正文

Wireshark & Packetdrill | TCP Delayed ACK（2）

admin
admin V管理员 /0 评论 /9 阅读
1027
文章最后更新时间2025年10月27日，若文章内容或图片失效，请留言反馈！

ACK 要么Quick 要么Delay 

实验目的

基于 packetdrill TCP 三次握手脚本，通过构造模拟服务器端场景，继续研究测试 TCP Delayed ACK 现象。

基础脚本

# cat tcp_delayed_ack_000.pkt 0   socket(..., SOCK_STREAM, IPPROTO_TCP) = 3+0  setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0+0  bind(3, ..., ...) = 0+0  listen(3, 1) = 0+0 < S 0:0(0) win 10000 <mss 1000>+0 > S. 0:0(0) ack 1 <...>+0.01 < . 1:1(0) ack 1 win 10000+0 accept(3, ..., ...) = 4#

TCP Delayed ACK

TCP Delayed ACK（延迟确认）是一种为了减少网络中小数据包数量的优化机制。其核心原理是：当接收方收到数据后，它不会立即对每个收到的数据包单独发送 ACK（确认）数据包，而是等待一小段时间，期望在此期间有顺路的数据（比如应用层的响应）可以携带这个 ACK 一起发送给对方。如果在超时前都没有数据要发送，则再单独发送 ACK 数据包。这样做的目的是提高网络带宽利用率，减少纯 ACK 数据包的数量。然而，它也可能在某些情况下增加延迟。Linux 在实现上有个延迟 ACK 定时器，它的定时时间保存在一个 ato 变量中，默认值是 40 ms，但是会动态调整，最大定时时间为 500ms。

基础测试

首先仍是一个基础示例，仅修改 MSS 为 150，脚本如下。

# cat tcp_delayed_ack_006.pkt 0   socket(..., SOCK_STREAM, IPPROTO_TCP) = 3+0  setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0+0  bind(3, ..., ...) = 0+0  listen(3, 1) = 0+0  < S 0:0(0) win 10000 <mss 150>+0  > S. 0:0(0) ack 1 <...>+0.01 < . 1:1(0) ack 1 win 10000+0 accept(3, ..., ...) = 4+0.01 < P. 1:101(100) ack 1 win 10000+0 < P. 101:201(100) ack 1 win 10000+0 < P. 201:301(100) ack 1 win 10000+0 < P. 301:401(100) ack 1 win 10000+0 < P. 401:501(100) ack 1 win 10000+0 < P. 501:601(100) ack 1 win 10000+0 < P. 601:701(100) ack 1 win 10000+0 < P. 701:801(100) ack 1 win 10000+0 < P. 801:901(100) ack 1 win 10000+0 < P. 901:1001(100) ack 1 win 10000+0 < P. 1001:1101(100) ack 1 win 10000+0 < P. 1101:1201(100) ack 1 win 10000+0 < P. 1201:1301(100) ack 1 win 10000+0 < P. 1301:1401(100) ack 1 win 10000+0 < P. 1401:1501(100) ack 1 win 10000+0 < P. 1501:1601(100) ack 1 win 10000+0 < P. 1601:1701(100) ack 1 win 10000+0 `sleep 1`#

通过 tcpdump 捕获数据包如下，可以看到在连续收到 16 个数据段后，服务器端都是立马响应 ACK 数据包，即 Quick ACK，而在收到第 17 个数据段 Seq 1601:1701 时，服务器所发送的 ACK 数据包变为了 Delayed ACK，间隔 40ms+。

