαα·αααΌα
αααααα αααα»ααααααΉαααΆαααααα·ααΈααααα’αααααΉααααααΎαα‘αΎα ααααα·αααΎα’ααααααααα
α
α·αααααΆαααααααΆαααα»ααααααααααααααα αΆαααααΆααααααααΎαα·ααΈααΆααααααααααΆαααααΎα
ααααα: www.habr.com