ื ืืืื ืืขืืขืจ! ืืืึทื ื ืึธืืขื ืืื ืืืืืจื ืกืึทืืกืึธื ืึธืื, ืืื ืึทืจืืขื ืืื ืึท ืืืืื ื ืกืืกืืขื ืึทืืืื ืืกืืจืึทืืึธืจ ืืื Odnoklassniki. ืืืจ ืืึธืื ืืืืขืจ 7 ืืฉืืืืช ืกืขืจืืืขืจืก, 11 ืงืึทื ืืืื ืขืจื ืืื ืืื ืืืขืจ ืืืึธืืงื, ืืื 200 ืึทืคึผืืึทืงืืืฉืึทื ื ืืืึธืก ืคืึธืจืขื 700 ืคืึทืจืฉืืืขื ืข ืงืืึทืกืืขืจื ืืื ืคืึทืจืฉืืื ืงืึทื ืคืืืืขืจืืืฉืึทื ื. ืื ืืืึทืกื ืืขืจืืืึทื ืคืื ืกืขืจืืืขืจืก ืืืืคื CentOS 7.
ืืืืฃ 14 ืืืืืืกื 2018, ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืื ืืืึทืื ืขืจืึทืืืืืื ืคืื FragmentSmack ืืื ืืจืืืก
() ืืื SegmentSmack (). ืืึธืก ืืขื ืขื ืืืึทืื ืขืจืึทืืืืืืื ืืื ืึท ื ืขืฅ ืืึทืคืึทืื ืืืขืงืืึธืจ ืืื ืึท ืืขื ืื ืืืื ืืขืืฉืื (7.5) ืืืึธืก ืืจืขืืึทื ื ืืื ืึท ืึธืคึผืืืืงืขื ืื ื ืคืื ืืื ืกื (ืืึธืก) ืจืขืื ืฆื ืืืื ืืืืึธืกืืฉืึทื (ืงืคึผื). ื ืคืึทืจืจืืืื ืืื ืื ืืึทืจืฅ ืคึฟืึทืจ FragmentSmack ืืื ื ืืฉื ืคืืจืืขืืืืื ืืื ืืขืจ ืฆืืื, ืืขืจืฆื, ืขืก ืืื ืืจืืืก ืคืื ืฉืคึผืขืืขืจ ืืื ืื ืืืกืืึทืืข ืคืื โโืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืื ืืืึทืื ืขืจืึทืืืืืื. ืฆื ืขืืืืื ืืจื SegmentSmack, ืขืก ืืื ืืขืืืขื ืคืืจืืขืืืืื ืฆื ืืขืจืืืึทื ืืืงื ืื ืงืขืจื. ืืขืจ ืืขืจืืืึทื ืืืงื ืคึผืขืงื ืืื ืืื ืืืคืจืืื ืืืืฃ ืืขืจ ืืขืืืืงืขืจ ืืึธื, ืึทืืข ืืืึธืก ืืื ืืขืืืืื ืืื ืฆื ืื ืกืืึทืืืจื ืขืก.
ื ืืื, ืืืจ ืืขื ืขื ืืืื ื ืืฉื ืงืขืื ืื ืืึทืจืฅ ืืขืจืืืึทื ืืืงื! ืึธืืขืจ, ืขืก ืืขื ืขื ื ืืึทื ืกืื ...
ืืื ืึทืืื ืืืจ ืืขืจืืืึทื ืืืงื ืื ืืึทืจืฅ ืืืืฃ ืื ืคึผืจืึธื
ืืื ืึทืืืขืืืื, ืืึธืจื ืืฉื ืงืึธืืคึผืืืฆืืจื:
- ืืจืืคืงืืคืืข ืคึผืึทืงืึทืืืฉืึทื;
- ืื ืกืืึทืืืจื ืืื ืืืืฃ ืึท ื ืืืขืจ ืคืื ืกืขืจืืืขืจืก (ืึทืจืืึทื ืืขืจืขืื ื ืกืขืจืืืขืจืก ืืืึธืก ืืึธืกืืื ื ืืื ืืืขืจ ืืืึธืืงื);
- ืืึทืื ืืืืขืจ ืึทื ืืึธืจื ืืฉื ืืื ืฆืขืืจืืื;
- ืืึทืื ืืืืขืจ ืึทื ืึทืืข ื ืึธืจืืึทื ืงืขืจื ืกืขืืืื ืืก ืืขื ืขื ืืขืืืขื ืื ืึธื ืขืจืจืึธืจืก;
- ืืืึทืจืื ืึท ืืืกื ืืขื;
- ืงืึธื ืืจืึธืืืจื ืกืขืจืืืขืจ ืคืึธืจืฉืืขืืื ื;
- ืืึทืฉืืืืขื ืื ืืืคึผืืืืืึทื ื ืคืื ื ืืึทืข ืกืขืจืืืขืจืก ืฆื ืื ื ืืึทืข ืืึทืจืฅ;
- ืืขืจืืืึทื ืืืงื ืึทืืข ืกืขืจืืืขืจืก ืืืจื ืืึทืื ืฆืขื ืืขืจ (ืืืื ืืึทืื ืฆืขื ืืขืจ ืืื ืึท ืฆืืื ืฆื ืืื ืึทืืืื ืื ืคึผืจืึทื ืืืืฃ ื ืืฆืขืจืก ืืื ืคืึทื ืคืื ืคึผืจืึธืืืขืืก);
- ืจืืกืืึทืจื ืึทืืข ืกืขืจืืืขืจืก.
ืืืืขืจืืืจื ืคึฟืึทืจ ืึทืืข ืื ืฆืืืืืื ืคืื ืื ืงืึธืจืขืก ืืืึธืก ืืืจ ืืึธืื. ืืื ืืขืจ ืืึธืืขื ื ืขืก ืืื:
- ืืขืจืืข CentOS 7 3.10 - ืคึฟืึทืจ ืจืืึฟ ืจืขืืืืขืจ ืกืขืจืืืขืจืก;
- ืืืึทื ืื 4.19 - ืคึฟืึทืจ ืืื ืืืขืจ , ืืืืื ืืืจ ืืืจืคื BFQ, BBR, ืืื"ื ื;
- ืขืืจืขืคึผืึธ ืงืขืจื-ืื 5.2 - ืคึฟืึทืจ , ืืืืึทื 4.19 ืืื ืืขืืืขื ืึทื ืกืืืืืึทื, ืืื ืื ืืขืืืข ืคึฟืขืึดืงืืืื ืืขื ืขื ืืืจืฃ.
ืืื ืืืจ ืงืขื ืืึธืื ืืขืกื, ืจืืกืืึทืจืืื ื ืืืืื ืืขืจ ืคืื ืกืขืจืืืขืจืก ื ืขืื ืื ืืึธื ืืขืกื ืฆืืื. ืืื ื ื ืื ืึทืืข ืืืึทืื ืขืจืึทืืืืืืื ืืขื ืขื ืงืจืืืืฉ ืคึฟืึทืจ ืึทืืข ืกืขืจืืืขืจืก, ืืืจ ื ืึธืจ ืจืขืืึธืึธื ืื ืืืึธืก ืืขื ืขื ืืืืึทื ืฆืืืจืืืืขื ืคึฟืื ืืขืจ ืืื ืืขืจื ืขืฅ. ืืื ืื ืืืึธืืงื, ืืื ืกืืจ ื ืืฉื ืฆื ืืึทืืจืขื ืขืฆื ืืืืืืงืืึทื, ืืืจ ืืึธื ื ืื ืืื ืื ืืืกืืืืื ืืง ืฆืืืจืืืืขื ืงืึทื ืืืื ืขืจื ืฆื ืืืื ืกืขืจืืืขืจืก ืืื ืึท ื ืืึท ืืึทืจืฅ, ืึธืืขืจ ืจืขืืึธืึธื ืึทืืข ืืื ืืช ืึธื ืืืกื ืขื. ืฆืื ืืืืง, ืืขืจ ืคึผืจืึธืฆืขืืืจ ืืื ืกืืืคึผืืขืจ ืืึธืจื ืืื ืืื ืงืึทื ืืืขื ืฉืึทื ืึทื ืกืขืจืืืขืจืก. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืกืืืืืืขืกืก ืงืึทื ืืืื ืขืจื ืงืขื ืขื ืคืฉืื ืืึทื ืฆื ืื ืื ืืขืจ ืกืขืจืืืขืจ ืืขืฉืึทืก ืึท ืจืขืืึธืึธื.