# packetdrill tcp_delayed_ack_006.pkt## tcpdump -i any -nn port 8080tcpdump: data link type LINUX_SLL2tcpdump: verbose output suppressed, use -v[v]... for full protocol decodelistening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes14:27:43.497896 tun0  In  IP 192.0.2.1.51853 > 192.168.227.65.8080: Flags [S], seq 0, win 10000, options [mss 150], length 014:27:43.497930 tun0  Out IP 192.168.227.65.8080 > 192.0.2.1.51853: Flags [S.], seq 3061705794, ack 1, win 64240, options [mss 1460], length 014:27:43.508029 tun0  In  IP 192.0.2.1.51853 > 192.168.227.65.8080: Flags [.], ack 1, win 10000, length 014:27:43.518101 tun0  In  IP 192.0.2.1.51853 > 192.168.227.65.8080: Flags [P.], seq 1:101, ack 1, win 10000, length 100: HTTP14:27:43.518129 tun0  Out IP 192.168.227.65.8080 > 192.0.2.1.51853: Flags [.], ack 101, win 64140, length 014:27:43.518142 tun0  In  IP 192.0.2.1.51853 > 192.168.227.65.8080: Flags [P.], seq 101:201, ack 1, win 10000, length 100: HTTP14:27:43.518145 tun0  Out IP 192.168.227.65.8080 > 192.0.2.1.51853: Flags [.], ack 201, win 64050, length 014:27:43.518150 tun0  In  IP 192.0.2.1.51853 > 192.168.227.65.8080: Flags [P.], seq 201:301, ack 1, win 10000, length 100: HTTP14:27:43.518152 tun0  Out IP 192.168.227.65.8080 > 192.0.2.1.51853: Flags [.], ack 301, win 63950, length 014:27:43.518157 tun0  In  IP 192.0.2.1.51853 > 192.168.227.65.8080: Flags [P.], seq 301:401, ack 1, win 10000, length 100: HTTP14:27:43.518161 tun0  Out IP 192.168.227.65.8080 > 192.0.2.1.51853: Flags [.], ack 401, win 63850, length 014:27:43.518165 tun0  In  IP 192.0.2.1.51853 > 192.168.227.65.8080: Flags [P.], seq 401:501, ack 1, win 10000, length 100: HTTP14:27:43.518167 tun0  Out IP 192.168.227.65.8080 > 192.0.2.1.51853: Flags [.], ack 501, win 63750, length 014:27:43.518172 tun0  In  IP 192.0.2.1.51853 > 192.168.227.65.8080: Flags [P.], seq 501:601, ack 1, win 10000, length 100: HTTP14:27:43.518175 tun0  Out IP 192.168.227.65.8080 > 192.0.2.1.51853: Flags [.], ack 601, win 63650, length 014:27:43.518179 tun0  In  IP 192.0.2.1.51853 > 192.168.227.65.8080: Flags [P.], seq 601:701, ack 1, win 10000, length 100: HTTP14:27:43.518182 tun0  Out IP 192.168.227.65.8080 > 192.0.2.1.51853: Flags [.], ack 701, win 63550, length 014:27:43.518187 tun0  In  IP 192.0.2.1.51853 > 192.168.227.65.8080: Flags [P.], seq 701:801, ack 1, win 10000, length 100: HTTP14:27:43.518190 tun0  Out IP 192.168.227.65.8080 > 192.0.2.1.51853: Flags [.], ack 801, win 63450, length 014:27:43.518194 tun0  In  IP 192.0.2.1.51853 > 192.168.227.65.8080: Flags [P.], seq 801:901, ack 1, win 10000, length 100: HTTP14:27:43.518197 tun0  Out IP 192.168.227.65.8080 > 192.0.2.1.51853: Flags [.], ack 901, win 63350, length 014:27:43.518241 tun0  In  IP 192.0.2.1.51853 > 192.168.227.65.8080: Flags [P.], seq 901:1001, ack 1, win 10000, length 100: HTTP14:27:43.518243 tun0  Out IP 192.168.227.65.8080 > 192.0.2.1.51853: Flags [.], ack 1001, win 63250, length 014:27:43.518248 tun0  In  IP 192.0.2.1.51853 > 192.168.227.65.8080: Flags [P.], seq 1001:1101, ack 1, win 10000, length 100: HTTP14:27:43.518251 tun0  Out IP 192.168.227.65.8080 > 192.0.2.1.51853: Flags [.], ack 1101, win 63150, length 014:27:43.518255 tun0  In  IP 192.0.2.1.51853 > 192.168.227.65.8080: Flags [P.], seq 1101:1201, ack 1, win 10000, length 100: HTTP14:27:43.518258 tun0  Out IP 192.168.227.65.8080 > 192.0.2.1.51853: Flags [.], ack 1201, win 63050, length 014:27:43.518262 tun0  In  IP 192.0.2.1.51853 > 192.168.227.65.8080: Flags [P.], seq 1201:1301, ack 1, win 10000, length 100: HTTP14:27:43.518265 tun0  Out IP 192.168.227.65.8080 > 192.0.2.1.51853: Flags [.], ack 1301, win 62950, length 014:27:43.518269 tun0  In  IP 192.0.2.1.51853 > 192.168.227.65.8080: Flags [P.], seq 1301:1401, ack 1, win 10000, length 100: HTTP14:27:43.518272 tun0  Out IP 192.168.227.65.8080 > 192.0.2.1.51853: Flags [.], ack 1401, win 62850, length 014:27:43.518276 tun0  In  IP 192.0.2.1.51853 > 192.168.227.65.8080: Flags [P.], seq 1401:1501, ack 1, win 10000, length 100: HTTP14:27:43.518278 tun0  Out IP 192.168.227.65.8080 > 192.0.2.1.51853: Flags [.], ack 1501, win 62750, length 014:27:43.518282 tun0  In  IP 192.0.2.1.51853 > 192.168.227.65.8080: Flags [P.], seq 1501:1601, ack 1, win 10000, length 100: HTTP14:27:43.518285 tun0  Out IP 192.168.227.65.8080 > 192.0.2.1.51853: Flags [.], ack 1601, win 62650, length 014:27:43.518289 tun0  In  IP 192.0.2.1.51853 > 192.168.227.65.8080: Flags [P.], seq 1601:1701, ack 1, win 10000, length 100: HTTP14:27:43.561604 tun0  Out IP 192.168.227.65.8080 > 192.0.2.1.51853: Flags [.], ack 1701, win 62550, length 014:27:44.520409 ?     Out IP 192.168.227.65.8080 > 192.0.2.1.51853: Flags [R.], seq 1, ack 1701, win 64050, length 014:27:44.520455 ?     In  IP 192.0.2.1.51853 > 192.168.227.65.8080: Flags [R.], seq 1701, ack 1, win 10000, length 0#

