linux tcp packet capture

1. Tools

yum install nc tcpdump -y
installs nc and tcpdump tools

2. Start the service (do not run the command first)

• Open the listening port

1. Open a server listening port, -l means listen listening
2. nc -l localhost 8088
3. 

• open client

1. nc localhost 8088 (the client does not need to listen, and does not need the -l parameter)
2. 

• tcpdump enables monitoring

1. tcpdump -nn -i lo port 8088  
2. 

3. -nn: Specifies to convert the domain name in each monitored data packet into IP, and the port is displayed after converting the application name into a port number

4. -i: Specify the network interface to monitor, parameter value lo: capture the packet of the loopback network port

3. run

1. Execute the packet capture command and find that no data is monitored (the packet capture program does not capture data blocking)

2. Execute the command to monitor port 8088, and found that it is also blocked,,,, at this time, it is listening to port 8088

3. Run the client command and send data to port 8088

After running, I found that xshell has changed here, and there is an extra exclamation point

Open and find data

ACK confirms protocol establishment.

The process of three-way handshake shows that the two characteristics of tcp are connection-oriented and reliable (ack)

4. Disconnect

• waved four times

• [F] initiated by the first client means finish
• The server replies [.] on behalf of the server to receive ack confirmation
• Server initiates [F.] Server tells client to disconnect
• The client tells the server [.] to disconnect the ack