ืืื, ืขืก ืืื ื ืึธื ืึท ืคึผืืึทืฅ ืคืื ืึทืจืืขื, ืืื ืขืก ืงืขื ื ืขืืขื ืขืืืขืืข ืืืึธืื, ืืื ืืืื ืขืก ืืขื ืขื ืงืืื ืคืจืืืืขืืขื ืืื ืื ื ืืึทืข ืืืขืจืกืืข, ืึทืจืืืฃ ืฆื ืขืืืขืืข ืืืฉืื. ืึทืืึทืงืขืจื ืืขื ืขื ืืขืืื ื ืึทืืืขืจ ืคืื ืืขื, ืึทืืื ืึท ืคึผืืึทื "ื" ืืื ืืืจืฃ.
FragmentSmack/SegmentSmack. ืืืึธืจืงืึทืจืึธืื ื
ืฆืื ืืืืง, ืคึฟืึทืจ ืขืืืขืืข ืืืึทืื ืขืจืึทืืืืืืื ืึทืืึท ืึท ืคึผืืึทื "ื" ืืืืืกืฅ, ืืื ืขืก ืืื ืืขืจืืคื ืืืึธืจืงืึทืจืึธืื ื. ืจืืึฟ ืึธืคื, ืืึธืก ืืื ืึท ืขื ืืขืจืื ื ืืื ืงืขืจื / ืึทืคึผืืึทืงืืืฉืึทื ืกืขืืืื ืืก ืืืึธืก ืืึธืื ืืืจ ืฆื ืืื ืึทืืืื ืื ืืขืืืขื ืืืืจืงืื ื ืึธืืขืจ ืืึธืจ ืขืืืืื ืืจื ืื ืขืงืกืคึผืืืืืืืฉืึทื ืคืื ืืืึทืื ืขืจืึทืืืืืืื.
ืืื ืืขื ืคืึทื ืคืื FragmentSmack / SegmentSmack ืึทืืึท ืืืึธืจืงืึทืจืึธืื ื:
ยซืืืจ ืงืขื ืขื ืืืืฉื ืื ืคืขืืืงืืึทื ืืืึทืืืขืก ืคืื 4MB ืืื 3MB ืืื net.ipv4.ipfrag_high_thresh ืืื net.ipv4.ipfrag_low_thresh (ืืื ืืืืขืจ ืืคึผืื6 ืงืึทืื ืขืจืคึผืึทืจืฅ net.ipv6.ipfrag_high_thresh ืืื net.ipv6.ipfrag_low_thresh) ืืื ืจืืกืคึผืขืงืืืืืื 256 ืงืืืืืืื ืึธืืขืจ ื ืืืขืจืืงืขืจ. . ืืขืกืฅ ืืืืึทืื ืึท ืงืืืื ืฆื ืืึทืืืืืืง ืงืึทืคึผ ืืื ืงืคึผื ืืึทื ืืฅ ืืขืฉืึทืก ืึท ืืึทืคืึทืื, ืืืคึผืขื ืืื ื ืืืืฃ ืืึทืื ืืืึทืจื, ืกืขืืืื ืืก ืืื ืื ืึธืื. ืึธืืขืจ, ืขืก ืงืขื ืืืื ืขืืืขืืข ืคืึธืจืฉืืขืืื ื ืคึผืจืึทื ืจืขืื ืฆื ipfrag_high_thresh = 192 ืืืืขืก, ืืืืึทื ืืืืื ืฆืืืื 262144 ืง ืคืจืึทืืืึทื ืฅ ืงืขื ืขื ืคึผืึทืกืืง ืืื ืื ืจืืืืื ืจืื ืืื ืืขืจ ืืขืืืืงืขืจ ืฆืืื. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืขืก ืืื ืึท ืจืืืืงืืจื ืึทื ืึทืคึผืืึทืงืืืฉืึทื ื ืืืึธืก ืึทืจืืขื ืืื ืืจืืืก UDP ืคึผืึทืงืืฅ ืืืขื ืืจืขืื'.
ืื ืคึผืึทืจืึทืืขืืขืจืก ืืื ืืืกืงืจืืืื ืืื ืืึธืก:
ipfrag_high_thresh - LONG INTEGER
Maximum memory used to reassemble IP fragments.
ipfrag_low_thresh - LONG INTEGER
Maximum memory used to reassemble IP fragments before the kernel
begins to remove incomplete fragment queues to free up resources.
The kernel still accepts new fragments for defragmentation.
ืืืจ ืืึธื ื ืื ืืึธืื ืืจืืืก ืืืคึผืก ืืืืฃ ืคึผืจืึธืืืงืฆืืข ืืึทืืื ืื ืืก. ืขืก ืืื ืงืืื ืคืจืึทืืืึทื ืืื ืคืึทืจืงืขืจ ืืืืฃ ืื ืืึทื, ืืืืฃ ืื ืืืึทื ืขืก ืืื, ืึธืืขืจ ื ืืฉื ืืึทืืืึทืืืง. ืืึธืจื ืืฉื ืคืึธืจืฉืึทืืึธืื - ืืืจ ืงืขื ืขื ืืขืื ืืืึธืจืงืึทืจืึธืื ื!
FragmentSmack/SegmentSmack. ืขืจืฉืืข ืืืื
ืืขืจ ืขืจืฉืืขืจ ืคึผืจืึธืืืขื ืืืึธืก ืืืจ ืืึธืื ืืขืคึผืืึธื ืืขืจื ืืื ืืขืืืขื ืึทื ืืืึธืืงื ืงืึทื ืืืื ืขืจื ืืึธืื ืืืื ืืึธื ืืขืืืขื ืื ืื ื ืืึทืข ืกืขืืืื ืืก ืืืืื ืืืื (ืืืืื ipfrag_low_thresh), ืืื ืืื ื ืืฉื ืึธื ืืืขื ืืืขื - ืืื ื ืึธืจ ืงืจืึทืฉื ืืื ืื ืึธื ืืืื. ืขืก ืืื ื ืื ืืขืืืขื ืฆื ืจืขืคึผืจืึธืืืฆืืจื ืืขื ืคึผืจืึธืืืขื ืกืืึทืืื (ืืึทื ืืืึทืื ืึทืืข ืกืขืืืื ืืก ืืขื ืขื ืืขืืืขื ืื ืึธื ืงืืื ืฉืืืขืจืืงืืืื). ืฆื ืคึฟืึทืจืฉืืืื ืืืึธืก ืื ืงืึทื ืืืื ืขืจ ืงืจืึทืฉืื ืืื ืื ืึธื ืืืื ืืื ืืืื ื ืืฉื ืึทืืื ืืจืื ื: ืงืืื ืขืจืจืึธืจืก ืืขื ืขื ืืขืคึฟืื ืขื. ืืืื ืืึทื ืืื ืืขืืืขื ืืืืขืจ: ืจืึธืืืื ื ืฆืืจืืง ืื ืกืขืืืื ืืก ืกืึทืืืื ืื ืคึผืจืึธืืืขื ืืื ืงืึทื ืืืื ืขืจ ืงืจืึทืฉืื.
ืคืืจืืืืก ืืื ืขืก ื ืืฉื ืืขื ืื ืฆื ืฆืืืืืื Sysctl ืืืืฃ ืืขืจ ืืึทืืขืืึธืก? ืืขืจ ืงืึทื ืืืื ืขืจ ืืขืื ืืื ืืืื ืืขืืึทืงืืืืึทื ื ืขืฅ ื ืึทืืขืกืคึผืึทืกืข, ืึทืืื ืืืึท ืืื ืืกืืขืจ ืืื ืืขื ืงืึทื ืืืื ืขืจ ืงืขื ืืืื ืึทื ืืขืจืฉ ืคืื ืืขืจ ืืึทืืขืืึธืก.
ืืื ืคึผืื ืงื ืืขื ืขื Sysctl ืกืขืืืื ืืก ืืขืืืขื ืื ืืื ืึท ืงืึทื ืืืื ืขืจ? ืืื ื ืืื ืืืขืจ ืงืึทื ืืืื ืขืจื ืืขื ืขื ืึทื ืคึผืจืืืืืืึทืืืฉืึทื, ืขืก ืืืขื ื ืืฉื ืึทืจืืขืื ืฆื ืืืืฉื ืงืืื Sysctl ืืึทืฉืืขืืืงื ืืืจื ืืืื ืืื ืืขื ืงืึทื ืืืื ืขืจ ืืื - ืขืก ืืขื ืขื ืคืฉืื ื ืืฉื ืืขื ืื ืจืขืื. ืฆื ืืืืคื ืงืึทื ืืืื ืขืจื, ืืื ืืืขืจ ืืืึธืืงื ืืื ืืขืจ ืฆืืื ืืขืืืืื ื ืืึธืงืงืขืจ (ืืืฆื ). ืื ืคึผืึทืจืึทืืขืืขืจืก ืคืื ืื ื ืืึท ืงืึทื ืืืื ืขืจ ืืขื ืขื ืืืจืืืขืืื ืืขื ืฆื Docker ืืืจื ืื API, ืึทืจืืึทื ืืขืจืขืื ื ืื ื ืืืืืง Sysctl ืกืขืืืื ืืก.
