实例分析如何在Netfilter中跟踪FTP数据流

HereItIs

How conntrack works in Netfilter(Part 2 - How to track FTP connections)

本文档基于Linux2.6.30内核，版权归hereitis所有，可以自由拷贝/转载，转载时请保持文档的完整性并且注明来源,禁止用于任何商业用途。
Blog:http://blog.chinaunix.net/u3/110948/
Email:hereitis.cu@gmail.com
http://blog.chinaunix.net/u3/110948/showart.php?id=2166655

   1. Initialization
         1. nf_conntrack_ftp_init(net/netfilter/nf_conntrack_ftp.c)

1. static int __init nf_conntrack_ftp_init(void)
   
2. {
   
3.     int i, j = -1, ret = 0;
   
4.     char *tmpname;
   
5. 
   
6.     ftp_buffer = kmalloc(65536, GFP_KERNEL);
   
7.     if (!ftp_buffer)
   
8.         return -ENOMEM;
   
9. 
   
10.     if (ports_c == 0) // static unsigned int ports_c;
    
11.         ports[ports_c++] = FTP_PORT; //static u_int16_t ports[MAX_PORTS];
    
12. 
    
13.     /* FIXME should be configurable whether IPv4 and IPv6 FTP connections
    
14.          are tracked or not - YK */
    
15.     for (i = 0; i < ports_c; i++) {
    
16.         ftp[i][0].tuple.src.l3num = PF_INET;// Will be used when hash tuple
    
17.         ftp[i][1].tuple.src.l3num = PF_INET6;
    
18.         for (j = 0; j < 2; j++) {
    
19.             ftp[i][j].tuple.src.u.tcp.port = htons(ports[i]); // Will be used when hash tuple
    
20.             ftp[i][j].tuple.dst.protonum = IPPROTO_TCP; // Will be used when hash tuple
    
21.             ftp[i][j].expect_policy = &ftp_exp_policy;
    
22.             ftp[i][j].me = THIS_MODULE;
    
23.             ftp[i][j].help = help;
    
24.             tmpname = &ftp_names[i][j][0];
    
25.             if (ports[i] == FTP_PORT)
    
26.                 sprintf(tmpname, "ftp");
    
27.             else
    
28.                 sprintf(tmpname, "ftp-%d", ports[i]);
    
29.             ftp[i][j].name = tmpname;
    
30. 
    
31.             pr_debug("nf_ct_ftp: registering helper for pf: %d "
    
32.                  "port: %d\n",
    
33.                  ftp[i][j].tuple.src.l3num, ports[i]);
    
34.             ret = nf_conntrack_helper_register(&ftp[i][j]);
    
35.             if (ret) {
    
36.                 printk("nf_ct_ftp: failed to register helper "
    
37.                        " for pf: %d port: %d\n",
    
38.                     ftp[i][j].tuple.src.l3num, ports[i]);
    
39.                 nf_conntrack_ftp_fini();
    
40.                 return ret;
    
41.             }
    
42.         }
    
43.     }
    
44. 
    
45.     return 0;
    
46. }
    

复制代码

2. nf_conntrack_helper_register(net/netfilter/nf_conntrack_helper.c)

1. int nf_conntrack_helper_register(struct nf_conntrack_helper *me)
   
2. {
   
3.     unsigned int h = helper_hash(&me->tuple);
   
4. 
   
5.     BUG_ON(me->expect_policy == NULL);
   
6.     BUG_ON(me->expect_class_max >= NF_CT_MAX_EXPECT_CLASSES);
   
7.     BUG_ON(strlen(me->name) > NF_CT_HELPER_NAME_LEN - 1);
   
8. 
   
9.     mutex_lock(&nf_ct_helper_mutex);
   
10.     hlist_add_head_rcu(&me->hnode, &nf_ct_helper_hash[h]); // Global helper list
    
11.     nf_ct_helper_count++;
    
12.     mutex_unlock(&nf_ct_helper_mutex);
    
13. 
    
