TCP 流量分析 - (jianshu.com)
使用一台windows主机作为TCP Server,使用一台Linux作为TCP Client,发起TCP连接,发送数据,结束连接。
以下Python脚本通过Socket实现TCP Server端,接收TCP连接。
以下Python脚本通过Scapy实现TCP Client端,向Server端发起TCP连接。
首先在Windows主机上运行TCP Server脚本。
在linux主机上运行TCP Client脚本后,会将TCP交互过程打印出来。
通过科来的csna抓包,并追踪TCP流,如下为交互的数据包
#!/usr/bin/env python# -*- coding: utf-8 -*-
from scapy.all import *
import os
import time
def get_sip():
return "192.168.91.2"
#generate normal packet: packet type is syn
def gen_np_syn(dst,dport,sport=20,seq=11111):
ip=IP(dst=dst,src=get_sip())
tcp=TCP(sport=sport,dport=dport,seq=seq,flags='S')
#hexdump(tcp)
p = ip/tcp
p.display()
return p
#generate normal packet: packet type is push+ack
def gen_np_pushack(dst,dport,seq ,ack ,sport=20):
ip=IP(dst=dst,src=get_sip())
#tcp=TCP(sport=sport,dport=dport,seq=seq,ack=ack,flags='PA',chksum=90)
tcp=TCP(sport=sport,dport=dport,seq=seq,ack=ack,flags='PA')
data="GET / HTTP/1.1\r\nUser-Agent: Microsoft-ATL-Native/8.00\r\n\r\n"
p = ip/tcp/data
p.display()
return p
#generate normal packet: packet type is ack
def gen_np_ack(dst,dport,seq ,ack ,sport=20):
ip=IP(dst=dst,src=get_sip())
tcp=TCP(sport=sport, dport=dport,seq=seq, ack=ack,flags='A')
p = ip/tcp
p.show()
return p
#generate normal packet: packet type is fin
def gen_np_fin(dst,dport,seq ,ack ,sport=20):
ip=IP(dst=dst,src=get_sip())
tcp=TCP(sport=sport,dport=dport,seq=seq,ack=ack,flags='FA')
p = ip/tcp
p.show()
return p
def reuse(push=True,fin=False):
#dip='123.123.167.100'
dip='192.168.91.6'
dport=30001
#sport=random.randint(10000,60000)
sport=28274
seq = random.randint(10000,60000)
os.popen('iptables -A OUTPUT -p tcp --dport %d --tcp-flag RST RST --dst %s -j DROP' %(dport, dip))
np_s=gen_np_syn(dip,dport,sport,seq)
res_sa = sr1(np_s)
res_sa.display()
if push:
np_pa=gen_np_pushack(dip,dport,res_sa.ack,res_sa.seq+1,sport)
else:
np_pa=gen_np_ack(dip,dport,res_sa.ack,res_sa.seq+1,sport)
res_pa = send(np_pa)
if fin:
np_fa=gen_np_fin(dip,dport,res_sa.ack,res_sa.seq+1,sport)
send(np_fa)
os.popen('iptables -D OUTPUT -p tcp --dport %d --tcp-flag RST RST --dst %s -j DROP' %(dport, dip))
def main():
#reuse(False,True)
#time.sleep(1)
i = 0
while i <20:
i += 1
reuse(True,True)
time.sleep(1)
if __name__ == "__main__":
main()