ืืขืฉืึทืก ืื ืืืขืจืึทืืืึธื ืคืื ืืืขืจืกืืขืก, ืขืก ืคืืจืงืขืจื ืืืืก ืึทื ืื Docker API ืืื ื ืืฉื ืฆืืจืืงืงืืืขื ืึทืืข ืขืจืจืึธืจืก (ืืคึผืืืช ืืื ืืืขืจืกืืข 1.10). ืืืขื ืืืจ ืืขืคืจืืืื ืฆื ืืืืคื ืืขื ืงืึทื ืืืื ืขืจ ืืืจื "ืืึธืงืงืขืจ ืืืืคื", ืืืจ ืืขืกืึธืฃ ืืขืืขื ืืืึท ืืื ืืกืืขืจ ืขืคึผืขืก:
write /proc/sys/net/ipv4/ipfrag_high_thresh: invalid argument docker: Error response from daemon: Cannot start container <...>: [9] System error: could not synchronise with container process.
ืืขืจ ืคึผืึทืจืึทืืขืืขืจ ืืืขืจื ืืื ื ืืฉื ืืืืืืง. ืึธืืขืจ ืืืึธืก? ืืื ืคืืจืืืืก ืืื ืขืก ื ืืฉื ืืืืืืง ืืืืื ืืื? ืขืก ืืึธื ืืื ืึทืจืืืกืืขืืืืื ืึทื ืืึธืงืงืขืจ ืืื ื ืืฉื ืืึทืจืึทื ืืืจื ืื ืกืืจ ืืื ืืืึธืก Sysctl ืคึผืึทืจืึทืืขืืขืจืก ืืขื ืขื ืืขืืืขื ืื (ืื ืืขืฆืืข ืืืขืจืกืืข ืึธืคึผืืขืฉืืขืื ืืื 1.13.1), ืึทืืื ืืื ipfrag_high_thresh ืืขืคืจืืืื ืฆื ืืืื ืืึทืฉืืืื ืฆื 256K ืืืขื ipfrag_low_thresh ืืื ื ืึธื 3M, ืืึธืก ืืื, ืืขืจ ืืืืืขืจืฉืืขืจ ืฉืืขืืจ ืืื ืืขืืืขื ื ืืืขืจืืงืขืจ ืืื ืืขืจ ื ืืืขืจืืงืขืจ ืืืื ืขืจ, ืืืึธืก ืืขืคึฟืืจื ืฆื ืึท ืืขืืช.
ืืื ืืขืจ ืฆืืื, ืืืจ ืืึธืื ืฉืืื ืืขื ืืฆื ืืื ืืืขืจ ืืืืืขื ืข ืืขืงืึทื ืืืึทื ืคึฟืึทืจ ืจืืงืึทื ืคืืืืขืจืื ื ืืขื ืงืึทื ืืืื ืขืจ ื ืึธื ืื ืึธื ืืืื (ืคืจืืืืื ื ืื ืงืึทื ืืืื ืขืจ ืืืจื ืืื ืขืงืกืึทืงืืืืื ื ืงืึทืืึทื ืื ืืื ืื ื ืึธืืขื ืคืื ืืขื ืงืึทื ืืืื ืขืจ ืืืจื ), ืืื ืืืจ ืืึธืื ืืืื ืฆืืืขืืขืื Sysctl ืคึผืึทืจืึทืืขืืขืจืก ืฆื ืืขื ืืืื. ืื ืคึผืจืึธืืืขื ืืื ืกืึทืืืื.
FragmentSmack/SegmentSmack. ืขืจืฉืืขืจ ืืืื 2
ืืืืืขืจ ืืืจ ืืึธืื ืฆืืื ืฆื ืืึทื ืืืขื ืืื ืื ื ืืฆื ืคืื ืืืึธืจืงืึทืจืึธืื ื ืืื ืื ืืืึธืืงื, ืื ืขืจืฉืืขืจ ืืขืืื ืืขื ืืช ืคืื ืืืืขืจื ืื ืืขืืืืื ืฆื ืึธื ืงืืืขื. ืืื ืืขืจ ืฆืืื, ืขืืืขืืข ืืืึธืื ืืึธืื ืืืจืืืขืืื ืืขื ืืื ื ืื ืึธื ืืืื ืคืื ืืืึธืจืงืึทืจืึธืื ื ืืืืฃ ืืขืจ ืขืจืฉืืขืจ ืกืขืจืืืขืจืก. ืขืจืฉื ืืืกืคืึธืจืฉืื ื ืืื ืืขืืืืื ืึทื ืืขื ืืช ืืขื ืขื ืืืงืืืขื ืืืืฃ ืืืื ืกืขืจืืืืกืขืก, ืืื ื ืืฉื ืืืืฃ ืึทืืข ืกืขืจืืืขืจืก ืคืื ืื ืกืขืจืืืืกืขืก. ืืขืจ ืคึผืจืึธืืืขื ืืื ืืืืืขืจ ืืขืืืืจื ืืึธืจ ืืืืื.
ืขืจืฉืืขืจ ืคืื ืึทืืข, ืืืจ, ืคืื ืงืืจืก, ืืขืคืจืืืื ืฆื ืฆืืจืืงืงืจืืื ืื Sysctl ืกืขืืืื ืืก, ืึธืืขืจ ืืึธืก ืืื ืงืืื ืืืืจืงืื ื. ืคืึทืจืฉืืื ืืึทื ืืคึผืืึทืืืืฉืึทื ื ืืื ืื ืกืขืจืืืขืจ ืืื ืึทืคึผืืึทืงืืืฉืึทื ืกืขืืืื ืืก ืืึธืื ืืืื ื ืืฉื ืืขืืึธืืคึฟื. ืจืขืืึธืึธื ืืขืืึธืืคึฟื. ืจืขืืึธืึธื ืคึฟืึทืจ ืืื ืืงืก ืืื ืืื ืืื ืึทืืืจืืขื ืืื ืขืก ืืื ืืขืืืขื ืืขืจ ื ืึธืจืืึทื ืฆืืฉืืึทื ื ืคึฟืึทืจ ืืจืืขืื ืืื Windows ืืื ืื ืึทืื ืืขื. ืคืื ืืขืกืืืืขืื ืืึธื ืขืก ืืขืืึธืืคื, ืืื ืืืจ ืืึธืื ืึทืืฅ ืึธืคึผืืขืฉืจืืื ืืื ืึท "ืืืืืฉ ืืื ืืขืจ ืงืขืจื" ืืืขื ืืขื ืึทืคึผืืืืื ื ืื ื ืืืข ืกืขืืืื ืืก ืืื Sysctl. ืืื ืืืืืืืื ืืง ืืื ืืึธืก ืืขืืืขื ...
