18.6.3 FIN_WAIT_2 状态

18.6.3  FIN_WAIT_2 状态


在FIN_WAIT_2 状态我们已经发出了FIN,并且另一端也对它进行确认。除非我们在实行半关闭,

否则将等待另一端的应用层意识到它已收到一个文件结束符说明

这意味着我们这端可能永远保持这个状态,另一端也将处于CLOSE_WAIT状态,

并一直保持这个状态直到应用层决定进行关闭

 tcpdump -i eth1 '((tcp) and ((tcp port 9090) and (  host 192.168.137.2)))'



监视指定主机的数据包，例如所有进入或离开node1的数据包

tcpdump -i ens33  host node1



#协议为tcp，目标端口或源端口为80
tcpdump -nni ens33 -w packets.pcap 'tcp port 80'





Last login: Wed Feb 19 12:52:23 2020 from 192.168.137.1
node2:/root# tcpdump -i eth1 '((tcp) and ((tcp port 9090) and (  host 192.168.137.2)))'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes
14:19:59.208717 IP node2.46779 > node1.websm: Flags [S], seq 882198537, win 14600, options [mss 1460,sackOK,TS val 108351644 ecr 0,nop,wscale 7], length 0
14:19:59.209050 IP node1.websm > node2.46779: Flags [S.], seq 3646064921, ack 882198538, win 14480, options [mss 1460,sackOK,TS val 4257384 ecr 108351644,nop,wscale 6], length 0
14:19:59.209202 IP node2.46779 > node1.websm: Flags [.], ack 1, win 115, options [nop,nop,TS val 108351646 ecr 4257384], length 0
14:19

:59.209300 IP node2.46779 > node1.websm: Flags [F.], seq 1, ack 1, win 115, options [nop,nop,TS val 108351646 ecr 4257384], length 0
14:19:59.209482 IP node1.websm > node2.46779: Flags [.], ack 2, win 227, options [nop,nop,TS val 4257384 ecr 108351646], length 0


Wed Feb 19 14:20:15 CST 2020
tcp        0      0 192.168.137.3:46779         192.168.137.2:9090          FIN_WAIT2   
Wed Feb 19 14:20:15 CST 2020

node1:/root/test#netstat -na | grep 9090
tcp        0      0 0.0.0.0:9090                0.0.0.0:*                   LISTEN      
tcp        1      0 192.168.137.2:9090          192.168.137.3:46779         CLOSE_WAIT  
tcp        1      0 192.168.137.2:9090          192.168.137.2:49785         CLOSE_WAIT  
node1:/root/test#