14.     return 0;
    
15. }

复制代码

3. helper_hash(net/netfilter/nf_conntrack_helper.c)

1. /* Stupid hash, but collision free for the default registrations of the
   
2. * helpers currently in the kernel. */
   
3. static unsigned int helper_hash(const struct nf_conntrack_tuple *tuple)
   
4. {
   
5.     return (((tuple->src.l3num << 8) | tuple->dst.protonum) ^
   
6.         (__force __u16)tuple->src.u.all) % nf_ct_helper_hsize;
   
7. }

复制代码

4. How ftp helper registered


   2. How ftp helper works
         1. Big picture



         2. Main helper function(net/netfilter/nf_conntrack_ftp.c)

1. static int help(struct sk_buff *skb,
   
2.         unsigned int protoff,
   
3.         struct nf_conn *ct,
   
4.         enum ip_conntrack_info ctinfo)
   
5. {
   
6.     unsigned int dataoff, datalen;
   
7.     const struct tcphdr *th;
   
8.     struct tcphdr _tcph;
   
9.     const char *fb_ptr;
   
10.     int ret;
    
11.     u32 seq;
    
12.     int dir = CTINFO2DIR(ctinfo);
    
13.     unsigned int uninitialized_var(matchlen), uninitialized_var(matchoff);
    
14.     struct nf_ct_ftp_master *ct_ftp_info = &nfct_help(ct)->help.ct_ftp_info;
    
15.     struct nf_conntrack_expect *exp;
    
16.     union nf_inet_addr *daddr;
    
17.     struct nf_conntrack_man cmd = {};
    
18.     unsigned int i;
    
19.     int found = 0, ends_in_nl;
    
20.     typeof(nf_nat_ftp_hook) nf_nat_ftp;
    
21. 
    
22.     /* Until there's been traffic both ways, don't look in packets. */
    
23.     if (ctinfo != IP_CT_ESTABLISHED
    
24.         && ctinfo != IP_CT_ESTABLISHED+IP_CT_IS_REPLY) {
    
25.         pr_debug("ftp: Conntrackinfo = %u\n", ctinfo);
    
26.         return NF_ACCEPT;
    
27.     }
    
28. 
    
29.     th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
    
30.     if (th == NULL)
    
31.         return NF_ACCEPT;
    
32. 
    
33.     dataoff = protoff + th->doff * 4;
    
34.     /* No data? */
    
35.     if (dataoff >= skb->len) {
    
36.         pr_debug("ftp: dataoff(%u) >= skblen(%u)\n", dataoff,
    
37.              skb->len);
    
38.         return NF_ACCEPT;
    
39.     }
    
40.     datalen = skb->len - dataoff;
    
41. 
    
42.     spin_lock_bh(&nf_ftp_lock);
    
43.     fb_ptr = skb_header_pointer(skb, dataoff, datalen, ftp_buffer);
    
44.     BUG_ON(fb_ptr == NULL);
    
45. 
    
46.     ends_in_nl = (fb_ptr[datalen - 1] == '\n');
    
47.     seq = ntohl(th->seq) + datalen;
    
48. 
    
49.     /* Look up to see if we're just after a \n. */
    
50.     if (!find_nl_seq(ntohl(th->seq), ct_ftp_info, dir)) {
    
51.         /* Now if this ends in \n, update ftp info. */
    
52.         pr_debug("nf_conntrack_ftp: wrong seq pos %s(%u) or %s(%u)\n",
    
53.              ct_ftp_info->seq_aft_nl_num[dir] > 0 ? "" : "(UNSET)",
    
54.              ct_ftp_info->seq_aft_nl[dir][0],
    
55.              ct_ftp_info->seq_aft_nl_num[dir] > 1 ? "" : "(UNSET)",
    
56.              ct_ftp_info->seq_aft_nl[dir][1]);
    
57.         ret = NF_ACCEPT;
    
58.         goto out_update_nl;
    
59.     }
    
60. 
    
61.     /* Initialize IP/IPv6 addr to expected address (it's not mentioned
    
62.        in EPSV responses) */
    
63.     cmd.l3num = nf_ct_l3num(ct);
    
64.     memcpy(cmd.u3.all, &ct->tuplehash[dir].tuple.src.u3.all,
    
65.            sizeof(cmd.u3.all));
    
66. 
    
67.     for (i = 0; i < ARRAY_SIZE(search[dir]); i++) {
    
68.         found = find_pattern(fb_ptr, datalen,    // Try to find packet which trigger a ftp connection tracking
    
69.                      search[dir][i].pattern,
    
70.                      search[dir][i].plen,
    
71.                      search[dir][i].skip,
    
72.                      search[dir][i].term,
    
73.                      &matchoff, &matchlen,
    
74.                      &cmd,
    
75.                      search[dir][i].getnum);
    
76.         if (found) break;
    
77.     }
    
78.     if (found == -1) {
    
79.         /* We don't usually drop packets.  After all, this is
    
80.            connection tracking, not packet filtering.
    