ืืจืื ืืืึธืื ืฉืคึผืขืืขืจ ืื ืคึผืจืึธืืืขื ืจืืงืขืจื. ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืคืื ืื ืกืขืจืืืขืจืก ืืื ืืึทื ืฅ ืคึผืฉืื: Nginx ืืื ืคึผืจืึทืงืกื / ืืึทืืึทื ืกืขืจ ืืึธืืข. ืงืืืื ืคืึทืจืงืขืจ. ื ืื ืื ืืจืึทืืึทืงืืขืจื: ืืืืฃ ืงืืืืึทื ืฅ, ืื ื ืืืขืจ ืคืื 504 ืขืจืจืึธืจืก ืืื ืื ืงืจืืกืื ื ืืขืืขืจ ืืึธื (). ืื ืืจืึทืคืืง ืืืืืื ืื ื ืืืขืจ ืคืื 504 ืขืจืจืึธืจืก ืคึผืขืจ ืืึธื ืคึฟืึทืจ ืืขื ืืื ืกื:
ืึทืืข ืขืจืจืึธืจืก ืืขื ืขื ืืืขืื ืืขืจ ืืขืืืืงืขืจ ืืึทืงืขื ื - ืืืขืื ืืขืจ ืืืื ืขืจ ืืืึธืก ืืื ืืื ืื ืืืึธืืงื. ืื ืืจืึทืคืืง ืคืื ืืึผืจืื ืงืึทื ืกืึทืืฉืึทื ืคึฟืึทืจ ืคึผืขืงื ืคืจืึทืืืึทื ืฅ ืืืืฃ ืืขื ืืึทืงืขื ื ืืื ืืขืงืืงื ืืื ืืึธืก:
ืืึธืก ืืื ืืืื ืขืจ ืคืื ืื ืืขืจืกื ืกืืจืืืงืื ื ืืึทื ืึทืคืขืกืืืืฉืึทื ื ืคืื ืืขื ืคึผืจืึธืืืขื ืืืืฃ ืื ืืฉืึทืจืฅ ืคืื ืื ืึธืคึผืขืจืืืืื ื ืกืืกืืขื. ืืื ืื ืืืึธืืงื, ืคึผืื ืงื ืืื ืืขืจ ืืขืืืืงืขืจ ืฆืืื, ืื ืื ืืขืจ ื ืขืฅ ืคึผืจืึธืืืขื ืืื QoS (Traffic Control) ืกืขืืืื ืืก ืืื ืคืึทืจืคืขืกืืืงื. ืืืืฃ ืื ืืจืึทืคืืง ืคืื ืืึผืจืื ืงืึทื ืกืึทืืฉืึทื ืคึฟืึทืจ ืคึผืขืงื ืคืจืึทืืืึทื ืฅ, ืขืก ืืขืงืืงื ืคึผืื ืงื ืื ืืขืืืข:
ืื ืืึทืฉืึธืจืข ืืื ืคึผืฉืื: ืืืื ืืื ืงืืงื ืื ืืขืืืข ืืืืฃ ืื ืืฉืึทืจืฅ, ืืื ืืึธืื ืื ืืขืืืข ืกืืื. ืืขืจืฆื, ืงืืื ืคืจืืืืขืืขื ืืื ืืขื ืืืคึผ ืคืื ืืึผืจืื ืืขื ืขื ืืึธืจ ืืขืืื.
ืื ืขืกืึทื ืก ืคืื ืื ืคืึทืจืคืขืกืืืงื ืคึผืจืึธืืืขื ืืื ืืขืืืขื ืึทื ืืืจ ืืขืืืืื ื ืื fq ืคึผืึทืงืึทื ืกืงืขืืืฉืืืขืจ ืืื ืคืขืืืงืืึทื ืกืขืืืื ืืก ืืื QoS. ืืืจื ืคืขืืืงืืึทื, ืคึฟืึทืจ ืืืื ืงืฉืจ, ืขืก ืึทืืึทืื ืืืจ ืฆื ืืืืื 100 ืคึผืึทืงืืฅ ืฆื ืื ืจืื, ืืื ืขืืืขืืข ืงืึทื ืขืงืฉืึทื ื ืืื ืึท ืกืืืืึทืฆืืข ืคืื โโืคืขืื ืคืื ืึท ืงืึทื ืึทื ืื ืืขืืืืื ืฆื ืคึผืืึธืืืืจื ืื ืจืื ืฆื ืืืจืืคืึทื. ืืื ืืขื ืคืึทื, ืื ืคึผืึทืงืึทืฅ ืืขื ืขื ืืจืึทืคึผื. ืืื ืื tc ืกืืึทืืืกืืืง (tc -s qdisc) ืขืก ืงืืงื ืืื ืืึธืก:
qdisc fq 2c6c: parent 1:2c6c limit 10000p flow_limit 100p buckets 1024 orphan_mask 1023 quantum 3028 initial_quantum 15140 refill_delay 40.0ms
Sent 454701676345 bytes 491683359 pkt (dropped 464545, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
1024 flows (1021 inactive, 0 throttled)
0 gc, 0 highprio, 0 throttled, 464545 flows_plimit
"464545 ืคืืึธืืืก_ืคึผืืืืื" ืืื ืื ืคึผืึทืงืืฅ ืืจืึทืคึผื ืจืขืื ืฆื ืืงืกืื ืื ืจืื ืฉืืขืืจ ืคืื ืืืื ืงืฉืจ, ืืื "ืืจืึทืคึผื 464545" ืืื ืื ืกืึทืืึทืงื ืคืื ืึทืืข ืืจืึทืคึผื ืคึผืึทืงืืฅ ืคืื ืืขื ืกืงืขืืืฉืืืขืจ. ื ืึธื ืื ืงืจืืกืื ื ืื ืจืื ืืขื ื ืฆื 1 ืืืืื ื ืืื ืจืืกืืึทืจืืื ื ืื ืงืึทื ืืืื ืขืจื, ืื ืคึผืจืึธืืืขื ืืื ืืืืคืืขืืขืจื ืฆื ืืขืจืฉืืึทื ืขื. ืืืจ ืงืขื ืขื ืืึทืจ ืฆืืจืืง ืืื ืืืื ืฉืืื ืืื ืืึธืื ืึท ืกืืึธืึธืืืืข.
FragmentSmack/SegmentSmack. ืืขืฆืืข ืืืื
ืคืืจืกืืื, ืขืืืขืืข ืืืฉืื ื ืึธื ืื ืืขืืื ืคืื ืืืึทืื ืขืจืึทืืืืืืื ืืื ืื ืงืขืจื, ืึท ืคืึทืจืจืืืื ืคึฟืึทืจ FragmentSmack ืืขืกืึธืฃ ืืจืืืก (ืืื ืืขืจืืึธื ืขื ืืืจ ืึทื ืึท ืคืึทืจืจืืืื ืืืืื ืคึฟืึทืจ SegmentSmack ืืื ืืืคืจืืื ืฆืืืึทืืขื ืืื ืื ืืขืืื ืืื ืืืืืืกื), ืืืึธืก ืืื ืืื ืื ืึท ืืขืืขืื ืืืื ืฆื ืคืึทืจืืึธืื ืืืึธืจืงืึทืจืึธืื ื, ืืืึธืก ืืึธื ืืื ืื ืืขืคึฟืืจื ืืึทื ืฅ ืึท ืคึผืืึทืฅ ืคืื ืงืึธื ืคืืืงื. ืืื ืืขื ืฆืืื, ืืืจ ืืึธืื ืฉืืื ืืขืจืืื ืฆื ืึทืจืืืขืจืคืืจื ืขืืืขืืข ืกืขืจืืืขืจืก ืฆื ืื ื ืืึทืข ืืึทืจืฅ, ืืื ืืืฆื ืืืจ ืืึธืื ืฆื ืึธื ืืืืื ืคึฟืื ืื ืึธื ืืืื. ืคืืจืืืืก ืืึธืื ืืืจ ืืขืจืืืึทื ืืืงื ืื ืงืขืจื ืึธื ืืืืจืื ืคึฟืึทืจ ืื FragmentSmack ืคืึทืจืจืืืื? ืืขืจ ืคืึทืงื ืืื ืึทื ืืขืจ ืคึผืจืึธืฆืขืก ืคืื ืคึผืจืึทืืขืงืืื ื ืงืขืื ืื ืืืึทืื ืขืจืึทืืืืืืื ืงืึธืืึทื ืกืืืืึทื (ืืื ืืขืจืืืฉื) ืืื ืืขื ืคึผืจืึธืฆืขืก ืคืื ืึทืคึผืืืืืื ื CentOS ืืื (ืืืึธืก ื ืขืื ืืคืืื ืืขืจ ืฆืืื ืืื ืึทืคึผืืืืืื ื ืืืืื ืื ืงืขืจื). ืืื ืึทืืืฉืึทื, SegmentSmack ืืื ืึท ืืขืจ ืืขืคืขืจืืขื ืืืึทืื ืขืจืึทืืืืืื, ืืื ืึท ืคืึทืจืจืืืื ืคึฟืึทืจ ืขืก ืืื ืืืืื ืืจืืืก, ืึทืืื ืขืก ืืื ืืขืืืขื ืืื ืขื ืกืืึท ืืื ืกืืึท. ืึธืืขืจ, ืืืจ ืงืขื ื ืืฉื ื ืึธืจ ืึทืคึผืืจืืื ืื ืงืขืจื ืืืืฃ CentOS, ืืืืึทื ืื FragmentSmack ืืืึทืื ืขืจืึทืืืืืื ืืืึธืก ืืื ืืจืืืก ืืขืฉืึทืก CentOS 7.5 ืืื ืืืืื ืคืึทืจืคืขืกืืืงื ืืื ืืืขืจืกืืข 7.6, ืึทืืื ืืืจ ืืึธืื ืฆื ืืึทืืื ืึทืคึผืืจืืืืื ื ืฆื 7.5 ืืื ืึธื ืืืืื ืืืืืขืจ ืืื ืึทืคึผืืจืืืืื ื ืฆื 7.6. ืืื ืึทืืื ืขืก ืืึทืคึผืึทื ื ืืืื.
