Lvs-NAT
LVS特点：
通过LVS提供的负载均衡技术和Linux操作系统实现一个高性能、高可用的服务器群集，它具有良好可靠性、可扩展性和可操作性。从而以低廉的成本实现最优的服务性能。LVS的主要特点有以下几个方面：
高并发连接：LVS基于内核网络层面工作，有超强的承载能力和并发处理能力。单台LVS负载均衡器，可支持上万并发连接。 稳定性强：是工作在网络4层之上仅作分发之用，这个特点也决定了它在负载均衡软件里的性能最强，稳定性最好，对内存和cpu资源消耗极低。
成本低廉：硬件负载均衡器少则十几万，多则几十万上百万，LVS只需一台服务器和就能免费部署使用，性价比极高。
配置简单：LVS配置非常简单，仅需几行命令即可完成配置，也可写成脚本进行管理。
支持多种算法：支持多种论调算法，可根据业务场景灵活调配进行使用
支持多种工作模型：可根据业务场景，使用不同的工作模式来解决生产环境请求处理问题。
应用范围广：因为LVS工作在4层，所以它几乎可以对所有应用做负载均衡，包括http、数据库、DNS、ftp服务等等
缺点：工作在4层，不支持7层规则修改，机制过于庞大，不适合小规模应用。
LVS工作原理：
当客户端的请求到达负载均衡器的内核空间时，首先会到达PREROUTING链。
当内核发现请求数据包的目的地址是本机时，将数据包送往INPUT链。
LVS由用户空间的ipvsadm和内核空间的IPVS组成，ipvsadm用来定义规则，IPVS利用ipvsadm定义的规则工作，IPVS工作在INPUT链上,当数据包到达INPUT链时，首先会被IPVS检查，如果数据包里面的目的地址及端口没有在规则里面，那么这条数据包将经过INPUT链送至用户空间，交给用户空间的进程来处理。
如果数据包里面的目的地址及端口在规则里面，那么这条数据报文将被修改目的地址为事先定义好的后端服务器，并送往POSTROUTING链。
最后经由POSTROUTING链发往后端服务器。
LVS 模式：
NAT DR TUN
配置复杂度 简单 －－－－－复杂－－－－
扩展 性 差 好 很好
支持数量 >20 -------- >100 -----------
特点 地址转换 修改MAC 封装IP
支持OS any 大部分 需要支持ipip隧道
三种模式下的简单压力测试
简单的压力测试采用Apache ab，500并发用户，10w的请求总数。
总耗时(s) T PS(#/sec)
NAT 22.480 4448.34
TUNNEL 10.707 9339.80
DR 10.177 9825.68
可以看出NAT性能要比后两种差一倍。
LVS是从四层对消息进行负载转发的，很大程度上是直接利用操作系统的特性来实现消息转发，
因此转发损耗有限，但是NAT模式中Load Balancer对于性能的影响很大，同时对于负载压力本身以及后台节点数目有限制。
在LVS基础上有很多其他的开源软件，增加了心跳等机制来保证集群的健壮性。而LVS并不能满足根据应用参数或包体内容转发请求的场景，
因此进一步研究HA-Proxy，这种基于基于应用级别在7层对消息作分析转发的负载均衡方案。
LVS调度算法介绍
LVS有两种类型的调度算法，其一就是静态的调度算法，这种算法一经实现，后续就不会发生变化，是既定的规则，后续数据包的流转都会按照这种规则进行按部就班的流转；其二就是动态的调度算法，这种算法是基于网络状况，或者后端服务器的状况，连接的状况等来进行实时的调整，算法的规则会根据实际情况而发生一定的变化。
常用的静态调度算法有以下几种：
1.RR：轮叫调度（Round Robin）
调度器通过”轮叫”调度算法将外部请求按顺序轮流分配到集群中的真实服务器上，它均等地对待每一台服务器，而不管服务器上实际的连接数和系统负载｡
2.WRR：加权轮叫（Weight RR）
调度器通过“加权轮叫”调度算法根据真实服务器的不同处理能力来调度访问请求。这样可以保证处理能力强的服务器处理更多的访问流量。调度器可以自动问询真实服务器的负载情况,并动态地调整其权值。
3.DH：目标地址散列调度（Destination Hash ）
根据请求的目标IP地址，作为散列键(HashKey)从静态分配的散列表找出对应的服务器，若该服务器是可用的且未超载，将请求发送到该服务器，否则返回空。
4.SH：源地址 hash（Source Hash）
源地址散列”调度算法根据请求的源IP地址，作为散列键(HashKey)从静态分配的散列表找出对应的服务器，若该服务器是可用的且未超载，将请求发送到该服务器，否则返回空｡
常用的动态调度算法有下面这些
1.LC：最少链接（Least Connections）
调度器通过”最少连接”调度算法动态地将网络请求调度到已建立的链接数最少的服务器上。如果集群系统的真实服务器具有相近的系统性能，采用”最小连接”调度算法可以较好地均衡负载。
2.WLC：加权最少连接(默认采用的就是这种)（Weighted Least Connections）
在集群系统中的服务器性能差异较大的情况下，调度器采用“加权最少链接”调度算法优化负载均衡性能，具有较高权值的服务器将承受较大比例的活动连接负载｡调度器可以自动问询真实服务器的负载情况,并动态地调整其权值。
3.SED：最短延迟调度（Shortest Expected Delay ）
在WLC基础上改进，Overhead = （ACTIVE+1）*256/加权，不再考虑非活动状态，把当前处于活动状态的数目+1来实现，数目最小的，接受下次请求，+1的目的是为了考虑加权的时候，非活动连接过多缺陷：当权限过大的时候，会倒置空闲服务器一直处于无连接状态。
4.NQ永不排队/最少队列调度（Never Queue Scheduling NQ）
无需队列。如果有台 realserver的连接数＝0就直接分配过去，不需要再进行sed运算，保证不会有一个主机很空间。在SED基础上无论+几，第二次一定给下一个，保证不会有一个主机不会很空闲着，不考虑非活动连接，才用NQ，SED要考虑活动状态连接，对于DNS的UDP不需要考虑非活动连接，而httpd的处于保持状态的服务就需要考虑非活动连接给服务器的压力。
参考链接：https://blog.csdn.net/gui951753/article/details/80316565
NAT模式
一定确认在Director机器上，加载此模块！！！
modprobe iptable_nat
注意：如果你的Realserver是xen的虚拟机。
modprobe iptable_nat
三、配置：
1、准备5个centos