81.            However, it is necessary for accurate tracking in
    
82.            this case. */
    
83.         pr_debug("conntrack_ftp: partial %s %u+%u\n",
    
84.              search[dir][i].pattern,  ntohl(th->seq), datalen);
    
85.         ret = NF_DROP;
    
86.         goto out;
    
87.     } else if (found == 0) { /* No match */
    
88.         ret = NF_ACCEPT;
    
89.         goto out_update_nl;
    
90.     }
    
91. 
    
92.     pr_debug("conntrack_ftp: match `%.*s' (%u bytes at %u)\n",
    
93.          matchlen, fb_ptr + matchoff,
    
94.          matchlen, ntohl(th->seq) + matchoff);
    
95. 
    
96.     exp = nf_ct_expect_alloc(ct);
    
97.     if (exp == NULL) {
    
98.         ret = NF_DROP;
    
99.         goto out;
    
100.     }
     
101. 
     
102.     /* We refer to the reverse direction ("!dir") tuples here,
     
103.      * because we're expecting something in the other direction.
     
104.      * Doesn't matter unless NAT is happening.  */
     
105.     daddr = &ct->tuplehash[!dir].tuple.dst.u3;
     
106. 
     
107.     /* Update the ftp info */
     
108.     if ((cmd.l3num == nf_ct_l3num(ct)) &&
     
109.         memcmp(&cmd.u3.all, &ct->tuplehash[dir].tuple.src.u3.all,
     
110.              sizeof(cmd.u3.all))) {
     
111.         /* Enrico Scholz's passive FTP to partially RNAT'd ftp
     
112.            server: it really wants us to connect to a
     
113.            different IP address.  Simply don't record it for
     
114.            NAT. */
     
115.         if (cmd.l3num == PF_INET) {
     
116.             pr_debug("conntrack_ftp: NOT RECORDING: %pI4 != %pI4\n",
     
117.                  &cmd.u3.ip,
     
118.                  &ct->tuplehash[dir].tuple.src.u3.ip);
     
119.         } else {
     
120.             pr_debug("conntrack_ftp: NOT RECORDING: %pI6 != %pI6\n",
     
121.                  cmd.u3.ip6,
     
122.                  ct->tuplehash[dir].tuple.src.u3.ip6);
     
123.         }
     
124. 
     
125.         /* Thanks to Cristiano Lincoln Mattos
     
126.            <[email]lincoln@cesar.org.br[/email]> for reporting this potential
     
127.            problem (DMZ machines opening holes to internal
     
128.            networks, or the packet filter itself). */
     
129.         if (!loose) {
     
130.             ret = NF_ACCEPT;
     
131.             goto out_put_expect;
     
132.         }
     
133.         daddr = &cmd.u3;
     
134.     }
     
135. 
     
136.     nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, cmd.l3num, // Setup expectation for this ftp connection
     
137.               &ct->tuplehash[!dir].tuple.src.u3, daddr,
     
138.               IPPROTO_TCP, NULL, &cmd.u.tcp.port);
     
139. 
     
140.     /* Now, NAT might want to mangle the packet, and register the
     
141.      * (possibly changed) expectation itself. */
     
142.     nf_nat_ftp = rcu_dereference(nf_nat_ftp_hook);
     
143.     if (nf_nat_ftp && ct->status & IPS_NAT_MASK)
     
144.         ret = nf_nat_ftp(skb, ctinfo, search[dir][i].ftptype,
     
145.                  matchoff, matchlen, exp);
     
146.     else {
     
147.         /* Can't expect this?  Best to drop packet now. */
     
148.         if (nf_ct_expect_related(exp) != 0)
     
149.             ret = NF_DROP;
     
150.         else
     
151.             ret = NF_ACCEPT;
     
152.     }
     
153. 
     
154. out_put_expect:
     
155.     nf_ct_expect_put(exp);
     
156. 
     