增加一个分段，使得接收数据超出 MSS 150。

# cat tcp_delayed_ack_007.pkt 0   socket(..., SOCK_STREAM, IPPROTO_TCP) = 3+0  setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0+0  bind(3, ..., ...) = 0+0  listen(3, 1) = 0+0  < S 0:0(0) win 10000 <mss 150>+0  > S. 0:0(0) ack 1 <...>+0.01 < . 1:1(0) ack 1 win 10000+0 accept(3, ..., ...) = 4+0.01 < P. 1:101(100) ack 1 win 10000+0 < P. 101:201(100) ack 1 win 10000+0 < P. 201:301(100) ack 1 win 10000+0 < P. 301:401(100) ack 1 win 10000+0 < P. 401:501(100) ack 1 win 10000+0 < P. 501:601(100) ack 1 win 10000+0 < P. 601:701(100) ack 1 win 10000+0 < P. 701:801(100) ack 1 win 10000+0 < P. 801:901(100) ack 1 win 10000+0 < P. 901:1001(100) ack 1 win 10000+0 < P. 1001:1101(100) ack 1 win 10000+0 < P. 1101:1201(100) ack 1 win 10000+0 < P. 1201:1301(100) ack 1 win 10000+0 < P. 1301:1401(100) ack 1 win 10000+0 < P. 1401:1501(100) ack 1 win 10000+0 < P. 1501:1601(100) ack 1 win 10000+0 < P. 1601:1701(100) ack 1 win 10000+0 < P. 1701:1801(100) ack 1 win 10000+0 `sleep 1`#