2、iptables -F , 清除规则
3、/etc/selinux/config,关SELinux
画拓扑图
Client：
CIP: 110.0.0.1/24
GW: 110.0.0.254
DGW:
110.0.0.254/24
220.0.0.254/24
Director：
eth0 DIP: 192.168.0.253/24
eth0:1 VIP: 220.0.0.1/24
RealServer:
RIP: 192.168.0.188
RIP: 192.168.0.194
注意：如果你的Realserver是xen的虚拟机。
modprobe iptable_nat
部署
客户端：
要求：
能够访问到VIP即可。
配置IP: 110.0.0.1
设置GW: 110.0.0.254
DGW:
要求：
实现IP转发
配置IP：
110.0.0.254
220.0.0.254
开启IP转发
Director分发器：
yum install ipvsadm
1、转发
[root@vmware1 ~]# sysctl -p
net.ipv4.ip_forward = 1
2、加载模块
modprobe iptable_nat
3、
添加VIP 220.0.0.1/24
DIP 192.168.0.253/24
修改GW -> 220.0.0.254
4、使用这个命令设置规则：
ipvsadm -A -t 220.0.0.1:80 -s rr
ipvsadm -a -t 220.0.0.1:80 -r 192.168.0.188 -m
ipvsadm -a -t 220.0.0.1:80 -r 192.168.0.194 -m
[root@www blues]# /etc/init.d/ipvsadm save
Saving IPVS table to /etc/sysconfig/ipvsadm: [确定]
RealServer：
配置IP：192.168.0.188
网关指向DIP： 192.168.0.253
e.g：
启动HTTPD
（实验期间，各个服务器的页面不同）
echo "192.168.0.188" > /var/www/html/index.html
=======运维========
ipvsadm -L -n
ipvsadm -C
ipvsadm -L -n --stats
ipvsadm -L -n --rate
ipvsadm -L -n -c
参数备忘
* -L|-l --list 显示内核虚拟服务器表
* -Z --zero 虚拟服务表计数器清零（清空当
前的连接数量等）
* -C --clear 清除内核虚拟服务器表中的所有
记录。
* --stats 显示统计信息
* --rate 显示速率信息
* -c --connection 显示LVS 目前的连接
策略保存及测试
* service ipvsadm save
* ab -n 1000 -c 1000 http://192.168.1.100
* watch -n 0.1 ipvsadm -L -n --stats
注意
* 单网卡：
– 虚拟IP需要是eth0:X形式，默认发送数据使用
eth0上IP地址。至少两个IP。
* 双卡随意，但是确保出口路由网卡正确。
* 客户机不可以是集群中节点
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
vsftpd:
81 iptables -t mangle -A PREROUTING -d 20.0.0.2 -p tcp --dport 21 -j MARK --set-mark 21
82 iptables -t mangle -A PREROUTING -d 20.0.0.2 -p tcp --dport 10000:20000 -j MARK --set-mark 21
90 ipvsadm -A -f 21 -s lc -p 3600
91 ipvsadm -a -f 21 -r 10.10.10.32 -m
92 ipvsadm -a -f 21 -r 10.10.10.33 -m
启动vsftpd
pasv_address=20.0.0.2
pasv_max_port=20000
pasv_min_port=10000
抓包分析
[root@CIP]# tcpdump -i eth0 -nn -vv port 80
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
11:06:17.401350 IP (tos 0x0, ttl 64, id 64104, offset 0, flags [DF], proto: TCP (6), length: 60) 202.106.0.1.7391 > 202.106.0.254.80: S,
cksum 0xc782 (correct), 3000071322:3000071322(0) win 5840 <mss 1460,sackOK,timestamp 5017330 0,nop,wscale 7>
11:06:17.402662 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: TCP (6), length: 60) 202.106.0.254.80 > 202.106.0.1.7391: S,
cksum 0x8e94 (correct), 3178615476:3178615476(0) ack 3000071323 win 5792 <mss 1460,sackOK,timestamp 4827289 5017330,nop,wscale 7>
11:06:17.402684 IP (tos 0x0, ttl 64, id 64105, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.1.7391 > 202.106.0.254.80: ., cksum 0xd3d0 (correct),
1:1(0) ack 1 win 46 <nop,nop,timestamp 5017332 4827289>
11:06:17.402863 IP (tos 0x0, ttl 64, id 64106, offset 0, flags [DF], proto: TCP (6), length: 220) 202.106.0.1.7391 > 202.106.0.254.80: P 1:169(168) ack 1 win 46