157. out_update_nl:
     
158.     /* Now if this ends in \n, update ftp info.  Seq may have been
     
159.      * adjusted by NAT code. */
     
160.     if (ends_in_nl)
     
161.         update_nl_seq(ct, seq, ct_ftp_info, dir, skb);
     
162. out:
     
163.     spin_unlock_bh(&nf_ftp_lock);
     
164.     return ret;
     
165. }

复制代码

3. Pattern search(net/netfilter/nf_conntrack_ftp.c)
         1. Structure

1. static struct ftp_search {
   
2.     const char *pattern;
   
3.     size_t plen;
   
4.     char skip;
   
5.     char term;
   
6.     enum nf_ct_ftp_type ftptype;
   
7.     int (*getnum)(const char *, size_t, struct nf_conntrack_man *, char);
   
8. } search[IP_CT_DIR_MAX][2] = { // 2 directions and 2 modes
   
9.     [IP_CT_DIR_ORIGINAL] = {
   
10.         {
    
11.             .pattern    = "PORT",
    
12.             .plen        = sizeof("PORT") - 1,
    
13.             .skip        = ' ',
    
14.             .term        = '\r',
    
15.             .ftptype    = NF_CT_FTP_PORT,
    
16.             .getnum        = try_rfc959,
    
17.         },
    
18.         {
    
19.             .pattern    = "EPRT",
    
20.             .plen        = sizeof("EPRT") - 1,
    
21.             .skip        = ' ',
    
22.             .term        = '\r',
    
23.             .ftptype    = NF_CT_FTP_EPRT,
    
24.             .getnum        = try_eprt,
    
25.         },
    
26.     },
    
27.     [IP_CT_DIR_REPLY] = {
    
28.         {
    
29.             .pattern    = "227 ",
    
30.             .plen        = sizeof("227 ") - 1,
    
31.             .skip        = '(',
    
32.             .term        = ')',
    
33.             .ftptype    = NF_CT_FTP_PASV,
    
34.             .getnum        = try_rfc959,
    
35.         },
    
36.         {
    
37.             .pattern    = "229 ",
    
38.             .plen        = sizeof("229 ") - 1,
    
39.             .skip        = '(',
    
40.             .term        = ')',
    
41.             .ftptype    = NF_CT_FTP_EPSV,
    
42.             .getnum        = try_epsv_response,
    
43.         },
    
44.     },
    
45. };

复制代码

2. try_rfc959(net/netfilter/nf_conntrack_ftp.c)

1. /* Returns 0, or length of numbers: 192,168,1,1,5,6 */
   
2. static int try_rfc959(const char *data, size_t dlen,
   
3.               struct nf_conntrack_man *cmd, char term)
   
4. {
   
5.     int length;
   
6.     u_int32_t array[6];
   
7. 
   
8.     length = try_number(data, dlen, array, 6, ',', term);
   
9.     if (length == 0)
   
10.         return 0;
    
11. 
    
12.     cmd->u3.ip =  htonl((array[0] << 24) | (array[1] << 16) |
    
13.                     (array[2] << 8) | array[3]);
    
14.     cmd->u.tcp.port = htons((array[4] << 8) | array[5]);
    
15.     return length;
    
16. }
    

复制代码

3. try_eprt(net/netfilter/nf_conntrack_ftp.c)

1. /* Returns 0, or length of numbers: |1|132.235.1.2|6275| or |2|3ffe::1|6275| */
   
2. static int try_eprt(const char *data, size_t dlen, struct nf_conntrack_man *cmd,
   
3.             char term)
   
4. {
   
5.     char delim;
   
6.     int length;
   
7. 
   
8.     /* First character is delimiter, then "1" for IPv4 or "2" for IPv6,
   
9.        then delimiter again. */
   
10.     if (dlen <= 3) {
    
11.         pr_debug("EPRT: too short\n");
    
12.         return 0;
    
13.     }
    
14.     delim = data[0];
    
15.     if (isdigit(delim) || delim < 33 || delim > 126 || data[2] != delim) {
    
16.         pr_debug("try_eprt: invalid delimitter.\n");
    
17.         return 0;
    
18.     }
    
19. 
    
20.     if ((cmd->l3num == PF_INET && data[1] != '1') ||
    
21.         (cmd->l3num == PF_INET6 && data[1] != '2')) {
    
22.         pr_debug("EPRT: invalid protocol number.\n");
    
23.         return 0;
    
24.     }
    
25. 
    
26.     pr_debug("EPRT: Got %c%c%c\n", delim, data[1], delim);
    
27. 
    
28.     if (data[1] == '1') {
    
29.         u_int32_t array[4];
    
30. 
    
