天天看點
傳回

用 shell 腳本制造連接配接頻繁中斷的場景問題的提出問題的解決結語參考

問題的提出

最近在準備用戶端的新版本，在内部灰階過程中，發現一類奇怪的 dump，通過檢視日志和堆棧，可以确定是因為每次連上背景就被背景斷開了、導緻多次重連後随機發生的崩潰。dump 和日志都無法提供進一步的資訊來定位問題，本地又不複現，也沒有辦法去聯系使用者檢視現場 (windows 服務崩潰後自動重新開機，使用者不感覺)。于是想到能不能自己制造這樣的場景 —— 當連接配接建立後立即斷開該連接配接 —— 看是否會複現崩潰。

問題的解決

tcpview

在 windows 上最直覺的解決方案就是手動斷開連接配接啦，拿出 sysinternal 工具集，翻出 tcpview，就可以看到系統上所有的 tcp 連接配接了：

用 shell 腳本制造連接配接頻繁中斷的場景問題的提出問題的解決結語參考

除了能看到建立的 tcp 連接配接所屬程序、本地位址/端口号、遠端位址/端口号外、連接配接狀态外，還可以看到一些連接配接上的統計資訊，如收發包數和位元組數等。高亮的那一行就是我想要殺掉的連接配接。在 tcpview 裡殺連接配接很簡單，直接右鍵菜單 ‘Close Connection’ 即可。但是這樣做的問題是，每次從看到連接配接到殺死連接配接要經曆一定時間 (手動操作)，甚至程序日志已經顯示連接配接建立了，tcpview 還沒有刷出來，總而言之就是一個字 —— 慢，殺了十幾次，挂上調試器的程序紋絲不動，一點要崩潰的迹象也沒有 (關鍵是還手疼)，汗~

tcpkill

都 2020 年了，自動化工具用起來，查了一下，tcpview 除了界面外沒有提供類似指令行的功能，于是隻能在網上搜 “什麼指令能殺掉 tcp 連接配接” 了，百度到一個 tcpkill，這個指令是原生于 linux 的，需要先安裝 dsniff 工具包

$ sudo yum install dsniff

複制

安裝成功後就可以實操一下了

$ tcpkill
Version: 2.4
Usage: tcpkill [-i interface] [-1..9] expression

複制

help 和 man 都太過簡單，其實重點就是最後這個參數 expression，貌似是使用和 tcpdump 相同的格式，為了驗證 tcpkill，我先搭建了一個簡單的測試環境：

$ nc -4 -l -p 5555

複制

使用 nc 建立一個在 5555 端口監聽的程序；

$ nc -4 localhost 5555 -p 6666

複制

在另外一個終端中建立一個程序去連接配接 5555 端口，它自己的端口是 6666；

$ netstat -antp
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
……            
tcp        0      0 127.0.0.1:5555          127.0.0.1:6666          ESTABLISHED 2451/nc             
tcp        0      0 127.0.0.1:6666          127.0.0.1:5555          ESTABLISHED 2470/nc 
……

複制

可以通過 netstat 指令檢視到建立的這個連接配接及其端口号。下面用 tcpkill 殺掉這個連接配接，這裡使用指定 6666 端口的方式：

$ sudo tcpkill -i lo port 6666
tcpkill: listening on lo [port 6666]
127.0.0.1:6666 > 127.0.0.1:5555: R 18446744073486680909:18446744073486680909(0) win 0
127.0.0.1:6666 > 127.0.0.1:5555: R 18446744073486681251:18446744073486681251(0) win 0
127.0.0.1:6666 > 127.0.0.1:5555: R 18446744073486681935:18446744073486681935(0) win 0
127.0.0.1:5555 > 127.0.0.1:6666: R 18446744071881223293:18446744071881223293(0) win 0
127.0.0.1:5555 > 127.0.0.1:6666: R 18446744071881223635:18446744071881223635(0) win 0
127.0.0.1:5555 > 127.0.0.1:6666: R 18446744071881224319:18446744071881224319(0) win 0

複制

列印了一堆莫名其妙的資訊，看 netstat 輸出的話，那個連接配接還是 ESTABLISHED 狀态，但是通過在控制台輸入一些字元 (例如 abc) 來發送資料後，連接配接中斷、程序退出

$ nc -4 localhost 5555 -p 6666
hello
world
abc
Ncat: Connection reset by peer.