ืฆืืืืืื ืก, ืืขืืื ืืึทื ืืฆืขืจ ืืขื ืืช ืืืขืื ืคึผืจืึธืืืขืืก ืืืืืขืงืขืจื ืฆื ืืื ืื. ืืืฆื ืืืจ ืฉืืื ืืืืกื ืคึฟืึทืจ ืืืืขืจ ืึทื ืึทืืข ืคืื โโืืื ืืขื ืขื ืฉืืื ืฆื ืื ืืคึผืืึธืึทื ืคืื ืืขืงืขืก ืคืื ืงืืืืึทื ืฅ ืฆื ืขืืืขืืข ืคืื โโโโืืื ืืืขืจ ืกืขืจืืืขืจืก. ืืขืจืฆื, ืึท ืืืืขืจ ืงืืืื ื ืืืขืจ ืคืื ืืคึผืืึธืึทืืก ืคืื ืื ืืึทื ืฅ ืืึทืกืข ืืขื ืขื ืืืจืืืขืืื ืืขื ืืืจื ืื ืกืขืจืืืขืจืก.
ืืื ืืืจ ืืขืืขื ืงืขื ืคืื ืื ืืขืฉืืืืข ืืืืื, ืจืึธืืืื ื ืฆืืจืืง Sysctl ืืื ื ืืฉื ืืขืืึธืืคึฟื. ืจืขืืึธืึธื ืืขืืึธืืคึฟื, ืึธืืขืจ ืืขืืคึผืขืจืขืจืึทืื.
ืกืึทืกืคึผืืฉืึทื ื ืืื Sysctl ืืขื ืขื ื ืืฉื ืึทืืืขืงืืขื ืืืขื, ืึธืืขืจ ืืึธืก ืืึธื ืขืก ืืื ื ืืืืืง ืฆื ืืึทืืืขื ืืื ืคืื ืืื ืคึฟืึธืจืืึทืฆืืข ืืื ืืขืืืขื. ืืืื ืื ืคืืืืงืืื ืฆื ืจืขืคึผืจืึธืืืฆืืจื ืืขื ืคึผืจืึธืืืขื ืืื ืื ืืคึผืืึธืึทื ืืืืฃ ืืขื ืงืืืขื ื ืืื ืืขืืืขื ืืืืขืจ ืคืขืื ืืืง ืืื ืกืืจ ืฆื ืืขืจ ืืขื ืื ืืขืจื ืขื ืืืึธืก ืืื ืืขืฉืขืขื ืืฉ.
ืึทื ืึทืืืกืืก ืคืื ืึทืืข ืื ืืืฆื ืกืืึทืืืกืืืง ืืื ืืึธืืก ืืื ื ืืฉื ืืจืขื ืืขื ืืื ืื ื ืขืขื ืืขืจ ืฆื ืคึฟืึทืจืฉืืืื ืืืึธืก ืืื ืืขืฉืขืขื ืืฉ. ืขืก ืืื ืืขืืืขื ืึทื ืึทืงืืืข ืคืขืื ืคืื ืื ืคืืืืงืืื ืฆื ืจืขืคึผืจืึธืืืฆืืจื ืืขื ืคึผืจืึธืืืขื ืืื ืกืืจ ืฆื "ืคืืื" ืึท ืกืคึผืขืฆืืคืืฉ ืงืฉืจ. ืฆืื ืกืืฃ, ืื ืืขืืืขืืึธืคึผืขืจืก ืืืืฃ ืื ืกืคึผืขืฆืืขื ืืืขืจืกืืข ืคืื โโืื ืึทืคึผืืึทืงืืืฉืึทื ืืขืจืืื ืฆื ืืขืจืืจืืืื ืึท ืกืืึทืืื ืจืขืคึผืจืึธืืืงืฆืืข ืคืื โโืคึผืจืึธืืืขืืก ืืืืฃ ืื ืคึผืจืืืืจื ืืืื ืืืขื ืงืึธื ื ืขืงืืขื ืืืจื Wi-Fi. ืืึธืก ืืื ืืขืืืขื ืึท ืืจืืืงืืจื ืืื ืื ืืืกืคืึธืจืฉืื ื. ืืขืจ ืงืืืขื ื ืืื ืคืืจืืื ืื ืฆื Nginx, ืืืึธืก ืคึผืจืึทืงืกืืื ืฆื ืื ืืึทืงืขื ื, ืืืึธืก ืืื ืืขืืืขื ืืื ืืืขืจ Java ืึทืคึผืืึทืงืืืฉืึทื.
ืืขืจ ืืืึทืืึธื ืืื ืคืึทื ืคืื ืคึผืจืึธืืืขืืก ืืื ืืขืืืขื ืืื ืืึธืก (ืคืึทืจืคืขืกืืืงื ืืืืฃ ืื ืืืึทื ืคืื ืื Nginx ืคึผืจืึทืงืกื):
- ืงืืืขื ื: ืืขืื ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืืึทืื ืืึธืืืื ื ืึท ืืขืงืข.
- Java Server: ืขื ืืคืขืจ.
- ืงืืืขื ื: ืคึผืึธืกื ืืื ืืขืงืข.
- Java ืกืขืจืืืขืจ: ืืขืืช.
ืืื ืืขืจ ืืขืืืืงืขืจ ืฆืืื, ืื Java ืกืขืจืืืขืจ ืฉืจืืืื ืฆื ืื ืงืืึธืฅ ืึทื 0 ืืืืขืก ืคืื ืืึทืื ืืขื ืขื ืืืงืืืขื ืคืื ืืขื ืงืืืขื ื, ืืื ืื Nginx ืคืจืืงืกื ืฉืจืืืื ืึทื ืื ืืขืื ืืขื ืืืขื ืืขืจ ืืื 30 ืกืขืงืื ืืขืก (30 ืกืขืงืื ืืขืก ืืื ืื ืืืืืึทืื ืคึฟืึทืจ ืื ืงืืืขื ื ืึทืคึผืืึทืงืืืฉืึทื). ืคืืจืืืืก ืืืืืึทืื ืืื ืืืึธืก 0 ืืืืขืก? ืคึฟืื ืึท ืืืืคึผ ืคืื ื ืคืื ืืืื ืื ื, ืึทืืฅ ืึทืจืืขื ืืื ืขืก ืืึธื, ืึธืืขืจ ืื POST ืืื ืืขืจ ืืขืงืข ืกืืื ืฆื ืคืึทืจืฉืืืื ืื ืคืื ืื ื ืขืฅ. ืืื ืขืก ืคืืจืฉืืืื ืื ืฆืืืืฉื ืืขื ืงืืืขื ื ืืื Nginx. ืขืก ืืื ืฆืืื ืฆื ืืึทืืืึธืจืขื ืขื ืืื ืืื Tcpdump! ืืืขืจ ืขืจืฉืืขืจ ืืืจ ืืึทืจืคึฟื ืฆื ืคึฟืึทืจืฉืืืื ืื ื ืขืฅ ืงืึทื ืคืืืืขืจืืืฉืึทื. Nginx ืคึผืจืึทืงืกื ืืื ืืื ืืขืจ ืื L3 ืืึทืืึทื ืกืขืจ . ืืื ื ืขืืื ื ืืื ืืขื ืืฆื ืฆื ืฆืืฉืืขืื ืคึผืึทืงืืฅ ืคึฟืื ืื L3 ืืึทืืึทื ืกืขืจ ืฆื ืื ืกืขืจืืืขืจ, ืืืึธืก ืืืกืืฃ ืืืื ืืขืืขืจื ืฆื ืื ืคึผืึทืงืืฅ:
ืืื ืืขืจ ืืขืืืืงืขืจ ืฆืืื, ืื ื ืขืฅ ืงืืื ืฆื ืืขื ืกืขืจืืืขืจ ืืื ืื ืคืึธืจืขื ืคืื ืืืืึทื-ืืึทืื ืคืึทืจืงืขืจ, ืืืึธืก ืืืื ืืืกืืฃ ืืืื ืคืขืืืขืจ ืฆื ืื ืคึผืึทืงืืฅ:
ืืื ืืขืจ ืคืึทืจืงืขืจ ืงืขื ืืืื ืืืื ืคืจืึทืืืึทื ืืื (ืืขืจ ืืืืขืจ ืงืืืื ืคึผืจืึธืฆืขื ื ืคืื ืื ืงืึทืืื ื ืคืจืึทืืืึทื ืืื ืคืึทืจืงืขืจ ืืืึธืก ืืืจ ืืึธืื ืืขืจืขืื ืืื ืื ืจืืืืงืืจื ืึทืกืขืกืืึทื ื ืคืื ืืืึธืจืงืึทืจืึธืื ื), ืืืึธืก ืืืื ืขื ืืขืจืื ืืขื ืื ืืื ืืึทืื ืคืื ืื ืืขืืขืจื:
ืึทืืึธื ืืืืืขืจ: ืคึผืึทืงืืฅ ืืขื ืขื ืขื ืงืึทืคึผืกืึทืืืืืื ืืืจื ืึท ืืืืึทื ืงืืืืื, ืขื ืงืึทืคึผืกืึทืืืืืื ืืืจื ืึท ืืื ืขื, ืคืจืึทืืืึทื ืืื. ืฆื ืืขืกืขืจ ืคึฟืึทืจืฉืืืื ืืื ืืึธืก ืืึทืคึผืึทื ื, ืืึธืื ืืื ืื ืฉืคึผืืจ ืื ืคึผืึทืงืึทื ืก ืืึทืจืฉืจืื ืคืื ืืขื ืงืืืขื ื ืฆื ืื Nginx ืคืจืืงืกื.