通过 tcpdump 捕获数据包如下，可以看到在连续收到 16 个数据段后，服务器端都是立马响应 ACK 数据包，即 Quick ACK，而在收到第 17 个数据段 Seq 1601:1701 时，响应判断是 Delayed ACK，延迟发出，之后在收到第 18 个数据段 Seq 1701:1801 时，算上 Seq 1601:1701 和 1701:1801 各 100 字节总共 200 字节，理论应该超过了 MSS 150 字节的大小，但却没有立马发送 ACK，仍然是 Delayed ACK，间隔 40ms+。

# packetdrill tcp_delayed_ack_007.pkt## tcpdump -i any -nn port 8080tcpdump: data link type LINUX_SLL2tcpdump: verbose output suppressed, use -v[v]... for full protocol decodelistening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes14:29:43.309894 tun0  In  IP 192.0.2.1.38717 > 192.168.26.189.8080: Flags [S], seq 0, win 10000, options [mss 150], length 014:29:43.309928 tun0  Out IP 192.168.26.189.8080 > 192.0.2.1.38717: Flags [S.], seq 2069060169, ack 1, win 64240, options [mss 1460], length 014:29:43.320022 tun0  In  IP 192.0.2.1.38717 > 192.168.26.189.8080: Flags [.], ack 1, win 10000, length 014:29:43.330100 tun0  In  IP 192.0.2.1.38717 > 192.168.26.189.8080: Flags [P.], seq 1:101, ack 1, win 10000, length 100: HTTP14:29:43.330126 tun0  Out IP 192.168.26.189.8080 > 192.0.2.1.38717: Flags [.], ack 101, win 64140, length 014:29:43.330136 tun0  In  IP 192.0.2.1.38717 > 192.168.26.189.8080: Flags [P.], seq 101:201, ack 1, win 10000, length 100: HTTP14:29:43.330139 tun0  Out IP 192.168.26.189.8080 > 192.0.2.1.38717: Flags [.], ack 201, win 64050, length 014:29:43.330144 tun0  In  IP 192.0.2.1.38717 > 192.168.26.189.8080: Flags [P.], seq 201:301, ack 1, win 10000, length 100: HTTP14:29:43.330147 tun0  Out IP 192.168.26.189.8080 > 192.0.2.1.38717: Flags [.], ack 301, win 63950, length 014:29:43.330152 tun0  In  IP 192.0.2.1.38717 > 192.168.26.189.8080: Flags [P.], seq 301:401, ack 1, win 10000, length 100: HTTP14:29:43.330156 tun0  Out IP 192.168.26.189.8080 > 192.0.2.1.38717: Flags [.], ack 401, win 63850, length 014:29:43.330161 tun0  In  IP 192.0.2.1.38717 > 192.168.26.189.8080: Flags [P.], seq 401:501, ack 1, win 10000, length 100: HTTP14:29:43.330164 tun0  Out IP 192.168.26.189.8080 > 192.0.2.1.38717: Flags [.], ack 501, win 63750, length 014:29:43.330168 tun0  In  IP 192.0.2.1.38717 > 192.168.26.189.8080: Flags [P.], seq 501:601, ack 1, win 10000, length 100: HTTP14:29:43.330171 tun0  Out IP 192.168.26.189.8080 > 192.0.2.1.38717: Flags [.], ack 601, win 63650, length 014:29:43.330175 tun0  In  IP 192.0.2.1.38717 > 192.168.26.189.8080: Flags [P.], seq 601:701, ack 1, win 10000, length 100: HTTP14:29:43.330178 tun0  Out IP 192.168.26.189.8080 > 192.0.2.1.38717: Flags [.], ack 701, win 63550, length 014:29:43.330182 tun0  In  IP 192.0.2.1.38717 > 192.168.26.189.8080: Flags [P.], seq 701:801, ack 1, win 