複制

在 5555 端口監聽的程序由于連接配接中斷也自動退出了

$ nc -4 -l -p 5555
hello
world
abc

複制

此時再看 netstat 輸出，就看不到這條連接配接的相關資訊了。看相關文章，貌似是這個指令向連接配接發送了僞造的 rst 包，是以隻有當下次用戶端再請求時，才會發現連接配接已經中斷了。而且 tcpkill 好像會一直運作，隻要它發現在 6666 這個端口建立了連接配接，就會去嘗試中斷。雖然後面這個特性挺好，但是連接配接隻有在下一次發送資料時才能檢測到中斷這事，實效性差那麼點兒意思；最麻煩的是我在 windows 的 msys2 環境中，沒有這個指令可用，看來這個指令依賴的一些 linux 底層機制在 win32 上不太好實作，于是果斷放棄。

cports

下面百度的重點就放在了 “windows 上可以殺掉 tcp 連接配接的指令” 了，結果還真被找到一個 —— CurrPorts，它本身是個 UI 工具，界面和 tcpview 很類似：

用 shell 腳本制造連接配接頻繁中斷的場景問題的提出問題的解決結語參考

輸出的資訊大同小異，都是程序、協定、本地位址/端口、遠端位址/端口、連接配接狀态等 (其實還少了一些連接配接上的統計資訊)。然後關閉連接配接也是通過選中項目後右鍵菜單來實作的：

用 shell 腳本制造連接配接頻繁中斷的場景問題的提出問題的解決結語參考

光看菜單的話，感覺比 tcpview 功能豐富多了，比如光選項就有這麼多：

用 shell 腳本制造連接配接頻繁中斷的場景問題的提出問題的解決結語參考

确實比 tcpview 要好用一些，但是使用右鍵菜單來關閉連接配接，貌似和之前沒有多大分别呢 (雖然可以使用 Ctrl+T 快捷方式)。不要急，下面着重說一下 CurrPorts 的指令行參數，這是差別于 tcpview 的一大優勢：

/stext <Filename> Save the list of all opened TCP/UDP ports into a regular text file.
/stab <Filename> Save the list of all opened TCP/UDP ports into a tab-delimited text file.
/scomma <Filename> Save the list of all opened TCP/UDP ports into a comma-delimited text file.
/stabular <Filename> Save the list of all opened TCP/UDP ports into a tabular text file.
/shtml <Filename> Save the list of all opened TCP/UDP ports into HTML file (Horizontal).
/sverhtml <Filename> Save the list of all opened TCP/UDP ports into HTML file (Vertical).
/sxml <Filename> Save the list of all opened TCP/UDP ports to XML file.
/CaptureTime <Milliseconds>

Specifies the capture time in milliseconds for the save command-line options (/stext, /stab, /scomma, and so on...)

Example:

cports.exe /RunAsAdmin /scomma c:\temp\ports1.csv /CaptureTime 15000
/RunAsAdmin Runs CurrPorts as Administrator.
/sort <column>

This command-line option can be used with other save options for sorting by the desired column.

If you don't specify this option, the list is sorted according to the last sort that you made from the user interface.

The <column> parameter can specify the column index (0 for the first column, 1 for the second column, and so on) or

the name of the column, like "Remote Port" and "Remote Address".

You can specify the '~' prefix character (e.g: "~Remote Address") if you want to sort in descending order.

You can put multiple /sort in the command-line if you want to sort by multiple columns.

Examples:

cports.exe /shtml "f:\temp\1.html" /sort 2 /sort ~1

cports.exe /shtml "f:\temp\1.html" /sort "Protocol" /sort "~Remote Address"
/nosort When you specify this command-line option, the list will be saved without any sorting.
/filter <filter string>

Start CurrPorts with the specified filters.

If you want to specify more than one filter, use the ';' character as a delimiter.
/cfg <cfg filename> Start CurrPorts with the specified config file.

/MarkPorts

/DisplayUdpPorts

/DisplayTcpPorts

/DisplayClosedPorts

/MarkNewModifiedPorts

/SortOnAutoRefresh

/AlwaysOnTop

/AskBefore

/DisplayIPv6Ports

/DisplayListening

/DisplayEstablished

/DisplayNoState

/DisplayNoRemoteIP

/ResolveAddresses

/RememberLastFilter

/DisplayPortInAddress

/AutoRefresh,

/ShowInfoTip

/TrayIcon

/TrayIconOneClick

/StartAsHidden

/LogChanges

/LogFilename

/DisabledFilters

/AddExportHeaderLine

You can use all these parameters to control the options that are available under the Options and View menus.

For example, if you want to start CurrPorts with 'Display UDP Ports' turned off and 'Display Closed' turned on:

cports.exe /DisplayUdpPorts 0 /DisplayClosedPorts 1

You can also use these parameters in conjunction with all save parameters. For example:

If you want to save into tab-delimited file only the UDP ports:

cports.exe /DisplayUdpPorts 1 /DisplayTcpPorts 0 /stab "c:\temp\udp.txt"

看了一圈兒，好像都是将結果儲存到檔案的一些選項，還好下面有一段話是專門說明如何關閉連接配接的：

Closing a Connection From Command-Line
Starting from version 1.09, you can close one or more connections from command-line, by using /close parameter.
The syntax of /close command:
/close <Local Address> <Local Port> <Remote Address> <Remote Port> {Process Name/ID}

For each parameter, you can specify "*" in order to include all ports or addresses. The process name is an optional parameter. If you specify a process, only the ports of the specified process will be closed.
Examples:

    Close all connections with remote port 80 and remote address 192.168.1.10:
    /close * * 192.168.1.10 80
    Close all connections with remote port 80 (for all remote addresses):
    /close * * * 80
    Close all connections to remote address 192.168.20.30:
    /close * * 192.168.20.30 *
    Close all connections with local port 80:
    /close * 80 * *
    Close all connections of Firefox with remote port 80:
    /close * * * 80 firefox.exe
    Close all connections of the process that its ID is 3276:
    /close * * * * 3276