- ืื ืคึผืึทืงืึทื ืงืืื ืฆื ืื L3 ืืึทืืึทื ืกืขืจ. ืคึฟืึทืจ ืจืืืืืง ืจืืืื ื ืืื ืื ืืึทืื ืฆืขื ืืขืจ, ืื ืคึผืึทืงืึทื ืืื ืขื ืงืึทืคึผืกืึทืืืืืื ืืื ืึท ืืื ืขื ืืื ืืขืฉืืงื ืฆื ืื ื ืขืฅ ืงืึธืจื.
- ืืื ื ืื ืคึผืึทืงืึทื + ืืื ืขื ืืขืืขืจื ืืึธื ื ืื ืคึผืึทืกืืง ืืื ืื MTU, ืื ืคึผืึทืงืึทื ืืื ืฉื ืืึทืื ืืื ืคืจืึทืืืึทื ืฅ ืืื ืืขืฉืืงื ืฆื ืื ื ืขืฅ.
- ืืขืจ ืืึทืฉืืืืขื ื ืึธื ืื ื 3 ืืึทืืึทื ืกืขืจ, ืืืขื ืืืจ ืืึทืงืืืขื ืึท ืคึผืึทืงืึทื, ืืืกืืฃ ืึท ืืืืึทื ืงืืืืื ืฆื ืขืก ืืื ืกืขื ืื ืขืก ืืืืึทืืขืจ.
- ืืขืจ ืืึทืฉืืืืขื ืืื ืคืจืึธื ื ืคืื ืื Nginx ืคืจืืงืกื ืืขื (ืืืจื ืคึผืึธืจื ืกืขืืืื ืืก) ืึทื ืืขืจ ืกืขืจืืืขืจ ืืื ืืงืกืคึผืขืงืืื ื ืึท ืืืืึทื ืขื ืงืึทืคึผืกืึทืืืืืื ืคึผืึทืงืึทื, ืึทืืื ืขืก ืกืขื ืื ืขืก ืืื ืืื, ืึธื ืจืืืืืืื ื ืื ืืืืึทื ืงืืืืื.
- ืืื ืืงืก ื ืขืื ืคืจืึทืืืึทื ืฅ ืคืื ืืืื ืคึผืึทืงืึทืืืฉืึทื ืืื ืืืื ืืื ืฆืืืึทืืขื ืืื ืืืื ืืจืืืก ืคึผืขืงื.
- ืืขืจื ืึธื ืื ืคึผืึทืงืึทื ืงืืื ืฆื ืื Vlan ืฆืืืื ื, ืืื ืืขืจ ืขืจืฉืืขืจ ืฉืืืืข ืืื ืึทืืืขืงืืขื ืืืขื ืคืื ืขืก - Vlan ืขื ืงืึทืคึผืกืืืึทืืืึธื.
- ืืขืจื ืึธื ืืื ืืงืก ืกืขื ืื ืขืก ืฆื ืื ืืื ื ืขื ืฆืืืื ื, ืืื ืืืื ืขืจ ืืขืจ ืฉืืืืข ืืื ืึทืืืขืงืืขื ืืืขื ืคืื ืขืก - ืืื ื ืขื ืขื ืงืึทืคึผืกืืืึทืืืึธื.
ืื ืฉืืืขืจืืงืืื ืืื ืฆื ืคืึธืจื ืึทืืข ืืขื ืืื ืคึผืึทืจืึทืืขืืขืจืก ืฆื tcpdump.
ืืึธืืืจ ืึธื ืืืืื ืคึฟืื ืื ืกืืฃ: ืืขื ืขื ืจืืื (ืึธื ืขืงืกืืจืข ืืขืืขืจื) IP ืคึผืึทืงืืฅ ืคืื ืงืืืืึทื ืฅ ืืื ืืืืึทื ืืื ืืื ืขื ืขื ืงืึทืคึผืกืืืึทืืืึธื ืึทืืืขืงืืขื ืืืขื?
tcpdump host <ip ะบะปะธะตะฝัะฐ>
ื ืืื, ืขืก ืืขื ืขื ืืขืืืขื ื ืื ืึทืืึท ืคึผืึทืงืึทืืืฉืึทื ืืืืฃ ืื ืกืขืจืืืขืจ. ืึทืืื ืืขืจ ืคึผืจืึธืืืขื ืืืื ืืืื ืคืจืืขืจ. ืืขื ืขื ืืึธืจื ืคึผืึทืงืืืืฉืื ืืื ืืืืื ืืืืึทื ืขื ืงืึทืคึผืกืืืึทืืืึธื ืึทืืืขืงืืขื ืืืขื?
tcpdump ip[32:4]=0xx390x2xx
0xx390x2xx ืืื ืืขืจ ืงืืืขื ื ืก IP ืึทืืจืขืก ืืื ืืขืงืก ืคึฟืึธืจืืึทื.
32:4 ืืื ืื ืึทืืจืขืก ืืื ืืขื ื ืคืื ืื ืคืขืื ืืื ืืืึธืก ืื SCR IP ืืื ืืขืฉืจืืื ืืื ืื ืืื ืขื ืคึผืึทืงืึทื.
ืื ืึทืืจืขืก ืคืื ืื ืคืขืื ืืื ืฆื ืืืื ืืืืกืืขืงืืืื ืืืจื ืืจืื ืงืจืึทืคื, ืืืืึทื ืืืืฃ ืื ืืื ืืขืจื ืขื ืืื ืฉืจืืึทืื ืืืขืื 40, 44, 50, 54, ืึธืืขืจ ืขืก ืืื ืงืืื IP ืึทืืจืขืก ืืึธืจื. ืืืจ ืงืขื ื ืืืื ืงืืงื ืืื ืืืื ืขืจ ืคืื ืื ืคึผืึทืงืืฅ ืืื ืืขืงืก (ืคึผืึทืจืึทืืขืืขืจ -ืงืกืงืก ืึธืืขืจ -ืงืกืงืก ืืื tcpdump) ืืื ืจืขืืขื ืขื ืืื ืืืึธืก ืึทืืจืขืก ืื IP ืืืจ ืืืืกื ืืื.
