á¡á¬ážáá¯á¶ážáá²áááºá¹ááá¬áá«á áá»áœááºá¯ááºáá¡áááºááŸá¬ Sasha ááŒá áºáá«áááºá áá»áœááºá¯ááºááẠFunCorp ááœáẠbackend á ááºážáááºááŒááºážááᯠáŠážáá±á¬ááºáá«áááºá á¡ááŒá¬ážáá°áá»á¬ážáá²á·ááá¯á·ááẠáá»áœááºá¯ááºááá¯á·ááẠáááºáá±á¬ááºááŸá¯ááᯠáŠážáááºááá·áº áááá¯áá¬ááᯠá¡áá±á¬ááºá¡áááºáá±á¬áºáá²á·áááºá ááááºááŸá¬áá±á¬á· áá«á á¡áá¯ááºááœá±ááᯠááá¯ážááŸááºážá á±áááº... áááºáá±á¬ááºááŸá¯áá áºáá¯á á®ááᯠáá®ážááŒá¬ážá á®á ááºážáááºááẠááá¯ááá¯ááœááºáá°áá±á¬áºáááºáž á¡ááŒá¬ážáá áºáááºááœááºá ááœááºáááºáá±á«áºááœáẠáááŒá¬ááááŒá áºááœá¬ážáá±á·ááŸáááá·áº áááºáá±á¬ááºááŸá¯áá áºáá¯ááŸáá·áºáá áºáᯠá¡ááŒááºá¡ááŸááºáááºááœááºááŸá¯ááᯠá ááºážáááºááẠááá¯á¡ááºáá«áááºá
á€áá±á¬ááºážáá«ážááœááºá ááœááºáááºááŒá¿áá¬áá»á¬ážááŸááá±áá»áááºááœáẠá¡ááºááá®áá±ážááŸááºážááá¯ááºáá±á¬ááºááŸá¯ááᯠáá±á¬áºááŒááá·áº á¡ááŒá±áá¶á¡ááŒá±á¡áá±áá»á¬ážááᯠá á áºáá±ážááẠá¡áá¯á¶ážááŒá¯ááá¯ááºááá·áº utilities ááŸá áºáá¯á¡ááŒá±á¬ááºáž ááœá±ážááœá±ážáá«áááºá
ááœááºáááºááŒá¿áá¬áá»á¬ážááᯠáá¯á¶áá±á¬áºááŒááºážá
áá¯á¶ááŸááºá¡á¬ážááŒáá·áºá áá±á¬á·ááºáá²ááᯠáá±á¬ááºážááœááºáá±á¬á¡ááºáá¬áááºáá»áááºáááºááŸá¯ááŒáá·áº á ááºážáááºáá¬áá¬áá»á¬ážááœáẠá ááºážáááºáááºá ááŒááºážáááºážáá±á¬áá¯ááºáá¯ááºááŸá¯áááºáááºážáá»ááºááœááºá á¡áá¬áá»á¬ážááẠá€áá»áŸáá»á±á¬ááœá±á·áááºááá¯ááºáá±á¬ááŒá±á¬áá·áº áá áºáá«áá áºáá¶ááœáẠáá»áááºáááºááŸá¯á¡á¬ážáááºážáá±á¬á¡ááŒá±á¡áá±áá»á¬ážááœáẠáááá¯ááááºáá»á¬ážááᯠáááºá ááºážáááºááẠááá¯á¡ááºáááºá Linux ááœááºá utility ááẠááá¯ááá¯á·áá±á¬á¡ááŒá±á¡áá±áá»á¬ážááᯠáá¯á¶áá±á¬áºááŒááºážá¡ááœáẠáá°áá®áá±ážáá«áááá·áºáááºá tc.
tc(abbr Traffic Control ááŸ) ááẠá
áá
áºá¡ááœááºážááŸá ááœááºáááºáááºáá±á·ááºá»áá»á¬ážá áá¯ááºááœáŸáá·áºááŸá¯ááᯠáá»áááºááŸáááá¯ááºá
á±áá«áááºá ဠutility ááẠáá±á¬ááºážááœááºáá±á¬ á
áœááºážáá±á¬ááºáááºáá»á¬áž ááŸáááŒá®áž áááºážááá¯á·á¡ááŒá±á¬ááºáž áááºááá¯ááá¯áááºááŸá¯ááá¯ááºáá«áááºá
áá¬áá¬áá±á«áºááœáẠáá²á·áááºáá¶áá¬áá¬ááᯠááœáá·áºááŒáá·áºáá¡á±á¬áẠ(áá»áœááºáá±á¬áºáá¯á¶ážáááºá
ncat -l 127.0.0.1 12345 -k -c 'xargs -n1 -i echo "Response: {}"'
client ááŸáá·áº server á¡ááŒá¬áž á¡ááŒááºá¡ááŸááºáá¯á¶á·ááŒááºááŸá¯ á¡ááá·áºááá¯ááºážááœáẠá¡áá»áááºáá¶ááááºá¡á¬ážáá¯á¶ážááᯠá¡áá±ážá áááºááŒáááá¯ááºáááºá áá±á¬ááºážááá¯áá»ááºáá áºáá¯áá±ážááá¯á·ááá·áº ááá¯ážááŸááºážáá±á¬ Python script ááᯠáá±ážáá¬ážáá²á·áááºá á ááºážááẠáá»áœááºá¯ááºááá¯á·á echo server ááá¯á·
áá¯á¶ážá áœá²áá° á¡áááºážá¡ááŒá áºáá¯ááº
#!/bin/python
import socket
import time
HOST = '127.0.0.1'
PORT = 12345
BUFFER_SIZE = 1024
MESSAGE = "Testn"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
t1 = time.time()
print "[time before connection: %.5f]" % t1
s.connect((HOST, PORT))
print "[time after connection, before sending: %.5f]" % time.time()
s.send(MESSAGE)
print "[time after sending, before receiving: %.5f]" % time.time()
data = s.recv(BUFFER_SIZE)
print "[time after receiving, before closing: %.5f]" % time.time()
s.close()
t2 = time.time()
print "[time after closing: %.5f]" % t2
print "[total duration: %.5f]" % (t2 - t1)
print data
áááºážááá¯ááœáá·áºááŒá®áž á¡ááºáá¬áá±á·á áºáá±á«áºááŸá á¡ááœá¬ážá¡áá¬ááᯠááŒáá·áºááŒáá«á áá¯á· lo ááŸáá·áº port 12345:
[user@host ~]# python client.py
[time before connection: 1578652979.44837]
[time after connection, before sending: 1578652979.44889]
[time after sending, before receiving: 1578652979.44894]
[time after receiving, before closing: 1578652979.45922]
[time after closing: 1578652979.45928]
[total duration: 0.01091]
Response: Test
á¡ááŸáá¯ááºáá¯á¶ááŒá®áž
[user@host ~]# tcpdump -i lo -nn port 12345
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
10:42:59.448601 IP 127.0.0.1.54054 > 127.0.0.1.12345: Flags [S], seq 3383332866, win 43690, options [mss 65495,sackOK,TS val 606325685 ecr 0,nop,wscale 7], length 0
10:42:59.448612 IP 127.0.0.1.12345 > 127.0.0.1.54054: Flags [S.], seq 2584700178, ack 3383332867, win 43690, options [mss 65495,sackOK,TS val 606325685 ecr 606325685,nop,wscale 7], length 0
10:42:59.448622 IP 127.0.0.1.54054 > 127.0.0.1.12345: Flags [.], ack 1, win 342, options [nop,nop,TS val 606325685 ecr 606325685], length 0
10:42:59.448923 IP 127.0.0.1.54054 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 606325685 ecr 606325685], length 5