複制

給出了豐富的示例，例如針對我們的場景，可以這樣調用 cports (UI 叫 CurrPorts，但指令名為 cports.exe)：

cports /close * * xxx.xxx.xx.xx 3570 gdphost.exe

複制

其中 xxx 部分是連接配接的遠端 IP 位址，3570 是遠端端口，gdphost.exe 是發起連接配接的程序名。當 cmd 以管理者權限運作，上面的調用是可以殺死連接配接的，但是在 msys2 bash (其實就是 git bash 啦) 中運作卻直接啟動了 CurrPorts 工具的 UI 界面。問題可能出在 /close 被 bash 作了轉義識别上，用雙引号将它們包含一下：

cports "/close" "*" "*" "xxx.xxx.xx.xx" "3570" "gdphost.exe"

複制

結果還是不行，經過一翻研究，改成下面這樣就可以了：

cports "//close" "*" "*" "xxx.xxx.xx.xx" "3570" "gdphost.exe"

複制

在 msys2 bash 中要對 win32 指令的選項開始符 '/' 使用轉義符字首，否則 bash 會認為 /close 是一個目錄(?)而非參數，進而進行某種轉換(?)。又研究了一下雙引号的作用，發現對于星号還是必需加上的，其它的參數可以不加，于是最後版本就成了這樣：

cports "//close" "*" "*" xxx.xxx.xx.xx 3570 gdphost.exe

複制

注意 cports 所在目錄我是添加到了 Path 環境變量，是以可以這樣直接寫指令，否則必需提供 cports 的完整路徑。另外這個 bash 也必需以管理者權限啟動，不然指令雖然可以傳回，但是沒有發生任何實質性影響。

完整腳本

有了 cports 的底層支援，我們就可以這樣寫腳本來自動斷開連接配接“僞造”事發現場啦：

1 #! /bin/sh
 2 while true
 3 do
 4   n=$(netstat -ano | grep 3570 | wc -l)
 5   if [ $n -gt 0 ]; then
 6     cports "//close" "*" "*" "*" 3570 gdphost.exe
 7     echo "close connection"
 8   else 
 9     echo "no connection find"
10   fi
11 done

複制

加了一點簡單的邏輯，在運作循環中首先通過 netstat 判斷有沒有在 3570 端口建立的連接配接，如果有就調用 cports 去斷開；如果沒有就繼續循環，直到 Ctrl+C 結束。腳本運作起來後，結合圖形界面、可以看到這個程序到背景的連接配接在不停的斷開重連，下面是觀察到腳本的一些輸出 (内容較多、展開慎重)：

$ ./kill.sh
close connection
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
close connection
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
close connection
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
close connection
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
close connection
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
close connection
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
close connection
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
close connection
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
close connection
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
close connection
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
close connection
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
close connection
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
no connection find
close connection
no connection find
no connection find
no connection find
^C

複制

錄取了大概一千行的輸出，平均每 80 行可以觀察到一次中斷連接配接的記錄，也就是說 netstat 運作 80 次左右才能輪到一次 cports，這和程序在連接配接中斷後 5 秒進行第一次重試有關 (通過換算，netstat 一秒運作了 16 次?)，而為了“及時”殺掉程序這裡也沒有采用 sleep 去避免忙等待 (其實可以等待 4 秒)。

結語

今天通過一個實際場景來研究了一下如何使用 shell + cports 不斷的殺死某個連接配接、進而構造一個 bug 複現的場景。雖然腳本寫的很漂亮，但遺憾的是這個 bug 未能複現 (淚奔~)，我用調試器挂上 win32 程序跑了四個多小時也沒有出現崩潰。再仔細對比 log 輸出，發現僞造的場景下程序還是可以有機會輸出更多資訊，看來“殺”的還是不夠快啊；于是我将 netstat 檢測 3570 端口是否存在這步去掉了，直接在循環裡調用 cports 不斷的殺連接配接，這應該比之前快了吧，但是還是沒有發生崩潰；是以我感覺下一步隻能用 c++ 寫個程式，模拟在 3570 端口偵聽、并在連接配接一上來的時候就 close connection 試試了 (需要設定 host 以便将域名指向本地啟動的這個模拟程式)。

雖然沒能複現 bug，但是無意間得到了 cports 這個寶貝，另外它的作者 nir sofer 也是一個 windows 工具小達人，制作了一系列 win32 工具供網友免費下載下傳使用，有興趣的讀者可以去他的網站上翻翻。

使用 shell 腳本建立 tcp 連接配接可以參考我之前寫的這篇文章：《用 shell 腳本做 tcp 協定模拟 》。

參考

[1]. Windows Sysinternals

[2]. Tcpkill

[3]. How to kill a particular tcp connection in windows?

[4]. CPorts

[5]. NirSoft

上一篇: 淺談裝置指紋技術和應用
下一篇: 淺談溯源分析基礎技術