<nop,nop,timestamp 5017332 4827289>
11:06:17.403777 IP (tos 0x0, ttl 63, id 31279, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.254.80 > 202.106.0.1.7391: ., cksum 0xd31f (correct), 1:1(0)
ack 169 win 54 <nop,nop,timestamp 4827290 5017332>
11:06:17.405396 IP (tos 0x0, ttl 63, id 31280, offset 0, flags [DF], proto: TCP (6), length: 328) 202.106.0.254.80 > 202.106.0.1.7391: P 1:277(276) ack 169 win 54
<nop,nop,timestamp 4827292 5017332>
11:06:17.405410 IP (tos 0x0, ttl 64, id 64107, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.1.7391 > 202.106.0.254.80: ., cksum 0xd207 (correct),
169:169(0) ack 277 win 54 <nop,nop,timestamp 5017334 4827292>
11:06:17.405419 IP (tos 0x0, ttl 63, id 31281, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.254.80 > 202.106.0.1.7391: F, cksum 0xd208 (correct),
277:277(0) ack 169 win 54 <nop,nop,timestamp 4827292 5017332>
11:06:17.405611 IP (tos 0x0, ttl 64, id 64108, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.1.7391 > 202.106.0.254.80: F, cksum 0xd205 (correct),
169:169(0) ack 278 win 54 <nop,nop,timestamp 5017334 4827292>
11:06:17.406499 IP (tos 0x0, ttl 63, id 31282, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.254.80 > 202.106.0.1.7391: ., cksum 0xd204 (correct),
278:278(0) ack 170 win 54 <nop,nop,timestamp 4827293 5017334>
11:06:19.066060 IP (tos 0x0, ttl 64, id 49295, offset 0, flags [DF], proto: TCP (6), length: 60) 202.106.0.1.7392 > 202.106.0.254.80: S, cksum 0xdf77 (correct),
3002619388:3002619388(0) win 5840 <mss 1460,sackOK,timestamp 5018995 0,nop,wscale 7>
11:06:19.066325 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: TCP (6), length: 60) 202.106.0.254.80 > 202.106.0.1.7392: S, cksum 0x52a3 (correct),
3004158104:3004158104(0) ack 3002619389 win 5792 <mss 1460,sackOK,timestamp 4262154 5018995,nop,wscale 7>
11:06:19.066354 IP (tos 0x0, ttl 64, id 49296, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.1.7392 > 202.106.0.254.80: ., cksum 0x97e1 (correct),
1:1(0) ack 1 win 46 <nop,nop,timestamp 5018995 4262154>
11:06:19.066742 IP (tos 0x0, ttl 64, id 49297, offset 0, flags [DF], proto: TCP (6), length: 220) 202.106.0.1.7392 > 202.106.0.254.80: P 1:169(168) ack 1 win 46
<nop,nop,timestamp 5018996 4262154>
11:06:19.066991 IP (tos 0x0, ttl 63, id 55698, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.254.80 > 202.106.0.1.7392: ., cksum 0x972f
(correct), 1:1(0) ack 169 win 54 <nop,nop,timestamp 4262155 5018996>
11:06:19.067432 IP (tos 0x0, ttl 63, id 55699, offset 0, flags [DF], proto: TCP (6), length: 347) 202.106.0.254.80 > 202.106.0.1.7392: P 1:296(295) ack 169 win 54
<nop,nop,timestamp 4262155 5018996>
11:06:19.067445 IP (tos 0x0, ttl 64, id 49298, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.1.7392 > 202.106.0.254.80: .