10000, length 100: HTTP14:29:43.330185 tun0  Out IP 192.168.26.189.8080 > 192.0.2.1.38717: Flags [.], ack 801, win 63450, length 014:29:43.330189 tun0  In  IP 192.0.2.1.38717 > 192.168.26.189.8080: Flags [P.], seq 801:901, ack 1, win 10000, length 100: HTTP14:29:43.330192 tun0  Out IP 192.168.26.189.8080 > 192.0.2.1.38717: Flags [.], ack 901, win 63350, length 014:29:43.330196 tun0  In  IP 192.0.2.1.38717 > 192.168.26.189.8080: Flags [P.], seq 901:1001, ack 1, win 10000, length 100: HTTP14:29:43.330198 tun0  Out IP 192.168.26.189.8080 > 192.0.2.1.38717: Flags [.], ack 1001, win 63250, length 014:29:43.330228 tun0  In  IP 192.0.2.1.38717 > 192.168.26.189.8080: Flags [P.], seq 1001:1101, ack 1, win 10000, length 100: HTTP14:29:43.330231 tun0  Out IP 192.168.26.189.8080 > 192.0.2.1.38717: Flags [.], ack 1101, win 63150, length 014:29:43.330235 tun0  In  IP 192.0.2.1.38717 > 192.168.26.189.8080: Flags [P.], seq 1101:1201, ack 1, win 10000, length 100: HTTP14:29:43.330238 tun0  Out IP 192.168.26.189.8080 > 192.0.2.1.38717: Flags [.], ack 1201, win 63050, length 014:29:43.330242 tun0  In  IP 192.0.2.1.38717 > 192.168.26.189.8080: Flags [P.], seq 1201:1301, ack 1, win 10000, length 100: HTTP14:29:43.330244 tun0  Out IP 192.168.26.189.8080 > 192.0.2.1.38717: Flags [.], ack 1301, win 62950, length 014:29:43.330249 tun0  In  IP 192.0.2.1.38717 > 192.168.26.189.8080: Flags [P.], seq 1301:1401, ack 1, win 10000, length 100: HTTP14:29:43.330251 tun0  Out IP 192.168.26.189.8080 > 192.0.2.1.38717: Flags [.], ack 1401, win 62850, length 014:29:43.330256 tun0  In  IP 192.0.2.1.38717 > 192.168.26.189.8080: Flags [P.], seq 1401:1501, ack 1, win 10000, length 100: HTTP14:29:43.330258 tun0  Out IP 192.168.26.189.8080 > 192.0.2.1.38717: Flags [.], ack 1501, win 62750, length 014:29:43.330262 tun0  In  IP 192.0.2.1.38717 > 192.168.26.189.8080: Flags [P.], seq 1501:1601, ack 1, win 10000, length 100: HTTP14:29:43.330264 tun0  Out IP 192.168.26.189.8080 > 192.0.2.1.38717: Flags [.], ack 1601, win 62650, length 014:29:43.330269 tun0  In  IP 192.0.2.1.38717 > 192.168.26.189.8080: Flags [P.], seq 1601:1701, ack 1, win 10000, length 100: HTTP14:29:43.330275 tun0  In  IP 192.0.2.1.38717 > 192.168.26.189.8080: Flags [P.], seq 1701:1801, ack 1, win 10000, length 100: HTTP14:29:43.373598 tun0  Out IP 192.168.26.189.8080 > 192.0.2.1.38717: Flags [.], ack 1801, win 62450, length 014:29:44.332169 ?     Out IP 192.168.26.189.8080 > 192.0.2.1.38717: Flags [R.], seq 1, ack 1801, win 64050, length 014:29:44.332209 ?     In  IP 192.0.2.1.38717 > 192.168.26.189.8080: Flags [R.], seq 1801, ack 1, win 10000, length 0#