10:42:59.448930 IP 127.0.0.1.12345 > 127.0.0.1.54054: Flags [.], ack 6, win 342, options [nop,nop,TS val 606325685 ecr 606325685], length 0
10:42:59.459118 IP 127.0.0.1.12345 > 127.0.0.1.54054: Flags [P.], seq 1:15, ack 6, win 342, options [nop,nop,TS val 606325696 ecr 606325685], length 14
10:42:59.459213 IP 127.0.0.1.54054 > 127.0.0.1.12345: Flags [.], ack 15, win 342, options [nop,nop,TS val 606325696 ecr 606325696], length 0
10:42:59.459268 IP 127.0.0.1.54054 > 127.0.0.1.12345: Flags [F.], seq 6, ack 15, win 342, options [nop,nop,TS val 606325696 ecr 606325696], length 0
10:42:59.460184 IP 127.0.0.1.12345 > 127.0.0.1.54054: Flags [F.], seq 15, ack 7, win 342, options [nop,nop,TS val 606325697 ecr 606325696], length 0
10:42:59.460196 IP 127.0.0.1.54054 > 127.0.0.1.12345: Flags [.], ack 16, win 342, options [nop,nop,TS val 606325697 ecr 606325697], length 0
á¡áá¬á¡á¬ážáá¯á¶ážááẠá á¶ááŸá¯ááºážááŒá áºáááº- áááºááœá²ááŸá¯ááºáááºááŒááºážá PSH/ACK ááŸáá·áº ACK ááŸá áºááŒááẠáá¯á¶á·ááŒááºááŸá¯ááŒá áºááẠ- áááºážááẠclient ááŸáá·áº server á¡ááŒá¬áž áá±á¬ááºážááá¯áá»ááºááŸáá·áº áá¯á¶á·ááŒááºááŸá¯ áááŸááºááŒááºážááŒá áºááŒá®áž FIN/ACK ááŸáá·áº ACK ááŸá áºááŒááẠ- áá»áááºáááºááŸá¯ááᯠá¡ááŒá®ážáááºáá«áááºá
Packet ááŸá±á¬áá·áºááŸá±ážááŒááºážá
ááá¯ááŸá±á¬áá·áºááŸá±ážááŸá¯ááᯠ500 áá®áá®á áá¹ááá·áºááá¯á· áááºááŸááºááŒáá«á áá¯á·á
tc qdisc add dev lo root netem delay 500ms
áá»áœááºá¯ááºááá¯á·ááẠáááá¯ááºážááá·áºááá¯ááœáá·áºááŒá®áž áá¬ááºááœáŸááºážááẠááᯠ2 á áá¹ááá·áºááŒá¬ áááºáááºáá±áááºááᯠááœá±á·ááááº-
[user@host ~]# ./client.py
[time before connection: 1578662612.71044]
[time after connection, before sending: 1578662613.71059]
[time after sending, before receiving: 1578662613.71065]
[time after receiving, before closing: 1578662614.72011]
[time after closing: 1578662614.72019]
[total duration: 2.00974]
Response: Test
á¡ááœá¬ážá¡áá¬ááŸá¬ áá¬ááœá±áá²á ááŒáá·áºáá¡á±á¬ááº-
á¡ááŸáá¯ááºáá¯á¶ááŒá®áž
13:23:33.210520 IP 127.0.0.1.58694 > 127.0.0.1.12345: Flags [S], seq 1720950927, win 43690, options [mss 65495,sackOK,TS val 615958947 ecr 0,nop,wscale 7], length 0
13:23:33.710554 IP 127.0.0.1.12345 > 127.0.0.1.58694: Flags [S.], seq 1801168125, ack 1720950928, win 43690, options [mss 65495,sackOK,TS val 615959447 ecr 615958947,nop,wscale 7], length 0
13:23:34.210590 IP 127.0.0.1.58694 > 127.0.0.1.12345: Flags [.], ack 1, win 342, options [nop,nop,TS val 615959947 ecr 615959447], length 0
13:23:34.210657 IP 127.0.0.1.58694 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 615959947 ecr 615959447], length 5
13:23:34.710680 IP 127.0.0.1.12345 > 127.0.0.1.58694: Flags [.], ack 6, win 342, options [nop,nop,TS val 615960447 ecr 615959947], length 0
13:23:34.719371 IP 127.0.0.1.12345 > 127.0.0.1.58694: Flags [P.], seq 1:15, ack 6, win 342, options [nop,nop,TS val 615960456 ecr 615959947], length 14
13:23:35.220106 IP 127.0.0.1.58694 > 127.0.0.1.12345: Flags [.], ack 15, win 342, options [nop,nop,TS val 615960957 ecr 615960456], length 0
13:23:35.220188 IP 127.0.0.1.58694 > 127.0.0.1.12345: Flags [F.], seq 6, ack 15, win 342, options [nop,nop,TS val 615960957 ecr 615960456], length 0
13:23:35.720994 IP 127.0.0.1.12345 > 127.0.0.1.58694: Flags [F.], seq 15, ack 7, win 342, options [nop,nop,TS val 615961457 ecr 615960957], length 0
13:23:36.221025 IP 127.0.0.1.58694 > 127.0.0.1.12345: Flags [.], ack 16, win 342, options [nop,nop,TS val 615961957 ecr 615961457], length 0
áááá¯ááºážááá·áºááŸáá·áº áá¬áá¬ááŒá¬ážááœáẠá¡ááŒááºá¡ááŸááºáááºááœááºááŸá¯ááœáẠáá áºá áá¹ááá·áºáááºááá·áº áá±á¬ááºáá»áá»ááºáá±ááŸá¯ááᯠáááºááœá±á·ááŒááºááá¯ááºáá«áááºá ááŸá±ážááœá±ážááŸá¯ ááá¯áá»á¬ážáá¬áá«á á áá áºááẠááá¯ááá¯á á áááºáááºá á¬ážá áá¬áá±á¬ááºážá áœá¬ ááŒá¯áá°áááº- kernel ááẠTCP packet á¡áá»áá¯á·ááᯠááŒááºáááºáá±ážááá¯á·ááẠá áááºáááºá ááŒáá·áºááŒá¬ááŸá¯ááᯠ1 á áá¹ááá·áºááá¯á· ááŒá±á¬ááºážááŒá®áž á¡ááœá¬ážá¡áá¬ááᯠááŒáá·áºááŒáá«á áá¯á· ( client á output ááᯠáá»áœááºá¯ááºáááŒáá«á á á¯á á¯áá±á«ááºážááŒá¬áá»ááẠ4 á áá¹ááá·áºááŸááá«áááº)
tc qdisc change dev lo root netem delay 1s
