tcpdump输出的TCP三次握手的疑问

huopin

192.168.1.23连接192.168.1.191的ssh端口，已经输入用户名密码登录成功。在192.168.1.191上抓到如下信息。TCP三次握手只看到了前两行的两次，第三次握手哪去了？\r\n

1. \r\n17:29:53.123192 IP 192.168.1.23.1773 > 192.168.1.191.22: S 175077054:175077054(0) win 65535 <mss 1460,nop,nop,sackOK> (DF)\r\n17:29:53.123413 IP 192.168.1.191.22 > 192.168.1.23.1773: S 4240709886:4240709886(0) ack 175077055 win 5840 <mss 1460,nop,nop,sackOK> (DF)\r\n17:29:53.123443 IP 192.168.1.23.1773 > 192.168.1.191.22: . ack 1 win 65535 (DF)\r\n17:29:53.146923 IP 192.168.1.191.22 > 192.168.1.23.1773: P 1:24(23) ack 1 win5840 (DF)\r\n17:29:53.154919 IP 192.168.1.23.1773 > 192.168.1.191.22: P 1:29(28) ack 24 win 65512 (DF)\r\n17:29:53.155446 IP 192.168.1.191.22 > 192.168.1.23.1773: . ack 29 win 5840 (DF)\r\n17:29:53.159267 IP 192.168.1.191.22 > 192.168.1.23.1773: P 24:664(640) ack 29win 5840 (DF)\r\n17:29:53.159481 IP 192.168.1.23.1773 > 192.168.1.191.22: P 29:533(504) ack 664 win 64872 (DF)\r\n17:29:53.159531 IP 192.168.1.23.1773 > 192.168.1.191.22: P 533:549(16) ack 664 win 64872 (DF)\r\n17:29:53.170910 IP 192.168.1.191.22 > 192.168.1.23.1773: P 664:944(280) ack 549 win 6432 (DF)\r\n17:29:53.309689 IP 192.168.1.23.1773 > 192.168.1.191.22: . ack 944 win 64592 (DF)\r\n17:29:53.314090 IP 192.168.1.23.1773 > 192.168.1.191.22: P 549:821(272) ack 944 win 64592 (DF)\r\n17:29:53.353779 IP 192.168.1.191.22 > 192.168.1.23.1773: . ack 821 win 7504 (DF)\r\n17:29:53.384315 IP 192.168.1.191.22 > 192.168.1.23.1773: P 944:1536(592) ack 821 win 7504 (DF)\r\n17:29:53.603745 IP 192.168.1.23.1773 > 192.168.1.191.22: P 821:837(16) ack 1536 win 65535 (DF)\r\n17:29:53.603976 IP 192.168.1.23.1773 > 192.168.1.191.22: P 837:889(52) ack 1536 win 65535 (DF)\r\n17:29:53.604408 IP 192.168.1.191.22 > 192.168.1.23.1773: . ack 837 win 7504 (DF)\r\n17:29:53.604442 IP 192.168.1.191.22 > 192.168.1.23.1773: . ack 889 win 7504 (DF)\r\n17:29:53.605354 IP 192.168.1.191.22 > 192.168.1.23.1773: P 1536:1588(52) ack 889 win 7504 (DF)\r\n17:29:53.812589 IP 192.168.1.23.1773 > 192.168.1.191.22: . ack 1588 win 65483(DF)\r\n17:29:57.766032 IP 192.168.1.23.1773 > 192.168.1.191.22: P 889:957(68) ack 1588 win 65483 (DF)\r\n17:29:57.767979 IP 192.168.1.191.22 > 192.168.1.23.1773: P 1588:1672(84) ack 957 win 7504 (DF)\r\n17:29:57.936786 IP 192.168.1.23.1773 > 192.168.1.191.22: . ack 1672 win 65399(DF)\r\n17:30:02.142999 IP 192.168.1.23.1773 > 192.168.1.191.22: P 957:1233(276) ack 1672 win 65399 (DF)\r\n17:30:02.154726 IP 192.168.1.191.22 > 192.168.1.23.1773: P 1672:1708(36) ack 1233 win 8576 (DF)\r\n17:30:02.154912 IP 192.168.1.23.1773 > 192.168.1.191.22: P 1233:1301(68) ack 1708 win 65363 (DF)\r\n17:30:02.158220 IP 192.168.1.191.22 > 192.168.1.23.1773: P 1708:1760(52) ack 1301 win 8576 (DF)\r\n17:30:02.158452 IP 192.168.1.23.1773 > 192.168.1.191.22: P 1301:1401(100) ack1760 win 65311 (DF)\r\n17:30:02.161712 IP 192.168.1.191.22 > 192.168.1.23.1773: P 1760:1796(36) ack 1401 win 8576 (DF)\r\n17:30:02.161902 IP 192.168.1.23.1773 > 192.168.1.191.22: P 1401:1453(52) ack 1796 win 65275 (DF)\r\n17:30:02.173378 IP 192.168.1.191.22 > 192.168.1.23.1773: P 1796:1884(88) ack 1453 win 8576 (DF)\r\n17:30:02.173407 IP 192.168.1.191.22 > 192.168.1.23.1773: P 1884:1984(100) ack1453 win 8576 (DF)\r\n17:30:02.173433 IP 192.168.1.23.1773 > 192.168.1.191.22: . ack 1984 win 65087(DF)\r\n17:30:02.308485 IP 192.168.1.191.22 > 192.168.1.23.1773: P 1984:2052(68) ack 1453 win 8576 (DF)\r\n17:30:02.315864 IP 192.168.1.191.22 > 192.168.1.23.1773: P 2052:2104(52) ack 1453 win 8576 (DF)\r\n17:30:02.315925 IP 192.168.1.23.1773 > 192.168.1.191.22: . ack 2104 win 64967(DF)\r\n

复制代码

\n\n[ 本帖最后由 huopin 于 2008-8-22 18:06 编辑 ]

xi2008wang

是少了一个:\r\n客户端192.168.1.23对服务器192.168.191确认的4240709887ack包

ssffzz1

17:29:53.123192 IP 192.168.1.23.1773 > 192.168.1.191.22: S 175077054:175077054(0) win 65535 <mss 1460,nop,nop,sackOK> (DF)\r\n17:29:53.123413 IP 192.168.1.191.22 > 192.168.1.23.1773: S 4240709886:4240709886(0) ack 175077055 win 5840 <mss 1460,nop,nop,sackOK> (DF)\r\n17:29:53.123443 IP 192.168.1.23.1773 > 192.168.1.191.22: . ack 1 win 65535 (DF)

ssffzz1

再仔细看看，就没显示序列号。有那来的不对这一说啊。

kentchoi

17:29:53.123443 IP 192.168.1.23.1773 > 192.168.1.191.22: . ack 1 win 65535 (DF)\r\n\r\n其中 ack 1 就意味着上一次的 syn +1 的序号作为ack 的序号了。。。\r\n\r\n看看 steven richard 的 tcp/ip 协议 卷一都有描述的。。。

kentchoi

这本书不用看教科书那样看，，当作数据包分析专门词典吧。。。\r\n\r\n自己看，，估计看完一遍又忘掉，，需要结合实际，当作词典来看待。\r\n\r\n其实就是圣经啊。。。

huopin

灰常灰常感谢楼上各位。

ssffzz1

TCP/IP协议分析，如果我没猜错的话。\r\n\r\n看好了，看书不是我说的哦。