为什么在超出 MSS 大小的情况下，仍然没有立马发出 ACK，可以在 __tcp_ack_snd_check() 函数中找到答案，关于超出 MSS 大小的条件 (tp->rcv_nxt - tp->rcv_wup) > inet_csk(sk)->icsk_ack.rcv_mss 只是其中一个，之后还要通过 &&（逻辑与）与后面的条件 (tp->rcv_nxt - tp->copied_seq < sk->sk_rcvlowat || __tcp_select_window(sk) >= tp->rcv_wnd) 进行判断。

而在这里的原因是 (tp->rcv_nxt - tp->copied_seq < sk->sk_rcvlowat || __tcp_select_window(sk) >= tp->rcv_wnd) 条件无法满足，为 0，也就是说未被读取的数据量大于应用的低水位标记，而且重新计算得到的接收窗口比当前已经通告的窗口小。

/* * Check if sending an ack is needed. */static void __tcp_ack_snd_check(struct sock *sk, int ofo_possible){  struct tcp_sock *tp = tcp_sk(sk);  unsigned long rtt, delay;    /* More than one full frame received... */  if (((tp->rcv_nxt - tp->rcv_wup) > inet_csk(sk)->icsk_ack.rcv_mss &&     /* ... and right edge of window advances far enough.      * (tcp_recvmsg() will send ACK otherwise).      * If application uses SO_RCVLOWAT, we want send ack now if      * we have not received enough bytes to satisfy the condition.      */    (tp->rcv_nxt - tp->copied_seq < sk->sk_rcvlowat ||     __tcp_select_window(sk) >= tp->rcv_wnd)) ||    /* We ACK each frame or... */    tcp_in_quickack_mode(sk) ||    /* Protocol state mandates a one-time immediate ACK */    inet_csk(sk)->icsk_ack.pending & ICSK_ACK_NOW) {  send_now:      tcp_send_ack(sk);      return;  }...}

考虑到 Window 窗口变化的原因，尝试增加 read() 测试，修改脚本如下。

# cat tcp_delayed_ack_008.pkt 0   socket(..., SOCK_STREAM, IPPROTO_TCP) = 3+0  setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0+0  bind(3, ..., ...) = 0+0  listen(3, 1) = 0+0  < S 0:0(0) win 10000 <mss 150>+0  > S. 0:0(0) ack 1 <...>+0.01 < . 1:1(0) ack 1 win 10000+0 accept(3, ..., ...) = 4+0.01 < P. 1:101(100) ack 1 win 10000+0 < P. 101:201(100) ack 1 win 10000+0 < P. 201:301(100) ack 1 win 10000+0 < P. 301:401(100) ack 1 win 10000+0 < P. 401:501(100) ack 1 win 10000+0 < P. 501:601(100) ack 1 win 10000+0 < P. 601:701(100) ack 1 win 10000+0 < P. 701:801(100) ack 1 win 10000+0 < P. 801:901(100) ack 1 win 10000+0 < P. 901:1001(100) ack 1 win 10000+0 < P. 1001:1101(100) ack 1 win 10000+0 < P. 1101:1201(100) ack 1 win 10000+0 < P. 1201:1301(100) ack 1 win 10000+0 < P. 1301:1401(100) ack 1 win 10000+0 < P. 1401:1501(100) ack 1 win 10000+0 < P. 1501:1601(100) ack 1 win 10000+0 read(4,...,1600) =1600+0 < P. 1601:1701(100) ack 1 win 10000+0 < P. 1701:1801(100) ack 1 win 10000+0 `sleep 1`#

通过 tcpdump 捕获数据包如下，可以看到在连续收到 16 个数据段后，服务器端都是立马响应 ACK 数据包，即 Quick ACK，而在收到第 17 个数据段 Seq 1601:1701 时，响应判断是 Delayed ACK，延迟发出。