á¡ááŸáá¯ááºáá¯á¶ááŒá®áž
13:29:07.709981 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [S], seq 283338334, win 43690, options [mss 65495,sackOK,TS val 616292946 ecr 0,nop,wscale 7], length 0
13:29:08.710018 IP 127.0.0.1.12345 > 127.0.0.1.39306: Flags [S.], seq 3514208179, ack 283338335, win 43690, options [mss 65495,sackOK,TS val 616293946 ecr 616292946,nop,wscale 7], length 0
13:29:08.711094 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [S], seq 283338334, win 43690, options [mss 65495,sackOK,TS val 616293948 ecr 0,nop,wscale 7], length 0
13:29:09.710048 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [.], ack 1, win 342, options [nop,nop,TS val 616294946 ecr 616293946], length 0
13:29:09.710152 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 616294947 ecr 616293946], length 5
13:29:09.711120 IP 127.0.0.1.12345 > 127.0.0.1.39306: Flags [S.], seq 3514208179, ack 283338335, win 43690, options [mss 65495,sackOK,TS val 616294948 ecr 616292946,nop,wscale 7], length 0
13:29:10.710173 IP 127.0.0.1.12345 > 127.0.0.1.39306: Flags [.], ack 6, win 342, options [nop,nop,TS val 616295947 ecr 616294947], length 0
13:29:10.711140 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [.], ack 1, win 342, options [nop,nop,TS val 616295948 ecr 616293946], length 0
13:29:10.714782 IP 127.0.0.1.12345 > 127.0.0.1.39306: Flags [P.], seq 1:15, ack 6, win 342, options [nop,nop,TS val 616295951 ecr 616294947], length 14
13:29:11.714819 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [.], ack 15, win 342, options [nop,nop,TS val 616296951 ecr 616295951], length 0
13:29:11.714893 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [F.], seq 6, ack 15, win 342, options [nop,nop,TS val 616296951 ecr 616295951], length 0
13:29:12.715562 IP 127.0.0.1.12345 > 127.0.0.1.39306: Flags [F.], seq 15, ack 7, win 342, options [nop,nop,TS val 616297952 ecr 616296951], length 0
13:29:13.715596 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [.], ack 16, win 342, options [nop,nop,TS val 616298952 ecr 616297952], length 0
client ááẠSYN packet ááᯠááŸá áºááŒáááºáá±ážááá¯á·ááŒá®áž server á០SYN/ACK ááŸá áºááŒáááºáá±ážááá¯á·áááºááᯠááœá±á·ááŒááºááá¯ááºáá«áááºá
ááááºážáá±áááºááá¯ážáá áºáá¯á¡ááŒááºá ááŸá±á¬áá·áºááŸá±ážááŸá¯ááᯠááœá±áááºááŸá¯á ááŒáá·áºááŒá°ážááŸá¯áá¯ááºáá±á¬ááºáá»ááºááŸáá·áº áááºááœááºááŸá¯áá áºáᯠ(ááááºáááºáááºá¡ááœáẠáááºááá¯ážááŸáá·áºá¡áá°) ááá¯á·ááᯠáááºááŸááºááá¯ááºáááºá áááºážááᯠá¡á±á¬ááºáá«á¡ááá¯ááºáž áá¯ááºáá±á¬ááºáááºá
tc qdisc change dev lo root netem delay 500ms 400ms 50 distribution normal
á€áá±áá¬ááœáẠáá»áœááºá¯ááºááá¯á·ááẠááŒáá·áºááŒá¬ááŸá¯ááᯠ100 ááŸáá·áº 900 áá®áá®á áá¹ááá·áºááŒá¬ážááœáẠáááºááŸááºáá¬ážááŒá®ážá áááºááá¯ážáá»á¬ážááᯠáá¯á¶ááŸááºááŒáá·áºááŒá°ážááŸá¯á¡á ááœá±ážáá»ááºáááºááŒá áºááŒá®áž ááááºáááºáááºá¡ááœáẠááŸá±á¬áá·áºááŸá±ážááŸá¯áááºááá¯ážááŸáá·áº 50% áááºá ááºááŸá¯ááŸááááºááŒá áºáááºá
áá»áœááºáá±á¬áºáá¯á¶ážáá²á· ááááá¯á¶áž command ááŸá¬ ááẠáááááŒá¯ááááœá¬ážááá¯ááºáá«áááºá áá±á«ááºáž, ááŒá®ážáá±á¬á· ááœá±á¬áá»ážáá². áá® command ááœá±áá²á· á¡áááá¹áá«ááºá áááá¬áááºááŸá¬ážáááºá áá«ááŒá±á¬áá·áº áá±á¬ááºáááºááŸááá±ážááẠááá¯áá¬áá² ááá·áºááŒá±á¬áááºá delconfiguration ááá¯áááºááŸá¬ážáááºá¡áá¯á¶ážááŒá¯ááá¯ááºáá«áááºá
Packet áá¯á¶ážááŸá¯á¶ážááŸá¯
á¡áá¯áá² packet áá¯á¶ážááŸá¯á¶ážááŸá¯ááᯠá
ááºážááŒáá·áºáá¡á±á¬ááºá á
á¬ááœááºá
á¬áááºážááŸááœá±á·ááŒááºááá¯ááºáááºá¡ááá¯ááºážá ááŒá
áºááá¯ááºááŒá±á¡áá»áá¯á·ááŒáá·áº packet áá»á¬ážááᯠáá»áááºážáá»áááºážáá¯á¶ážááŸá¯á¶ážááŒááºážá packet áá¯á¶ážááŸá¯á¶ážááŸá¯ááá¯ááœááºáá»ááºááẠ2á 3 ááá¯á·ááá¯áẠ4 ááŒááºáááºáá»á¬ážá Markov ááœááºážáááºááá¯á¡áá¯á¶ážááŒá¯ááŒááºáž ááá¯á·ááá¯áẠElliott-Gilbert áá±á¬áºáááºááá¯á¡áá¯á¶ážááŒá¯ááŒááºážááá¯á·ááᯠáááºážáááºážáá¯á¶ážáá»áá¯ážááŒáá·áº áá¯ááºáá±á¬ááºááá¯ááºáááºá áá±á¬ááºážáá«ážááœáẠáá»áœááºá¯ááºááẠááááá¯á¶áž (á¡ááá¯ážááŸááºážáá¯á¶ážááŸáá·áº á¡áááºááŸá¬ážáá¯á¶áž) áááºážáááºážááᯠá
ááºážá
á¬ážááŒá®áž á¡ááŒá¬ážáá°áá»á¬ážá¡ááŒá±á¬ááºáž áááºáááºááŸá¯ááá¯ááºáá«áááºá
áááºáá±á·áá»áºáá»á¬ážá 50% ááᯠ25% áááºá ááºááŸá¯ááŒáá·áº áá¯á¶ážááŸá¯á¶ážááŒáá«á áá¯á·á
tc qdisc add dev lo root netem loss 50% 25%