31.         /* Now we have IP address. */
    
32.         length = try_number(data + 3, dlen - 3, array, 4, '.', delim);
    
33.         if (length != 0)
    
34.             cmd->u3.ip = htonl((array[0] << 24) | (array[1] << 16)
    
35.                        | (array[2] << 8) | array[3]);
    
36.     } else {
    
37.         /* Now we have IPv6 address. */
    
38.         length = get_ipv6_addr(data + 3, dlen - 3,
    
39.                        (struct in6_addr *)cmd->u3.ip6, delim);
    
40.     }
    
41. 
    
42.     if (length == 0)
    
43.         return 0;
    
44.     pr_debug("EPRT: Got IP address!\n");
    
45.     /* Start offset includes initial "|1|", and trailing delimiter */
    
46.     return get_port(data, 3 + length + 1, dlen, delim, &cmd->u.tcp.port);
    
47. }

复制代码

4. try_epsv_response(net/netfilter/nf_conntrack_ftp.c)

1. /* Returns 0, or length of numbers: |||6446| */
   
2. static int try_epsv_response(const char *data, size_t dlen,
   
3.                  struct nf_conntrack_man *cmd, char term)
   
4. {
   
5.     char delim;
   
6. 
   
7.     /* Three delimiters. */
   
8.     if (dlen <= 3) return 0;
   
9.     delim = data[0];
   
10.     if (isdigit(delim) || delim < 33 || delim > 126
    
11.         || data[1] != delim || data[2] != delim)
    
12.         return 0;
    
13. 
    
14.     return get_port(data, 3, dlen, delim, &cmd->u.tcp.port);
    
15. }

复制代码

5. nf_ct_expect_init(net/netfilter/nf_conntrack_expect.c)

1. void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
   
2.                u_int8_t family,
   
3.                const union nf_inet_addr *saddr,
   
4.                const union nf_inet_addr *daddr,
   
5.                u_int8_t proto, const __be16 *src, const __be16 *dst)
   
6. {
   
7.     int len;
   
8. 
   
9.     if (family == AF_INET)
   
10.         len = 4;
    
11.     else
    
12.         len = 16;
    
13. 
    
14.     exp->flags = 0;
    
15.     exp->class = class;
    
16.     exp->expectfn = NULL;
    
17.     exp->helper = NULL;
    
18.     exp->tuple.src.l3num = family;
    
19.     exp->tuple.dst.protonum = proto;
    
20. 
    
21.     if (saddr) {
    
22.         memcpy(&exp->tuple.src.u3, saddr, len);
    
23.         if (sizeof(exp->tuple.src.u3) > len)
    
24.             /* address needs to be cleared for nf_ct_tuple_equal */
    
25.             memset((void *)&exp->tuple.src.u3 + len, 0x00,
    
26.                    sizeof(exp->tuple.src.u3) - len);
    
27.         memset(&exp->mask.src.u3, 0xFF, len);
    
28.         if (sizeof(exp->mask.src.u3) > len)
    
29.             memset((void *)&exp->mask.src.u3 + len, 0x00,
    
30.                    sizeof(exp->mask.src.u3) - len);
    
31.     } else {
    
32.         memset(&exp->tuple.src.u3, 0x00, sizeof(exp->tuple.src.u3));
    
33.         memset(&exp->mask.src.u3, 0x00, sizeof(exp->mask.src.u3));
    
34.     }
    
35. 
    
36.     if (src) {
    
37.         exp->tuple.src.u.all = *src;
    
38.         exp->mask.src.u.all = htons(0xFFFF);
    
39.     } else {
    
40.         exp->tuple.src.u.all = 0;
    
41.         exp->mask.src.u.all = 0;
    
42.     }
    
43. 
    
44.     memcpy(&exp->tuple.dst.u3, daddr, len);
    
45.     if (sizeof(exp->tuple.dst.u3) > len)
    
46.         /* address needs to be cleared for nf_ct_tuple_equal */
    
47.         memset((void *)&exp->tuple.dst.u3 + len, 0x00,
    
48.                sizeof(exp->tuple.dst.u3) - len);
    
49. 
    