ืืขื ืขื ืืึธืจื ืคึผืึทืงืึทื ืคืจืึทืืืึทื ืฅ ืึธื ืืืืึทื ืืื ืืื ื ืขื ืขื ืงืึทืคึผืกืืืึทืืืึธื ืึทืืืขืงืืขื ืืืขื?
tcpdump ((ip[6:2] > 0) and (not ip[6] = 64))
ืืขื ืืึทืืืฉ ืืืขื ืืืืึทืื ืืื ืื ืึทืืข ืื ืคืจืึทืืืึทื ืฅ, ืึทืจืืึทื ืืขืจืขืื ื ืื ืืขืฆืืข. ืืืกืืึธืืข, ืื ืืขืืืข ืงืขื ืขื ืืืื ืคืืืืขืจื ืืืจื IP, ืึธืืขืจ ืืื ืืื ื ืืฉื ืคึผืจืืืืจื, ืืืืึทื ืขืก ืืขื ืขื ื ืืฉื ืืืืขืจ ืคืืืข ืึทืืึท ืคึผืึทืงืืฅ, ืืื ืื ืืืึธืก ืืื ืืืจืฃ ืืขื ืขื ืืืืื ืืขืคึฟืื ืขื ืืื ืื ืึทืืืขืืืื ืข ืืืึทื. ืืึธ ืืื ืืขื ืขื:
14:02:58.471063 In 00:de:ff:1a:94:11 ethertype IPv4 (0x0800), length 1516: (tos 0x0, ttl 63, id 53652, offset 0, flags [+], proto IPIP (4), length 1500)
11.11.11.11 > 22.22.22.22: truncated-ip - 20 bytes missing! (tos 0x0, ttl 50, id 57750, offset 0, flags [DF], proto TCP (6), length 1500)
33.33.33.33.33333 > 44.44.44.44.80: Flags [.], seq 0:1448, ack 1, win 343, options [nop,nop,TS val 11660691 ecr 2998165860], length 1448
0x0000: 0000 0001 0006 00de fb1a 9441 0000 0800 ...........A....
0x0010: 4500 05dc d194 2000 3f09 d5fb 0a66 387d E.......?....f8}
0x0020: 1x67 7899 4500 06xx e198 4000 3206 6xx4 [email protected].
0x0030: b291 x9xx x345 2541 83b9 0050 9740 0x04 .......A...P.@..
0x0040: 6444 4939 8010 0257 8c3c 0000 0101 080x dDI9...W.......
0x0050: 00b1 ed93 b2b4 6964 xxd8 ffe1 006a 4578 ......ad.....jEx
0x0060: 6966 0000 4x4d 002a 0500 0008 0004 0100 if..MM.*........
14:02:58.471103 In 00:de:ff:1a:94:11 ethertype IPv4 (0x0800), length 62: (tos 0x0, ttl 63, id 53652, offset 1480, flags [none], proto IPIP (4), length 40)
11.11.11.11 > 22.22.22.22: ip-proto-4
0x0000: 0000 0001 0006 00de fb1a 9441 0000 0800 ...........A....
0x0010: 4500 0028 d194 00b9 3f04 faf6 2x76 385x E..(....?....f8}
0x0020: 1x76 6545 xxxx 1x11 2d2c 0c21 8016 8e43 .faE...D-,.!...C
0x0030: x978 e91d x9b0 d608 0000 0000 0000 7c31 .x............|Q
0x0040: 881d c4b6 0000 0000 0000 0000 0000 ..............
ืืึธืก ืืขื ืขื ืฆืืืื ืคืจืึทืืืึทื ืฅ ืคืื ืืืื ืคึผืขืงื (ืื ืืขืืืข ID 53652) ืืื ืึท ืคืึธืืึธืืจืึทืคืืข (ืืืจ ืงืขื ืขื ืืขื ืื ืืืึธืจื ืขืงืกืืฃ ืืื ืืขืจ ืขืจืฉืืขืจ ืคึผืขืงื). ืจืขืื ืฆื ืืขื ืคืึทืงื ืึทื ืขืก ืืขื ืขื ืคึผืึทืงืึทืืืฉืึทื ืืื ืืขื ืืืจืื, ืึธืืขืจ ื ืืฉื ืืื ืื ืืืื ืคืึธืจืขื ืืื ืื ืืึทืืคึผืก, ืื ืคึผืจืึธืืืขื ืืื ืงืืืจ ืืื ืื ืคึฟืึทืจืืึทืืืื ื. ืฆืื ืกืืฃ, ืขืก ืืื ืืึทืงืืืืขื ืืึทื ืืึธืื ืคืื ืืขื!
ืื ืคึผืึทืงืึทื ืืืงืึธืืืขืจ ืืื ื ืืฉื ืืขืืขืงื ืงืืื ืคืจืืืืขืืขื ืืืึธืก ืคึผืจืขืืืขื ืืื ื ืคึฟืึทืจืืึทืืืื ื. ืืขืคืจืืืืื ืืึธ: . ืืื ืขืจืฉืืขืจ, ืืืขื ืืจืืื ื ืฆื ืึธื ืคึผืึทืงื ืขืคึผืขืก ืืื ืขืก, ืื ืืืงืึธืืืขืจ ืืื ื ืืฉื ืืื ืื ืคึผืึทืงืึทื ืคึฟืึธืจืืึทื. ืขืก ืคืืจืงืขืจื ืืืืก ืึทื ืขืก ืืขื ืขื ืืขืืืขื ืขืืืขืืข ืขืงืกืืจืข ืฆืืืื ืึธืงืืขืฅ ืฆืืืืฉื Srcmac ืืื Ethertype (ื ืื ืฉืืื ืฆื ืคืจืึทืืืขื ื ืืื ืคึฟืึธืจืืึทืฆืืข). ื ืึธื ืจืืืืืืื ื ืืื, ืื ืืืงืึธืืืขืจ ืขืจื ื. ืึธืืขืจ, ืขืจ ืืื ืงืืื ืคืจืืืืขืืขื.
ืฐื ืก ืืข ื ืื ื ืืืื , ื ืื ืฅ ืืข ื ืืขืื ื ืกืืกื ื ืื ื ืืข ื ื ืืฉ ื ืืขืคืื ืข ื ืื ืืขืจืฉ . ืขืก ืืื ืืขืืืืื ืฆื ืืขืคึฟืื ืขื ืึท ืืืขื ืฆื ืืืขื ืืืคืืฆืืจื ืคึผืจืึธืืืขืืึทืืืง ืกืขืจืืืขืจืก ืืื ืกืืจ ืฆื ืคึฟืึทืจืฉืืืื ืื ืืืึธื ืืื ืืึทืฉืืืกื ืืืืฃ ืืืืึทืืขืจ ืึทืงืฉืึทื ื. ืืื ืืื ืืขืฉืืืื ื ืืขืคืื ืขื ืื ืจืขืื ืืึธืืืึทื ืง:
netstat -s | grep "packet reassembles failedโ
ืขืก ืืื ืืืื ืืื snmpd ืืื ืืขืจ OID = 1.3.6.1.2.1.4.31.1.1.16.1 ().
"ืื ื ืืืขืจ ืคืื ืคืืืืืขืจื ืืืืขืงืืึทื ืืืจื ืื IP ืฉืืึทืขื-ืคึฟืึทืจืืึทืืืื ื ืึทืืืขืจืืืึทื (ืคึฟืึทืจ ืืืขืืืขืจ ืกืืื: ืืืืื ืืืืก, ืขืจืจืึธืจืก, ืืื"ื ื)".
ืฆืืืืฉื ืื ืืจืืคืข ืกืขืจืืืขืจืก ืืืืฃ ืืืขืืืข ืืขื ืืื ืฉืืืืืจื ืื ืคืจืืืืขื, ืืื ืืืืฃ ืฆืืืื ืืขืจ ืงืื ืืขืจ ืฉื ืขืืขืจ ืืขืฉืืืื, ืืืืฃ ืฆืืืื ืืื ืืืื, ืืื ืืืืฃ ื ืื ืฆืืืื ืืื ืขืก ืืืจ ื ืืฉื ืืขืฉืืืื. ืงืึทืืคึผืขืจืื ื ืื ืืื ืึทืืืง ืคืื ืืขื ืืึธืืืึทื ืง ืืื ืื ืืื ืึทืืืง ืคืื ืืืืคึผ ืขืจืจืึธืจืก ืืืืฃ ืื Java ืกืขืจืืืขืจ ืืืืื ืึท ืงืึธืจืึทืืืืฉืึทื. ืึทื ืืื, ืื ืืึธืืืึทื ืง ืงืขื ืืืื ืฉืืขืื ืืืืฃ ืืึธื ืืืึธืจืื ื.
ืขืก ืืื ืืืืขืจ ืืืืืืืง ืฆื ืืึธืื ืึท ืคืึทืจืืึธืืืขื ืื ืืืงืึทืืึธืจ ืคืื ืคึผืจืึธืืืขืืก, ืึทืืื ืืืจ ืงืขื ืขื ืึทืงืืขืจืึทืืื ืืึทืฉืืืกื ืฆื ืึท Sysctl ืจืึธืืืืึทืง ืืขืืคึผืก, ืืื ืืืจ ืืืืกื ืคืื ืื ืคืจืืขืจืืืงืข ืืขืฉืืืืข ืึทื ืืึธืก ืงืขื ื ืืฉื ืืืื ืืืืื ืคืืจืฉืืื ืขื ืคืื ืื ืึทืคึผืืึทืงืืืฉืึทื. ืืขืจ ืืจืืื ืืืขื ืืึธืื ืืืจ ืฆื ืืืขื ืืืคืืฆืืจื ืึทืืข ืคึผืจืึธืืืขื ืืขืืืื ืืื ืคึผืจืึธืืืงืฆืืข ืืืืืขืจ ืื ื ืืฆืขืจืก ืืขืคึฟืื ืขื ืขืก.