áá¶ááá±á¬ááºážá áœá¬áá², áá»á áºáá° packets áá¯á¶ážááŸá¯á¶ážááŸá¯ááᯠááŸááºážááŸááºážáááºážáááºážááŒáááá¯ááºáááºááá¯ááºáá«á áááºážááẠá¡ááŸááºááááºá¡áá¯ááºáá¯ááºáááºáá¯áᬠáá»áœááºá¯ááºááá¯á·áá°ááá«áááºá ááŒá®ážáá±á¬á· áá¬ááºááœáŸááºážáá²á· ááá¯ážááŒáŸáá·áºááŒá®áž ááááºáááŒááẠáááºáááºáá»áááºá áá«ááᯠá¡áááºááŒá¯ááá¯á· áá°áá®áá±ážáá«áááá·áºáááºá client.py (áá»ááºáá»ááºážááŒá®ážááá¯ááºáááºá ááá¯á·ááá¯áẠ20 á áá¹ááá·áºá¡ááœááºáž ááŒá áºááá¯ááºáááº) ááŸáá·áº ááŒááºáááºáá±ážááá¯á·áá±á¬ áááºáá±á·áá»áºá¡áá±á¡ááœáẠááá¯ážáá¬áááº-
[user@host ~]# netstat -s | grep retransmited; sleep 10; netstat -s | grep retransmited
17147 segments retransmited
17185 segments retransmited
áá°áá¶áá¶áá»á¬áž á¡á á¯á¶ááá¯ááºááá·áºááŒááºážá
áááºáááºáá»á±á¬ááºáá¯á¶ážááŒááºážá¡ááŒááºá áááºááẠáááºáááºáá»ááºá á®ážááŸá¯ááᯠáá¯áááá¯ááºáááº- áá°áá¶áá¶ááẠáá»áááºážáááºáááºá¡áá±á¡áá¬ážááœáẠáá±á«áºáá¬áááá·áºáááºá áááºáá±á·áá»áºáá»ááºá á®ážááŸá¯ááᯠ50% ááŒá áºááá¯ááºááŒá±ááŸáá·áº áááºá ááºááŸá¯áááŸááá² ááŒá¯áá¯ááºááŒáá«á áá¯á·á
tc qdisc change dev lo root netem corrupt 50%
áá»áœááºá¯ááºááá¯á·ááẠáááá¯ááºážááá·áº áá¬ááºááœáŸááºážááᯠáá¯ááºáá±á¬ááºááẠ(ááá¯áá±áá¬ááœáẠá áááºáááºá á¬ážá áá¬áááŸááá±á¬áºáááºáž ááŒá®ážááŒá±á¬ááºááẠ2 á áá¹ááá·áºááŒá¬áááº)á áááºážááŒá±á¬ááºážááá¯ááŒáá·áºáá«-
á¡ááŸáá¯ááºáá¯á¶ááŒá®áž
[user@host ~]# tcpdump -i lo -nn port 12345
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
10:20:54.812434 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [S], seq 2023663770, win 43690, options [mss 65495,sackOK,TS val 1037001049 ecr 0,nop,wscale 7], length 0
10:20:54.812449 IP 127.0.0.1.12345 > 127.0.0.1.43666: Flags [S.], seq 2104268044, ack 2023663771, win 43690, options [mss 65495,sackOK,TS val 1037001049 ecr 1037001049,nop,wscale 7], length 0
10:20:54.812458 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [.], ack 1, win 342, options [nop,nop,TS val 1037001049 ecr 1037001049], length 0
10:20:54.812509 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 1037001049 ecr 1037001049], length 5
10:20:55.013093 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 1037001250 ecr 1037001049], length 5
10:20:55.013122 IP 127.0.0.1.12345 > 127.0.0.1.43666: Flags [.], ack 6, win 342, options [nop,nop,TS val 1037001250 ecr 1037001250], length 0
10:20:55.014681 IP 127.0.0.1.12345 > 127.0.0.1.43666: Flags [P.], seq 1:15, ack 6, win 342, options [nop,nop,TS val 1037001251 ecr 1037001250], length 14
10:20:55.014745 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [.], ack 15, win 340, options [nop,nop,TS val 1037001251 ecr 1037001251], length 0
10:20:55.014823 IP 127.0.0.1.43666 > 127.0.0.5.12345: Flags [F.], seq 2023663776, ack 2104268059, win 342, options [nop,nop,TS val 1037001251 ecr 1037001251], length 0
10:20:55.214088 IP 127.0.0.1.12345 > 127.0.0.1.43666: Flags [P.], seq 1:15, ack 6, win 342, options [nop,unknown-65 0x0a3dcf62eb3d,[bad opt]>
10:20:55.416087 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [F.], seq 6, ack 15, win 342, options [nop,nop,TS val 1037001653 ecr 1037001251], length 0
10:20:55.416804 IP 127.0.0.1.12345 > 127.0.0.1.43666: Flags [F.], seq 15, ack 7, win 342, options [nop,nop,TS val 1037001653 ecr 1037001653], length 0
10:20:55.416818 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [.], ack 16, win 343, options [nop,nop,TS val 1037001653 ecr 1037001653], length 0
10:20:56.147086 IP 127.0.0.1.12345 > 127.0.0.1.43666: Flags [F.], seq 15, ack 7, win 342, options [nop,nop,TS val 1037002384 ecr 1037001653], length 0
10:20:56.147101 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [.], ack 16, win 342, options [nop,nop,TS val 1037002384 ecr 1037001653], length 0
á¡áá»áá¯á·áá±á¬ áááºáá±á·ááºá»áá»á¬ážááᯠáááºáá«ááá²áá² áá±ážááá¯á·áá²á·ááŒá®áž áá»ááºá á®ážáá±áá±á¬ áááºáá¬áá±áá¬áá«ááá·áº áááºáá±á·ááºá»áá áºáᯠááŸááá±áááºááᯠááœá±á·ááŒááºááá¯ááºáááº- ááœá±ážáá»ááºá áá¬áá»á¬áž [nopáunknown-65 0x0a3dcf62eb3dá[ááá±á¬ááºážáá±á¬ááœá±ážáá»ááºááŸá¯]>. ááá¯á·áá±á¬áºá¡áááá¡áá¬ááŸá¬á¡áá¯á¶ážááœááºá¡áá¬á¡á¬ážáá¯á¶ážááŸááºáááºá áœá¬á¡áá¯ááºáá¯ááºáá²á·ááẠ- TCP áááºáááºážááá¬áááºááá¯ááŒá±ááŸááºážáá²á·áááºá