50.     exp->tuple.dst.u.all = *dst;
    
51. }
    
52. EXPORT_SYMBOL_GPL(nf_ct_expect_init);

复制代码

HereItIs

2. Let us take a real ftp traffic as an example
         1. The partial real ftp traffic

No.     Time        Source                Destination           Protocol Info
      1 0.000000    172.20.9.84           172.20.9.80           TCP      eportcomm > ftp [SYN] Seq=0 Win=65535 Len=0 MSS=1460

Frame 1 (62 bytes on wire, 62 bytes captured)
Internet Protocol, Src: 172.20.9.84 (172.20.9.84), Dst: 172.20.9.80 (172.20.9.80)
Transmission Control Protocol, Src Port: eportcomm (4666), Dst Port: ftp (21), Seq: 0, Len: 0

No.     Time        Source                Destination           Protocol Info
      2 0.000135    172.20.9.80           172.20.9.84           TCP      ftp > eportcomm [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1460

Frame 2 (62 bytes on wire, 62 bytes captured)
Internet Protocol, Src: 172.20.9.80 (172.20.9.80), Dst: 172.20.9.84 (172.20.9.84)
Transmission Control Protocol, Src Port: ftp (21), Dst Port: eportcomm (4666), Seq: 0, Ack: 1, Len: 0

No.     Time        Source                Destination           Protocol Info
      3 0.000152    172.20.9.84           172.20.9.80           TCP      eportcomm > ftp [ACK] Seq=1 Ack=1 Win=65535 Len=0

Frame 3 (54 bytes on wire, 54 bytes captured)
Internet Protocol, Src: 172.20.9.84 (172.20.9.84), Dst: 172.20.9.80 (172.20.9.80)
Transmission Control Protocol, Src Port: eportcomm (4666), Dst Port: ftp (21), Seq: 1, Ack: 1, Len: 0

No.     Time        Source                Destination           Protocol Info
      4 0.006313    172.20.9.80           172.20.9.84           FTP      Response: 220 Welcome to Test's FTP service.

Frame 4 (91 bytes on wire, 91 bytes captured)
Internet Protocol, Src: 172.20.9.80 (172.20.9.80), Dst: 172.20.9.84 (172.20.9.84)
Transmission Control Protocol, Src Port: ftp (21), Dst Port: eportcomm (4666), Seq: 1, Ack: 1, Len: 37
File Transfer Protocol (FTP)

...........

No.     Time        Source                Destination           Protocol Info
     12 8.471443    172.20.9.84           172.20.9.80           TCP      eportcomm > ftp [ACK] Seq=32 Ack=95 Win=65441 Len=0

Frame 12 (54 bytes on wire, 54 bytes captured)
Internet Protocol, Src: 172.20.9.84 (172.20.9.84), Dst: 172.20.9.80 (172.20.9.80)
Transmission Control Protocol, Src Port: eportcomm (4666), Dst Port: ftp (21), Seq: 32, Ack: 95, Len: 0

No.     Time        Source                Destination           Protocol Info
     13 10.124938   172.20.9.84           172.20.9.80           FTP      Request: PORT 172,20,9,84,18,67

Frame 13 (78 bytes on wire, 78 bytes captured)
Internet Protocol, Src: 172.20.9.84 (172.20.9.84), Dst: 172.20.9.80 (172.20.9.80)
Transmission Control Protocol, Src Port: eportcomm (4666), Dst Port: ftp (21), Seq: 32, Ack: 95, Len: 24
File Transfer Protocol (FTP)

No.     Time        Source                Destination           Protocol Info
     14 10.125258   172.20.9.80           172.20.9.84           FTP      Response: 200 PORT command successful. Consider using PASV.

Frame 14 (105 bytes on wire, 105 bytes captured)
Internet Protocol, Src: 172.20.9.80 (172.20.9.80), Dst: 172.20.9.84 (172.20.9.84)
Transmission Control Protocol, Src Port: ftp (21), Dst Port: eportcomm (4666), Seq: 95, Ack: 56, Len: 51
File Transfer Protocol (FTP)

No.     Time        Source                Destination           Protocol Info
     15 10.126652   172.20.9.84           172.20.9.80           FTP      Request: NLST

Frame 15 (60 bytes on wire, 60 bytes captured)
Internet Protocol, Src: 172.20.9.84 (172.20.9.84), Dst: 172.20.9.80 (172.20.9.80)
Transmission Control Protocol, Src Port: eportcomm (4666), Dst Port: ftp (21), Seq: 56, Ack: 146, Len: 6
File Transfer Protocol (FTP)

No.     Time        Source                Destination           Protocol Info
     16 10.127158   172.20.9.80           172.20.9.84           TCP      ftp-data > dhct-status [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=21742713 TSER=0 WS=5