上述没变化，但在收到第 18 个数据段 Seq 1701:1801 时，此时服务器所发送的 ACK 数据包又变为了 Quick ACK。在这里的原因是 (tp->rcv_nxt - tp->copied_seq < sk->sk_rcvlowat || __tcp_select_window(sk) >= tp->rcv_wnd) 条件满足，为 1，确切的说是 __tcp_select_window(sk) >= tp->rcv_wnd) 为 1 。

# packetdrill tcp_delayed_ack_008.pkt## tcpdump -i any -nn port 8080tcpdump: data link type LINUX_SLL2tcpdump: verbose output suppressed, use -v[v]... for full protocol decodelistening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes19:40:48.977884 tun0  In  IP 192.0.2.1.56173 > 192.168.64.135.8080: Flags [S], seq 0, win 10000, options [mss 150], length 019:40:48.977910 tun0  Out IP 192.168.64.135.8080 > 192.0.2.1.56173: Flags [S.], seq 1893775479, ack 1, win 64240, options [mss 1460], length 019:40:48.988008 tun0  In  IP 192.0.2.1.56173 > 192.168.64.135.8080: Flags [.], ack 1, win 10000, length 019:40:48.998116 tun0  In  IP 192.0.2.1.56173 > 192.168.64.135.8080: Flags [P.], seq 1:101, ack 1, win 10000, length 100: HTTP19:40:48.998141 tun0  Out IP 192.168.64.135.8080 > 192.0.2.1.56173: Flags [.], ack 101, win 64140, length 019:40:48.998152 tun0  In  IP 192.0.2.1.56173 > 192.168.64.135.8080: Flags [P.], seq 101:201, ack 1, win 10000, length 100: HTTP19:40:48.998156 tun0  Out IP 192.168.64.135.8080 > 192.0.2.1.56173: Flags [.], ack 201, win 64050, length 019:40:48.998160 tun0  In  IP 192.0.2.1.56173 > 192.168.64.135.8080: Flags [P.], seq 201:301, ack 1, win 10000, length 100: HTTP19:40:48.998165 tun0  Out IP 192.168.64.135.8080 > 192.0.2.1.56173: Flags [.], ack 301, win 63950, length 019:40:48.998170 tun0  In  IP 192.0.2.1.56173 > 192.168.64.135.8080: Flags [P.], seq 301:401, ack 1, win 10000, length 100: HTTP19:40:48.998174 tun0  Out IP 192.168.64.135.8080 > 192.0.2.1.56173: Flags [.], ack 401, win 63850, length 019:40:48.998177 tun0  In  IP 192.0.2.1.56173 > 192.168.64.135.8080: Flags [P.], seq 401:501, ack 1, win 10000, length 100: HTTP19:40:48.998179 tun0  Out IP 192.168.64.135.8080 > 192.0.2.1.56173: Flags [.], ack 501, win 63750, length 019:40:48.998183 tun0  In  IP 192.0.2.1.56173 > 192.168.64.135.8080: Flags [P.], seq 501:601, ack 1, win 10000, length 100: HTTP19:40:48.998185 tun0  Out IP 192.168.64.135.8080 > 192.0.2.1.56173: Flags [.], ack 601, win 63650, length 019:40:48.998188 tun0  In  IP 192.0.2.1.56173 > 192.168.64.135.8080: Flags [P.], seq 601:701, ack 1, win 10000, length 100: HTTP19:40:48.998190 tun0  Out IP 192.168.64.135.8080 > 192.0.2.1.56173: Flags [.], ack 701, win 63550, length 019:40:48.998193 tun0  In  IP 192.0.2.1.56173 > 192.168.64.135.8080: Flags [P.], seq 701:801, ack 1, win 10000, length 100: HTTP19:40:48.998195 tun0  Out IP 192.168.64.135.8080 > 192.0.2.1.56173: Flags [.], ack 