tcpdump/HTTP協定實踐
<a href="http://blog.51cto.com/attachment/201206/151241288.jpg" target="_blank"></a>
用戶端：
CLOSED->SYN_SENT->ESTABLISHED->FIN_WAIT_1->FIN_WAIT_2->TIME_WAIT->CLOSED
服務端：
CLOSED->LISTEN->SYN收到->ESTABLISHED->CLOSE_WAIT->LAST_ACK->CLOSED
# tcpdump host 192.168.64.71 and port 80 -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth2, link-type EN10MB (Ethernet), capture size 96 bytes
10:13:01.617505 IP 10.1.9.11.58384 > 192.168.64.71.80: <b>S</b>yn 3718379515:3718379515(0) win 65535 <mss 1460,nop,nop,sackOK> <b>用戶端發起連接配接請求</b>
10:13:01.617631 IP 192.168.64.71.80 > 10.1.9.11.58384: <b>S</b>yn 261066897:261066897(0) ack 3718379516 win 5840 <mss 1460,nop,nop,sackOK><b> </b><b>服務端響應連接配接請求</b>
10:13:01.617766 IP 10.1.9.11.58384 > 192.168.64.71.80: . ack 1 win 65535
10:13:01.618011 IP 10.1.9.11.58384 > 192.168.64.71.80: <b>P</b>ush 1:612(611) ack 1 win 65535 <b>用戶端向服務端發送資料</b><b>(HTTP</b><b>請求</b><b>)</b>
10:13:01.618023 IP 192.168.64.71.80 > 10.1.9.11.58384: . ack 612 win 6721
10:13:01.618486 IP 192.168.64.71.80 > 10.1.9.11.58384: <b>P</b>ush 1:329(328) ack 612 win 6721<b>服務端向用戶端回送資料</b><b>(HTTP</b><b>響應</b><b>)</b>
10:13:01.618510 IP 192.168.64.71.80 > 10.1.9.11.58384: <b>P</b>ush 329:1303(974) ack 612 win 6721
10:13:01.619638 IP 10.1.9.11.58384 > 192.168.64.71.80: . ack 1303 win 64233
10:13:11.574352 IP 10.1.9.11.58384 > 192.168.64.71.80: <b>F</b>in 612:612(0) ack 1303 win 64233 <b>用戶端先發起關閉連接配接操作</b>
10:13:11.574455 IP 192.168.64.71.80 > 10.1.9.11.58384: <b>F</b>in 1303:1303(0) ack 613 win 6721 <b>服務端響應用戶端的關閉連接配接操作</b>
10:13:11.574991 IP 10.1.9.11.58384 > 192.168.64.71.80: . ack 1304 win 64233 <b>用戶端進入</b><b>TIME_WAIT</b><b>狀态</b>
Ø 服務端(192.168.64.71.80)向用戶端(10.1.9.11.58384)回送的響應分了兩個tcp包：
第一個包發送了328位元組，第二個包發送了974位元組
Ø 關閉連接配接由用戶端(10.1.9.11.58384)首先發起，是以用戶端(192.168.64.71.80)需要經曆一個TIME_WAIT過程
Site found: www.tcpdump.com=192.168.64.71
Connecting to 192.168.64.71
Connected to 192.168.64.71
GET http:// www.tcpdump.com/
> Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
> User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
> Host: tsf.oa.com
Request sent. 611 bytes
Data available. 974/974 bytes
<a>HTTP/1.1 200 OK</a>
Date: Sun, 10 Aug 2008 02:27:08 GMT
Server: Apache/2.0.59 (Unix) DAV/2 PHP/5.2.1 SVN/1.4.6
Last-Modified: Wed, 21 May 2008 01:19:21 GMT
ETag: "298227-3ce-62ec9840"
Accept-Ranges: bytes
Content-Length: <b>974</b>
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=GB2312
200 Request complete
從上面的抓包結果來看，Apache将HTTP響應頭和資料部分是分成兩兩部分發送的，而且TCP/IP協定棧沒有再對其分包，也就是每個send調用都将資料發送完畢。
<a></a>
HTTP響應頭共328位元組。
本文轉自eyjian 51CTO部落格，原文連結：http://blog.51cto.com/mooon/908567，如需轉載請自行聯系原作者
![Apache靜态檔案通路配置（書封伺服器）[圖]](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACwAAAAAAQABAAACAkQBADs=)