Frame 16 (74 bytes on wire, 74 bytes captured)
Internet Protocol, Src: 172.20.9.80 (172.20.9.80), Dst: 172.20.9.84 (172.20.9.84)
Transmission Control Protocol, Src Port: ftp-data (20), Dst Port: dhct-status (4675), Seq: 0, Len: 0

No.     Time        Source                Destination           Protocol Info
     17 10.127192   172.20.9.84           172.20.9.80           TCP      dhct-status > ftp-data [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 WS=0 TSV=0 TSER=0

Frame 17 (78 bytes on wire, 78 bytes captured)
Internet Protocol, Src: 172.20.9.84 (172.20.9.84), Dst: 172.20.9.80 (172.20.9.80)
Transmission Control Protocol, Src Port: dhct-status (4675), Dst Port: ftp-data (20), Seq: 0, Ack: 1, Len: 0

No.     Time        Source                Destination           Protocol Info
     18 10.127311   172.20.9.80           172.20.9.84           TCP      ftp-data > dhct-status [ACK] Seq=1 Ack=1 Win=5856 Len=0 TSV=21742713 TSER=0

Frame 18 (66 bytes on wire, 66 bytes captured)
Internet Protocol, Src: 172.20.9.80 (172.20.9.80), Dst: 172.20.9.84 (172.20.9.84)
Transmission Control Protocol, Src Port: ftp-data (20), Dst Port: dhct-status (4675), Seq: 1, Ack: 1, Len: 0

No.     Time        Source                Destination           Protocol Info
     19 10.127412   172.20.9.80           172.20.9.84           FTP      Response: 150 Here comes the directory listing.

   2. Assume we are on 172.20.9.80(ftp server side), so hooks on point NF_INET_PRE_ROUTING and NF_INET_LOCAL_IN will be invoked.
         1. Big Picture

   2. What we got from Frame 1

No.     Time        Source                Destination           Protocol Info
      1 0.000000    172.20.9.84           172.20.9.80           TCP      eportcomm > ftp [SYN] Seq=0 Win=65535 Len=0 MSS=1460
Internet Protocol, Src: 172.20.9.84 (172.20.9.84), Dst: 172.20.9.80 (172.20.9.80)
Transmission Control Protocol, Src Port: eportcomm (4666), Dst Port: ftp (21), Seq: 0, Len: 0







   3. What we got from Frame 2

No.     Time        Source                Destination           Protocol Info
     2 0.000135    172.20.9.80           172.20.9.84           TCP      ftp> eportcomm [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1460

Frame 2 (62 bytes on wire, 62 bytes captured)
Internet Protocol, Src: 172.20.9.80 (172.20.9.80), Dst: 172.20.9.84 (172.20.9.84)
Transmission Control Protocol, Src Port: ftp (21), Dst Port: eportcomm (4666), Seq: 0, Ack: 1, Len: 0

   4. What we got from Frame 13

No.     Time        Source                Destination           Protocol Info
     13 10.124938   172.20.9.84           172.20.9.80           FTP      Request: PORT 172,20,9,84,18,67

Frame 13 (78 bytes on wire, 78 bytes captured)
Internet Protocol, Src: 172.20.9.84 (172.20.9.84), Dst: 172.20.9.80 (172.20.9.80)
Transmission Control Protocol, Src Port: eportcomm (4666), Dst Port: ftp (21), Seq: 32, Ack: 95, Len: 24
File Transfer Protocol (FTP)


   5. What we got from Frame 16

No.     Time        Source                Destination           Protocol Info
    16 10.127158   172.20.9.80           172.20.9.84           TCP     ftp-data > dhct-status [SYN] Seq=0 Win=5840 Len=0 MSS=1460TSV=21742713 TSER=0 WS=5

Frame 16 (74 bytes on wire, 74 bytes captured)
Internet Protocol, Src: 172.20.9.80 (172.20.9.80), Dst: 172.20.9.84 (172.20.9.84)
Transmission Control Protocol, Src Port: ftp-data (20), Dst Port: dhct-status (4675), Seq: 0, Len: 0


   Now, all connection tracking data structures for this FTP traffic are constructed and followed traffic in this flow will be tracked with this data structure.

cjhacker

能给个pdf或word的嘛

Godbach

多谢LZ分享。

jjj137

又是精品文章一篇……

cjhacker

我很想知道这个图是拿什么画的

Godbach

WIN下的Visio可以做出这样的效果

nu_teller

这个要顶一下

lsmushroom10

好帖子啊，顶

lsmushroom10

能否整理下提供源码的下载啊