801, win 63450, length 019:40:48.998198 tun0  In  IP 192.0.2.1.56173 > 192.168.64.135.8080: Flags [P.], seq 801:901, ack 1, win 10000, length 100: HTTP19:40:48.998200 tun0  Out IP 192.168.64.135.8080 > 192.0.2.1.56173: Flags [.], ack 901, win 63350, length 019:40:48.998203 tun0  In  IP 192.0.2.1.56173 > 192.168.64.135.8080: Flags [P.], seq 901:1001, ack 1, win 10000, length 100: HTTP19:40:48.998205 tun0  Out IP 192.168.64.135.8080 > 192.0.2.1.56173: Flags [.], ack 1001, win 63250, length 019:40:48.998208 tun0  In  IP 192.0.2.1.56173 > 192.168.64.135.8080: Flags [P.], seq 1001:1101, ack 1, win 10000, length 100: HTTP19:40:48.998210 tun0  Out IP 192.168.64.135.8080 > 192.0.2.1.56173: Flags [.], ack 1101, win 63150, length 019:40:48.998213 tun0  In  IP 192.0.2.1.56173 > 192.168.64.135.8080: Flags [P.], seq 1101:1201, ack 1, win 10000, length 100: HTTP19:40:48.998215 tun0  Out IP 192.168.64.135.8080 > 192.0.2.1.56173: Flags [.], ack 1201, win 63050, length 019:40:48.998218 tun0  In  IP 192.0.2.1.56173 > 192.168.64.135.8080: Flags [P.], seq 1201:1301, ack 1, win 10000, length 100: HTTP19:40:48.998220 tun0  Out IP 192.168.64.135.8080 > 192.0.2.1.56173: Flags [.], ack 1301, win 62950, length 019:40:48.998223 tun0  In  IP 192.0.2.1.56173 > 192.168.64.135.8080: Flags [P.], seq 1301:1401, ack 1, win 10000, length 100: HTTP19:40:48.998225 tun0  Out IP 192.168.64.135.8080 > 192.0.2.1.56173: Flags [.], ack 1401, win 62850, length 019:40:48.998228 tun0  In  IP 192.0.2.1.56173 > 192.168.64.135.8080: Flags [P.], seq 1401:1501, ack 1, win 10000, length 100: HTTP19:40:48.998230 tun0  Out IP 192.168.64.135.8080 > 192.0.2.1.56173: Flags [.], ack 1501, win 62750, length 019:40:48.998233 tun0  In  IP 192.0.2.1.56173 > 192.168.64.135.8080: Flags [P.], seq 1501:1601, ack 1, win 10000, length 100: HTTP19:40:48.998237 tun0  Out IP 192.168.64.135.8080 > 192.0.2.1.56173: Flags [.], ack 1601, win 62650, length 019:40:48.998258 tun0  In  IP 192.0.2.1.56173 > 192.168.64.135.8080: Flags [P.], seq 1601:1701, ack 1, win 10000, length 100: HTTP19:40:48.998262 tun0  In  IP 192.0.2.1.56173 > 192.168.64.135.8080: Flags [P.], seq 1701:1801, ack 1, win 10000, length 100: HTTP19:40:48.998264 tun0  Out IP 192.168.64.135.8080 > 192.0.2.1.56173: Flags [.], ack 1801, win 64050, length 019:40:50.000418 ?     Out IP 192.168.64.135.8080 > 192.0.2.1.56173: Flags [R.], seq 1, ack 1801, win 64050, length 019:40:50.000444 ?     In  IP 192.0.2.1.56173 > 192.168.64.135.8080: Flags [R.], seq 1801, ack 1, win 10000, length 0#

往期推荐

后台回复「TT」获取 Wireshark 提示和技巧系列合集
后台回复「TS」获取 Wireshark Troubleshooting 系列合集
如需交流或加技术群，可后台直接留言，我会在第一时间回复，谢谢！


推荐站内搜索：最好用的开发软件、免费开源系统、渗透测试工具云盘下载、最新渗透测试资料、最新黑客工具下载……
宙飒天下网