áá¯ááºááá¯ážááŸá¯ááœá¬ážááŒááºážá
áááŒá¬ážáá¬ááœá±áá¯ááºááá¯ááºááá²á ááá¯ááºááœááº? á¥ááá¬á¡á¬ážááŒáá·áºá packet áá¯á¶ážááŸá¯á¶ážááŸá¯á ááŒá±á¬ááºážááŒááºá¡ááŒá±á¡áá±âpacket duplication ááᯠáá¯ááá«á ဠcommand ááẠááŒá áºááá¯ááºááŒá± ááŸáá·áº áááºá ááºááŸá¯ á áá¯ááá¯áááºáž áá°áá«áááºá
tc qdisc change dev lo root netem duplicate 50% 25%
áááºáá±á·áá»áºáá»á¬ážá á¡á á®á¡á á¥áºááᯠááŒá±á¬ááºážáá²ááŒááºážá
á¡áááºáá»á¬ážááᯠáááºážáááºážááŸá áºáá»áá¯ážááŒáá·áº áá±á¬á ááºááá¯ááºáááºá
áááááœááºá á¡áá»áá¯á·áá±á¬á¡áá¯ááºáá»á¬ážááá¯áá»ááºáá»ááºážááá¯á·áááºá áá»ááºáááºáááºááŸááºáá¬ážáá±á¬ááŸá±á¬áá·áºááŸá±ážáááºá á á¬ááœááºá á¬áááºážá០á¥ááá¬-
tc qdisc change dev lo root netem delay 10ms reorder 25% 50%
ááŒá áºááá¯ááºááŒá± 25% (ááŸáá·áº 50% áááºá ááºááŸá¯) ááŒáá·áº áááºáá±á·áá»áºááᯠáá»ááºáá»ááºážááá¯á·áááºááŒá áºááŒá®áž áá»ááºááᯠ10 áá®áá®á áá¹ááá·áºááŒáá·áº áá±ážááá¯á·áááºááŒá áºáááºá
áá¯ááááááºážáááºážááŸá¬ Nth packet ááá¯ááºážááᯠáá±ážáá¬ážáá±á¬ ááŒá áºááá¯ááºááŒá± (ááŸáá·áºáááºá ááºááŸá¯) ááŒáá·áº áá»ááºááŒááºážááá¯á·ááŒá®áž áá»ááºááᯠáá±ážáá¬ážáá±á¬ ááŸá±á¬áá·áºááŸá±ážááŸá¯ááŒáá·áº ááá¯á·ááá¯ááºááŒááºáž ááŒá áºáááºá á á¬ááœááºá á¬áááºážá០á¥ááá¬-
tc qdisc change dev lo root netem delay 10ms reorder 25% 50% gap 5
ááá¹á áá¡áá¯ááºááá¯ááºážááœáẠááŸá±á¬áá·áºááŸá±ážááŸá¯áááŸááá² áá±ážááá¯á·ááá¯ááºááŒá± 25% ááŸááááºá
Bandwidth ááŒá±á¬ááºážáá²ááŒááºážá
áá±áá¬ááá¯ááºážááᯠáááºááœáŸááºážáá±á·ááŸááá«áááºá
tc qdisc change dev lo root netem rate 56kbit
á€á¡ááœá²á·ááẠááá®ážááŸáá·áºáááºááŒááºáž ááŒá¯áá¯ááºáá«áááºá localhost dial-up modem ááŸáááá·áº á¡ááºáá¬áááºááᯠá
á®ážáááºážááá¯ááºááá²á·ááá¯á· áá¬áá»ááºáá«áááºá áá
áºááŸá¯ááºážáááºááŸááºááŒááºážá¡ááŒááºá áááºááẠááá·áºááºá¡ááœáŸá¬áááá¯ááá¯áá±á¬ áá±á¬áºáááºááᯠá¡áá¯áá°ááá¯ááºáááº- áááºáááºá¡ááœááºá áá²ááºá¡ááœááºá¡á
á¬ážá ááŸáá·áº áá²ááºá¡ááœáẠá¡áá±á«áºááá¯ááºážááᯠáááºááŸááºáá«á á¥ááá¬á áá«ááᯠá¡áá¯áá°ááá¯á·ááááºá
tc qdisc change dev lo root netem rate 56kbit 0 48 5
áá»áááºáááºááŸá¯ á¡áá»áááºáá¯ááºááŸá¯ááᯠá¡áá¯áá°ááŒááºážá
áá±á¬á·ááºáá²ááºááá¯áááºáá¶ááá·áºá¡áá« á ááºážáááºááŸá¯á¡á á®á¡á ááºá áá±á¬ááºáááºá¡áá±ážááŒá®ážáá±á¬á¡áá»ááºááŸá¬ á¡áá»áááºáá¯ááºááŒááºážáááºááŒá áºáááºá ááŒáá·áºáá±ááá·áºá áá áºáá»á¬ážááœááºá áááºáá±á¬ááºááŸá¯áá»á¬ážáá²ááŸáá áºáá¯á¡á¬áž ááááºáá¬ážááá·áºá¡áá«á á¡ááŒá¬ážáá°áá»á¬ážááẠá¡ááŒá¬ážáá°áá»á¬ážáᶠá¡áá»áááºáá®ááŒááºááœá¬ážáááẠááá¯á·ááá¯áẠáá±á¬ááºáááºáᶠá¡ááŸá¬ážáá áºáá¯ááŒááºáá±ážááááºááŒá áºáá±á¬ááŒá±á¬áá·áº á¡áááºááŒá±á¬áá·áºááá¯áá±á¬áº áááºážááá¯á·ááẠáá¯á¶á·ááŒááºááŸá¯ ááá¯á·ááá¯áẠáá»áááºáááºááŸá¯ááᯠá á±á¬áá·áºááá¯ááºážáá±áá¯á¶áá»áŸááŒáá·áº áááá¯ááºážáá¬ážááá·áºáá±á¬ááŒá±á¬áá·áºá áááºáá±á¬ááºáááºá
ááá¯ááá¯á·áá¯ááºáá±á¬ááºááẠáááºážáááºážáá»á¬ážá
áœá¬ ááŸááááº- á¥ááá¬á¡á¬ážááŒáá·áºá áá¯á¶á·ááŒááºááŒááºážáááŸááá±á¬ áá¯á¶ááá¹áááºáá
áºáá¯ááᯠá¡áá¯á¶ážááŒá¯áá«á ááá¯á·ááá¯áẠá¡ááŸá¬ážááŸá¬ááŒááºáááááá¬ááᯠá¡áá¯á¶ážááŒá¯á áá¯ááºáááºážá
ááºááá¯á· áá»áááºáááºáá«á áááºážááŒá±á¬ááºážááŸááºááœáẠáá±á¬ááºááœá²ááŸááºáá
áºáá¯ááᯠááá·áºáᬠáá¯ááºáááºážá
ááºááᯠáááºááá¯ááºáá« (áááºážááẠáá±á¬ááºááŒááºáá±á¬áááºážáááºážááŒá
áºááá¯ááºáááº)á ááá¯á·áá±á¬áº á¡áááºááŸá¬ážáá¯á¶ážáá
áºáá¯ááŸá¬ firewall ports ááá¯á·ááá¯áẠhosts áá»á¬ážááŒá
áºáááºá áá«ááᯠáá°áá®áá±ážáá«áááá·áºáááºá
ááá¯ááºááŒáááºá¡ááœááºá áá»áœááºá¯ááºááá¯á·ááẠfirewall port 12345 ááŸáá·áºáá»áœááºá¯ááºááá¯á·á client script ááᯠrun áá«áááºá áááºááẠáá±ážááá¯á·áá° ááá¯á·ááá¯áẠáááºáá¶áá°ááŸá á¡áááºá¡áá¯ááºáá»á¬ážááᯠဠport ááá¯á· firewall ááŒáá·áº áá¯ááºáá±ážááá¯ááºáááºá áá»áœááºá¯ááºáááá°áá¬áá»á¬ážááœááºá á¡áááºáááºáááºáá»á¬ážááᯠfirewalled áá¶ááááá·áºááẠ(áá»áœááºá¯ááºááá¯á·ááẠááœááºážááẠINPUT ááŸáá·áº ááœá±ážáá»ááºááŸá¯ááᯠá¡áá¯á¶ážááŒá¯áá«áááºá --dport) ááá¯áá²á·ááá¯á·áá±á¬ áááºáá±á·áá»áºáá»á¬ážááẠTCP á¡áᶠRST ááŒáá·áº DROPá ááŒááºážáááºááŒááºáž ááá¯á·ááá¯áẠááŒááºážáááºááŒááºáž ááá¯á·ááá¯áẠICMP host ááŒáá·áº áááºááŸááºážááá®ááá¯áẠ(ááááºáá±á¬á· áá¯á¶áá±á¡ááŒá¯á¡áá°ááẠicmp-port- áááºááœááºááááá«áá á¬ááŒááºááá¯á·ááœáá·áºáááºáž ááŸááá«áááºá icmp-net- áááºááœááºááááá«á, icmp-proto- áááºááœááºááááá«á, icmp-net-áá¬ážááŒá áºáá¬ážáááºá О icmp-host-áá¬ážááŒá áºáá¬ážáááºá).