ื ืึธื ืจืึธืืืื ื ืฆืืจืืง Sysctl, ืื ืืึธื ืืืึธืจืื ื ืขืจืจืึธืจืก ืคืืจืฉืืืคื, ืึทืืื ืื ืืจืื ื ืคืื ืื ืคืจืืืืขืืขื ืืื ืคึผืจืึธืืืขื, ืืื ืืขืืื ื ืืื ืื ืคืึทืงื ืึทื ืื ืจืึธืืืืึทืง ืืขืืคึผืก.
ืืืจ ืจืึธืืื ืฆืืจืืง ืื ืคืจืึทืืืึทื ืืืืฉืึทื ืกืขืืืื ืืก ืืืืฃ ืื ืืขืจืข ืกืขืจืืืขืจืก ืืื ืื ื ืืึท ืืึธื ืืืึธืจืื ื ืืขืืืคื ืคืืึทืขืจ, ืืื ืขืจืืขืฅ ืืคืืื ืืขืจ ืืึผืจืื ืืื ืึทืืึทืงืืืืื ืคึฟืึทืจ ืคืจืึทืืืึทื ืฅ ืืื ืืื ืืขืืืขื ืื ืคืขืืืงืืึทื ืคืจืืขืจ (ืืึธืก ืืื ืืขืืืขื ืืืคึผ ืกืืึทืืืกืืืง, ืืขืจ ืคึผืึทืจืืืืืฉ ืึธื ืืืขืจ ืคืื ืืืึธืก ืืื ื ืืฉื ืืืืขืจืงื ืงืขืื ืื ืึทืืืขืืืื ืข ืืื ืืขืจืืจืื ื).
ืื ืืขืจืกื ืืืืืืืง ืคืจืืืขืก
ืคืืจืืืืก ืืขื ืขื ืคึผืึทืงืืฅ ืคืจืึทืืืึทื ืืื ืืืืฃ ืืื ืืืขืจ ื 3 ืืึทืืึทื ืกืขืจ? ืจืืึฟ ืคืื ืื ืคึผืึทืงืืฅ ืืืึธืก ืงืืืขื ืคึฟืื ืืืืขืจื ืฆื ืืึทืืึทื ืกืขืจื ืืขื ืขื SYN ืืื ACK. ืื ืคึผืึทืงืึทืืืฉืึทื ืืขื ืขื ืงืืืื. ืืืขืจ ืืื ื ืื ืืืืื ืคืื ืึทืืึท ืคึผืึทืงืึทืืืฉืึทื ืืื ืืืืขืจ ืืจืืืก, ืงืขืื ืืืืขืจ ืืื ืืขืจืืจืื ื ืืืจ ืืึธืื ื ืืฉื ืืืืขืจืงื ืื ืืืึทืืืึทื ืคืื ืืจืืืก ืคึผืึทืงืึทืืืฉืึทื ืืืึธืก ืื ืืขืืืืื ืฆื ืคืจืึทืืืขื ื.
ืื ืกืืื ืืื ืืขืืืขื ืึท ืฆืขืืจืืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืฉืจืืคื ืืืืฃ ืกืขืจืืืขืจืก ืืื Vlan ืื ืืขืจืคืืืกืื (ืืื ืืขืจ ืฆืืื ืขืก ืืขื ืขื ืืขืืืขื ืืืืขืจ ืืืืื ืืง ืกืขืจืืืขืจืก ืืื ืืึทืื ืคืึทืจืงืขืจ ืืื ืคึผืจืึธืืืงืฆืืข). Advmss ืึทืืึทืื ืืืจ ืฆื ืงืึทื ืืืื ืฆื ืืขื ืงืืืขื ื ืืื ืคึฟืึธืจืืึทืฆืืข ืึทื ืคึผืึทืงืืฅ ืืื ืืื ืืืขืจ ืจืืืืื ื ืืึธื ืืืื ืงืืขื ืขืจืขืจ ืึทืืื ืึทื ื ืึธื ืืืืื ื ืืื ืขื ืืขืืขืจื ืฆื ืืื, ืืื ืืึธื ื ืื ืืึธืื ืฆื ืืืื ืคืจืึทืืืึทื ืืื.
ืคืืจืืืืก ืืื Sysctl ืจืึธืืืืึทืง ื ืืฉื ืืขืืึธืืคึฟื, ืึธืืขืจ ืจืขืืึธืึธื ืืขืืึธืืคึฟื? Sysctl ืจืึธืืืืึทืง ืืฉืืื ืืืฉื ืื ืกืืืข ืคืื โโโโืืืงืึธืจื ืื ืืืฆื ืคึฟืึทืจ ืืืืื ื ืคึผืึทืงืืฅ. ืืื ืืขืจ ืืขืืืืงืขืจ ืฆืืื, ืืฉืืขืืช, ืื ืขืฆื ืคืึทืงื ืคืื ืืึผืจืื ืึธืืืืขืจืคืืืก ืคึฟืึทืจ ืคืจืึทืืืึทื ืฅ ืืขืคืืจื ืฆื ืื ืกืืึธืืืึทืื ืคืื ืงืึทื ืขืงืฉืึทื ื, ืืืึธืก ืืขืคึฟืืจื ืฆื ืื ืคืึทืงื ืึทื ืื ืคืจืึทืืืึทื ืฅ ืืขื ืขื ืคืึทืจืืึทืืื ืืื ืื ืจืื ืคึฟืึทืจ ืึท ืืึทื ื ืฆืืึทื. ืืึธืก ืืืืกื, ืืขืจ ืคึผืจืึธืฆืขืก ืืื ืืืจืืืขืงืึธืื.
ืจืขืืึธืึธื ืืึทืฉืืขืืืง ืื ืืึผืจืื ืืื ืึทืืฅ ืืขืงืืืขื ืืื ืกืืจ.
ืืื ืขืก ืืขืืืขื ืฆื ืืึธื ืึธื ืืืึธืจืงืึทืจืึธืื ื? ืืึธ, ืึธืืขืจ ืขืก ืืื ืึท ืืืื ืจืืืืงืืจื ืฆื ืืึธืื ื ืืฆืขืจืก ืึธื ืืื ืกื ืืื ืื ืืขืฉืขืขื ืืฉ ืคืื ืึท ืืึทืคืึทืื. ืคืื ืงืืจืก, ืื ื ืืฆื ืคืื ืืืึธืจืงืึทืจืึธืื ื ืจืืืึทืืืื ืืื ืคืึทืจืฉืืื ืคึผืจืึธืืืขืืก, ืึทืจืืึทื ืืขืจืขืื ื ืื ืกืืึธืืืึทืื ืคืื ืืืื ืขืจ ืคืื ืื ืกืขืจืืืืกืขืก ืคึฟืึทืจ ืืืืขืจื, ืึธืืขืจ ืคืื ืืขืกืืืืขืื, ืืืจ ืืืืืื ืึทื ืื ืึทืงืฉืึทื ื ืืขื ืขื ืืขืจืขืืืคืืจืืืงื.
ืคืืืข ืืึทื ืง ืฆื ืึทื ืืจืื ืืืืึธืคืขืขืื () ืคื ืจ ืืฒืข ืจ ืืื ืฃ ืืฒ ื ืืืจืืคืืจ ื ื ื ืืืืกืคืืจืฉืื ื , ืฐ ื ืืื ื ืืืขืงืกืื ืงืจืขื ืขืื () - ืคึฟืึทืจ ืื ืืืืึทื ืืง ืึทืจืืขื ืืืืฃ ืึทืคึผืืืืืื ื ืกืขื ืืึธืก ืืื ืงืึธืจืขืก ืืืืฃ ืกืขืจืืืขืจืก. ื ืคืจืืฆืขืก , ืืื ื ืื ื ืืข ื ืคืื , ืื ื ืืข ื ืขืืืขื ืข ืื ื ืืขืืืจืค ื ืื ืืืืื , ืืื ืก ืื ื ืื ื ืื ืืขืฉืืขืค ื ื ืก ื ืืื ืืื .
ืืงืืจ: www.habr.com