áá»áá«
DROP áá« á ááºážáá»ááºážáá áºáá¯ááŸááá»áŸáẠáááºáááºáá»á¬ážááẠááá¯ážááá¯ážááŸááºážááŸááºáž âáá»á±á¬ááºâ áááá·áºáááºá
iptables -A INPUT -p tcp --dport 12345 -j DROP
áá»áœááºá¯ááºááá¯á·ááẠáááá¯ááºážááá·áºááá¯ááœáá·áºááŒá®áž áá¬áá¬ááá¯á·áá»áááºáááºááá·áºá¡ááá·áºááœáẠáááºážááẠá¡á±ážáá²ááœá¬ážáááºááá¯ááœá±á·ááŒááºááááºá á¡ááœá¬ážá¡áá¬ááᯠááŒáá·áºáá¡á±á¬ááºá
á¡ááŸáá¯ááºáá¯á¶ááŒá®áž
[user@host ~]# tcpdump -i lo -nn port 12345
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
08:28:20.213506 IP 127.0.0.1.32856 > 127.0.0.1.12345: Flags [S], seq 3019694933, win 43690, options [mss 65495,sackOK,TS val 1203046450 ecr 0,nop,wscale 7], length 0
08:28:21.215086 IP 127.0.0.1.32856 > 127.0.0.1.12345: Flags [S], seq 3019694933, win 43690, options [mss 65495,sackOK,TS val 1203047452 ecr 0,nop,wscale 7], length 0
08:28:23.219092 IP 127.0.0.1.32856 > 127.0.0.1.12345: Flags [S], seq 3019694933, win 43690, options [mss 65495,sackOK,TS val 1203049456 ecr 0,nop,wscale 7], length 0
08:28:27.227087 IP 127.0.0.1.32856 > 127.0.0.1.12345: Flags [S], seq 3019694933, win 43690, options [mss 65495,sackOK,TS val 1203053464 ecr 0,nop,wscale 7], length 0
08:28:35.235102 IP 127.0.0.1.32856 > 127.0.0.1.12345: Flags [S], seq 3019694933, win 43690, options [mss 65495,sackOK,TS val 1203061472 ecr 0,nop,wscale 7], length 0
client ááẠá¡áááá¯ážááŒá®áž á¡áá»áááºáá¯ááºááœá¬ážáááŒáá·áº SYN packet áá»á¬ážááᯠáá±ážááá¯á·áááºááᯠááœá±á·ááŒááºááá¯ááºáá«áááºá ááá¯á·ááŒá±á¬áá·áº áááá¯ááºážááá·áºááœáẠáá±ážáááºáá±á¬ áá»áá¯á·ááœááºážáá»ááºáá áºáᯠááœá±á·ááŸááá²á·áááº- áááºááẠáááºážáááºážááᯠá¡áá¯á¶ážááŒá¯ááẠááá¯á¡ááºáááºá áááºááŸááºáá»áááº()client ááẠserver ááá¯á·áá»áááºáááºáááºááŒáá¯ážá á¬ážááá·áºá¡áá»áááºááá¯ááá·áºáááºáááºá
áá»áœááºá¯ááºááá¯á·ááẠá ááºážáá»ááºážááᯠáá»ááºáá»ááºážáááºááŸá¬ážáááº-
iptables -D INPUT -p tcp --dport 12345 -j DROP
á ááºážáá»ááºážá¡á¬ážáá¯á¶ážááᯠáá áºááŒáá¯ááºááẠáá»ááºááá¯ááºáááº-
iptables -F
á¡áááºá áááºááẠDocker ááá¯á¡áá¯á¶ážááŒá¯áá±ááŒá®áž ááœááºááááºáá¬ááá¯á·ááœá¬ážáá±á¬ traffic á¡á¬ážáá¯á¶ážááᯠfirewall áá¯ááºááẠááá¯á¡ááºáá«áá áááºážááᯠá¡á±á¬ááºáá«á¡ááá¯ááºáž ááŒá¯áá¯ááºááá¯ááºáá«áááºá
iptables -I DOCKER-USER -p tcp -d CONTAINER_IP -j DROP
ááŒááºážáááºáá«
ááᯠá¡áá¬ážáá° á ááºážáá»ááºážááᯠáá±á«ááºážááá·áºááŒáá«á áá¯á·á ááá¯á·áá±á¬áº ááŒááºážáááºááŒááºážááŒáá·áº-
iptables -A INPUT -p tcp --dport 12345 -j REJECT
á¡ááŸá¬ážáá áºáá¯ááŸáá·áº áá áºá áá¹ááá·áºá¡ááŒá¬ááœáẠclient ááẠááœááºáááºá [Errno 111] áá»áááºáááºááŸá¯ááᯠááŒááºážáááºáá²á·áááºá. ICMP áááºážááŒá±á¬ááºážááᯠááŒáá·áºáá¡á±á¬ááºá
[user@host ~]# tcpdump -i lo -nn icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
08:45:32.871414 IP 127.0.0.1 > 127.0.0.1: ICMP 127.0.0.1 tcp port 12345 unreachable, length 68
08:45:33.873097 IP 127.0.0.1 > 127.0.0.1: ICMP 127.0.0.1 tcp port 12345 unreachable, length 68
Client ááẠááŸá áºááŒááẠáááºáá¶áááŸááááºááᯠááœá±á·ááŒááºááá¯ááºáááºá ááááºáááºážááᯠáááºááœááºááááá«á ááá¯á·áá±á¬áẠá¡ááŸá¬ážáá áºáá¯ááŒáá·áº á¡áá¯á¶ážáááºáá²á·áááºá
tcp-reset ááŒáá·áº ááŒááºážáááºáá«á
ááœá±ážá áá¬ááᯠááá·áºááŒáá·áºáá¡á±á¬áẠ--reject-with tcp-reset:
iptables -A INPUT -p tcp --dport 12345 -j REJECT --reject-with tcp-reset
á€ááá á¹á ááœááºá ááááá±á¬ááºážááá¯áá»ááºááẠRST packet ááá¯áááºáá¶áááŸááá±á¬ááŒá±á¬áá·áº client ááẠá¡ááŸá¬ážá¡ááœááºážáá áºáá¯ááŸáá·áº áá»ááºáá»ááºážááœááºááœá¬ážáááº-
[user@host ~]# tcpdump -i lo -nn port 12345
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
09:02:52.766175 IP 127.0.0.1.60658 > 127.0.0.1.12345: Flags [S], seq 1889460883, win 43690, options [mss 65495,sackOK,TS val 1205119003 ecr 0,nop,wscale 7], length 0
09:02:52.766184 IP 127.0.0.1.12345 > 127.0.0.1.60658: Flags [R.], seq 0, ack 1889460884, win 0, length 0
icmp-host-reachable ááŒáá·áº ááŒááºážáááºáá«á
REJECT ááá¯á¡áá¯á¶ážááŒá¯áááºá¡ááœáẠá¡ááŒá¬ážááœá±ážáá»ááºááŸá¯áá áºáá¯ááᯠá ááºážááŒáá·áºááŒáá«á áá¯á·á
iptables -A INPUT -p tcp --dport 12345 -j REJECT --reject-with icmp-host-unreachable
á¡ááŸá¬ážáá áºáá¯ááŸáá·áº áá áºá áá¹ááá·áºá¡ááŒá¬ááœáẠclient ááẠááœááºáááºá [Errno 113] áááºáá¶áá»ááºážáááẠáááºážááŒá±á¬ááºážáááŸááá«áICMP á¡ááœá¬ážá¡áá¬ááœáẠáá»áœááºá¯ááºááá¯á·ááŒááºááááºá ICMP host 127.0.0.1 ááᯠáááºááœááºááááá«á.
áááºááẠá¡ááŒá¬ážáá±á¬ ááŒááºážááá¯ááŸá¯áá±á¬ááºáá»á¬ážááᯠá ááºážááŒáá·áºááá¯ááºáááºá áááºážááá¯á·ááᯠáá»áœááºá¯ááºá¡á¬áá¯á¶á áá¯ááºáá«ááẠ:)
áá±á¬ááºážááá¯ááŸá¯ á¡áá»áááºáá¯ááºáá¯á¶ážááŸá¯ááᯠá¡áá¯áá°ááŒááºážá
á¡ááŒá¬ážá¡ááŒá±á¡áá±ááŸá¬ áááá¯ááºážááá·áºááẠáá¬áá¬ááá¯á· áá»áááºáááºááá¯ááºáá±á¬áºáááºáž áááºážáá¶ááá¯á· áá±á¬ááºážááá¯áá»ááºáá áºáᯠááá±ážááá¯á·ááá¯ááºááá·áºá¡áá«ááŒá áºáááºá á á áºáá¯ááºááŒááºáž áá»ááºáá»ááºážáá áááºááá¯ááºá á±ááẠáááºáá±á·ááºá»áá»á¬ážááᯠá á áºáá¯ááºáááºážá áááá¯ááºážááá·áºááŸáá·áºáá¬áá¬ááŒá¬ážááŸá áááºááá·áºáááºááœááºáá±ážáááºážááŒá±á¬ááºážááá¯áááᯠááŒáá·áºááŸá¯áá«áá áá»áááºáááºááŸá¯áá áºáá¯áááºáá±á¬ááºááá·áºá¡áá«ááœáẠSYN ááŸáá·áº ACK á¡áá¶áá»á¬ážááá¯áᬠá¡áá¯á¶ážááŒá¯áá±á¬áºáááºáž áá±áá¬áááŸááºááá·áºá¡áá« áá±á¬ááºáá¯á¶ážáá±á¬ááºážááá¯áá»ááºáááºáááºááœáẠPSH á¡áá¶áá«ááŸááááºááᯠáááááŒá¯áááááºááŒá áºáááºá buffering ááá¯ááŸá±á¬ááºááŸá¬ážáááºá¡ááá¯á¡áá»á±á¬ááºáááºáááºáááºá á á áºáá¯ááºááŸá¯áá áºáá¯áááºáá®ážááẠáááºááẠá€á¡áá»ááºá¡áááºááᯠá¡áá¯á¶ážááŒá¯ááá¯ááºáááºá ááá¯á·ááŒá±á¬áá·áº áá»áááºáááºááŸá¯ááᯠáááºáá±á¬ááºáááºááŒá áºáá±á¬áºáááºáž áááá¯ááºážááá·áºááẠáá¬áá¬ááá¯á· áá±áá¬áá±ážááá¯á·ááá¯ááºáááºááá¯ááºáá«á
áá»áá«
DROP á¡ááœáẠcommand ááẠá€áá²á·ááá¯á· ááŒá áºáááº-
iptables -A INPUT -p tcp --tcp-flags PSH PSH --dport 12345 -j DROP
áááá¯ááºážááá·áºááá¯ááœáá·áºááŒá®áž áá¬ááºá¡ááœá¬ážá¡áá¬ááᯠááŒáá·áºááŸá¯áá«-
á¡ááŸáá¯ááºáá¯á¶ááŒá®áž
[user@host ~]# tcpdump -i lo -nn port 12345
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
10:02:47.549498 IP 127.0.0.1.49594 > 127.0.0.1.12345: Flags [S], seq 2166014137, win 43690, options [mss 65495,sackOK,TS val 1208713786 ecr 0,nop,wscale 7], length 0
10:02:47.549510 IP 127.0.0.1.12345 > 127.0.0.1.49594: Flags [S.], seq 2341799088, ack 2166014138, win 43690, options [mss 65495,sackOK,TS val 1208713786 ecr 1208713786,nop,wscale 7], length 0
10:02:47.549520 IP 127.0.0.1.49594 > 127.0.0.1.12345: Flags [.], ack 1, win 342, options [nop,nop,TS val 1208713786 ecr 1208713786], length 0
10:02:47.549568 IP 127.0.0.1.49594 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 1208713786 ecr 1208713786], length 5
10:02:47.750084 IP 127.0.0.1.49594 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 1208713987 ecr 1208713786], length 5
10:02:47.951088 IP 127.0.0.1.49594 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 1208714188 ecr 1208713786], length 5
10:02:48.354089 IP 127.0.0.1.49594 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 1208714591 ecr 1208713786], length 5
áá»áááºáááºááŸá¯ááᯠáááºáá±á¬ááºáá¬ážááŒá®áž client ááẠáá¬áá¬ááá¯á· áá±áá¬áááá¯á·ááá¯ááºáááºááᯠáá»áœááºá¯ááºááá¯á·ááœá±á·ááŒááºááá«áááºá
ááŒááºážáááºáá«
á€ááá á¹á ááœáẠá¡ááŒá¯á¡áá°ááẠáá°áá®áááá·áºáááº- áá±á¬ááºáááºááẠáá±á¬ááºážááá¯áá»ááºááᯠáá±ážááá¯á·ááá¯ááºáááºááá¯ááºáá±á¬áºáááºáž áááºáá¶áááŸááááºááŒá áºáááºá ICMP 127.0.0.1 tcp á¡áá±á«áẠ12345 ááᯠáááºááœááºááááá« ááŸáá·áº áá±á¬ááºážááá¯áá»áẠááŒááºáááºáááºááŒááŸá¯ááŒá¬áž á¡áá»áááºááᯠá¡áááá¯ážáá±ážáá«á command ááẠá€áá²á·ááá¯á· ááŒá áºáááº-
iptables -A INPUT -p tcp --tcp-flags PSH PSH --dport 12345 -j REJECT
tcp-reset ááŒáá·áº ááŒááºážáááºáá«á
command ááẠá€áá²á·ááá¯á· ááŒá áºáááº-
iptables -A INPUT -p tcp --tcp-flags PSH PSH --dport 12345 -j REJECT --reject-with tcp-reset
áá¯á¶ážáá²á·á¡áá«ááŸá¬áááºáž ááááŒá®ážáá¬ážáá«á --reject-with tcp-reset áá±á¬ááºáááºááẠáá¯á¶á·ááŒááºááŸá¯ááœáẠRST áááºáááºááᯠáááºáá¶áááŸááááá·áºáááºá ááá¯á·ááŒá±á¬áá·áº á¡ááŒá¯á¡áá°ááᯠááá·áºááŸááºážááá¯ááºáááº- áá»áááºáááºááŸá¯áááºáá±á¬ááºáá¬ážá áẠRST áááºáááºááᯠáááºáá¶áááŸáááŒááºážááá¯áááºááŸá¬ á¡ááŒá¬ážáá áºáááºááœáẠsocket ááᯠááá»áŸá±á¬áºááá·áºáá² ááááºááœá¬ážááŒááºážááŒá áºááŒá®ážá ááá¯ááá¯áááºááŸá¬ client á០áááºáá¶ááá·áºááẠáááºáá°ááœááºáá°áá»á¬ážá connection ááŸááŒááºáááºá áááº. áá»áœááºá¯ááºááá¯á·á áá¬ááºááœáŸááºážááᯠáááºáááºááŒá®áž á€á¡áá¬ááᯠáá±áá»á¬ááŒáá·áºáá«á á€áááºááŸá¬ áá¬ááºá¡ááœá¬ážá¡áá¬áá¯á¶ááá¹áááºááŒá áºáááº-
á¡ááŸáá¯ááºáá¯á¶ááŒá®áž
[user@host ~]# tcpdump -i lo -nn port 12345
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
10:22:14.186269 IP 127.0.0.1.52536 > 127.0.0.1.12345: Flags [S], seq 2615137531, win 43690, options [mss 65495,sackOK,TS val 1209880423 ecr 0,nop,wscale 7], length 0
10:22:14.186284 IP 127.0.0.1.12345 > 127.0.0.1.52536: Flags [S.], seq 3999904809, ack 2615137532, win 43690, options [mss 65495,sackOK,TS val 1209880423 ecr 1209880423,nop,wscale 7], length 0
10:22:14.186293 IP 127.0.0.1.52536 > 127.0.0.1.12345: Flags [.], ack 1, win 342, options [nop,nop,TS val 1209880423 ecr 1209880423], length 0
10:22:14.186338 IP 127.0.0.1.52536 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 1209880423 ecr 1209880423], length 5
10:22:14.186344 IP 127.0.0.1.12345 > 127.0.0.1.52536: Flags [R], seq 3999904810, win 0, length 0
icmp-host-reachable ááŒáá·áº ááŒááºážáááºáá«á
command á áááºááá¯áá¯á¶á á¶áá²ááá¯áᬠáá°ááá¯ááºážááááŒá®ážáá¬ážááŒá áºáááºáááºáá«ááẠ:) á€ááá á¹á ááœáẠáááá¯ááºážááá·áºáá¡ááŒá¯á¡áá°ááẠááá¯ážááŸááºážáá±á¬ ááŒááºážáááºááŒááºážáá áºáá¯ááŸáá·áº á¡áááºážáááºááœá¬ááŒá¬ážáá«áááº- áááºáááºááᯠááŒááºááá¯á·ááẠááŒáá¯ážáááºážááŸá¯ááŒá¬ážááœáẠclient ááẠá¡áá»áááºáá¯ááºáá¯á¶ážáááºááá¯ááºáá«á
[user@host ~]# tcpdump -i lo -nn icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
10:29:56.149202 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable, length 65
10:29:56.349107 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable, length 65
10:29:56.549117 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable, length 65
10:29:56.750125 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable, length 65
10:29:56.951130 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable, length 65
10:29:57.152107 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable, length 65
10:29:57.353115 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable, length 65
áá±á¬ááºáá»ááº
áá»áááºááœá²áá¬ážáá±á¬ áááá¯ááºážááá·áº ááá¯á·ááá¯áẠáá¬áá¬ááŸáá·áº áááºáá±á¬ááºááŸá¯áá áºáá¯á á¡ááŒááºá¡ááŸááºáá¯á¶á·ááŒááºááŸá¯ááᯠá ááºážáááºááẠá¡áá¯á¡áá±á¬ááºáá áºáá¯áá±ážááẠáááá¯á¡ááºáá«á áá áºáá«áá áºáá¶ááœáẠLinux ááœááºááœá±á·ááá±á¬ á á¶áá¯á¶ážáá á¹á ááºážáá»á¬ážááᯠá¡áá¯á¶ážááŒá¯ááẠáá¯á¶áá±á¬ááºáá«áááºá
áá±á¬ááºážáá«ážááœáẠááœá±ážááœá±ážáá¬ážáá±á¬ á¡áá¯á¶ážá¡áá±á¬ááºáá»á¬ážááẠáá±á¬áºááŒáá¬ážáááºááẠááá¯áá
áœááºážáá±á¬ááºááá¯ááºáá±á¬ááŒá±á¬áá·áº áááºážááá¯á·ááᯠá¡áá¯á¶ážááŒá¯áááºá¡ááœáẠááá·áºááá¯ááºááá¯ááºááœá±ážáá»ááºááŸá¯á¡áá»áá¯á·ááᯠáááºááŸá¬ááœá±ááá¯ááºáá«áááºá áá¯áá¹ááá¯ááºáá±ážá¡áá áá»áœááºá¯ááºááẠáá»áœááºá¯ááºá¡ááŒá±á¬ááºážáá±ážáá¬ážáááºáá»á¬áž (ááááºáá±á¬á· áááºážáá«ážáááº)á ááá·áºáá¯áá¹ááá®ááœáẠá
ááºážáááºáá¬ááœáẠá€ááá¯á·ááá¯áẠá¡áá¬ážáá° utilities áá»á¬ážááᯠá¡áá¯á¶ážááŒá¯áá«áá á¡ááá¡áá» á¡ááá¡áá» áá±ážáá«á ááá¯ááºáá«áá á¡ááŒá¶ááŒá¯áá¬ážáá±á¬áááºážáááºážáá»á¬ážááá¯á¡áá¯á¶ážááŒá¯á ááœááºáááºááŒá¿áá¬áá»á¬ážá¡ááŒá±á¡áá±áá»á¬ážááœáẠá
ááºážáááºáááºáá¯á¶ážááŒááºáá«á ááá·áºáá±á¬á·ááºáá²ááºááá¯ááá¯áá±á¬ááºážááœááºáá¬áááºáᯠáá»áŸá±á¬áºááá·áºáá«áááºá
source: www.habr.com