, cksum 0x9608 (correct), 169:169(0) ack 296 win 54 <nop,nop,timestamp 5018996 4262155>
11:06:19.067455 IP (tos 0x0, ttl 63, id 55700, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.254.80 > 202.106.0.1.7392: F,
cksum 0x9607 (correct), 296:296(0) ack 169 win 54 <nop,nop,timestamp 4262155 5018996>
11:06:19.067848 IP (tos 0x0, ttl 64, id 49299, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.1.7392 > 202.106.0.254.80: F,
cksum 0x9605 (correct), 169:169(0) ack 297 win 54 <nop,nop,timestamp 5018997 4262155>
11:06:19.068001 IP (tos 0x0, ttl 63, id 55701, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.254.80 > 202.106.0.1.7392: .,
cksum 0x9604 (correct), 297:297(0) ack 170 win 54 <nop,nop,timestamp 4262156 5018997>
[root@VIP]# tcpdump -i eth0 -nn -vv port 80
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
11:10:29.425911 IP (tos 0x0, ttl 64, id 16332, offset 0, flags [DF], proto: TCP (6), length: 60) 202.106.0.1.45604 > 202.106.0.254.80:
S, cksum 0x6925 (correct), 3208668859:3208668859(0) win 5840 <mss 1460,sackOK,timestamp 5200247 0,nop,wscale 7>
11:10:29.427252 IP (tos 0x0, ttl 64, id 16332, offset 0, flags [DF], proto: TCP (6), length: 60) 202.106.0.1.45604 > 192.168.0.118.80:
S, cksum 0x736f (correct), 3208668859:3208668859(0) win 5840 <mss 1460,sackOK,timestamp 5200247 0,nop,wscale 7>
11:10:29.427613 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto: TCP (6), length: 60) 192.168.0.118.80 > 202.106.0.1.45604: S,
cksum 0x46a8 (correct), 3368218792:3368218792(0) ack 3208668860 win 5792 <mss 1460,sackOK,timestamp 5010222 5200247,nop,wscale 7>
11:10:29.427646 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: TCP (6), length: 60) 202.106.0.254.80 > 202.106.0.1.45604: S, cksum 0x3c5e (
correct), 3368218792:3368218792(0) ack 3208668860 win 5792 <mss 1460,sackOK,timestamp 5010222 5200247,nop,wscale 7>
11:10:29.427760 IP (tos 0x0, ttl 64, id 16333, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.1.45604 > 202.106.0.254.80: .,
cksum 0x819a (correct), 1:1(0) ack 1 win 46 <nop,nop,timestamp 5200249 5010222>
11:10:29.427777 IP (tos 0x0, ttl 64, id 16333, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.1.45604 > 192.168.0.118.80: .,
cksum 0x8be4 (correct), 1:1(0) ack 1 win 46 <nop,nop,timestamp 5200249 5010222>
11:10:29.427980 IP (tos 0x0, ttl 64, id 16334, offset 0, flags [DF], proto: TCP (6), length: 220) 202.106.0.1.45604 > 202.106.0.254.80: P
1:169(168) ack 1 win 46 <nop,nop,timestamp 5200249 5010222>
11:10:29.427992 IP (tos 0x0, ttl 64, id 16334, offset 0, flags [DF], proto: TCP (6), length: 220) 202.106.0.1.45604 > 192.168.0.118.80:
P 1:169(168) ack 1 win 46 <nop,nop,timestamp 5200249 5010222>
11:10:29.428695 IP (tos 0x0, ttl 64, id 33670, offset 0, flags [DF], proto: TCP (6), length: 52) 192.168.0.118.80 > 202.106.0.1.45604: .,
cksum 0x8b33 (correct), 1:1(0) ack 169 win 54 <nop,nop,timestamp 5010223 5200249>
11:10:29.428709 IP (tos 0x0, ttl 63, id 33670, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.254.80 > 202.106.0.1.45604: .,
cksum 0x80e9 (correct), 1:1(0) ack 169 win 54 <nop,nop,timestamp 5010223 5200249>
11:10:29.430816 IP (tos 0x0, ttl 64, id 33671, offset 0, flags [DF], proto: TCP (6), length: 328) 192.168.0.118.80 > 202.106.0.1.45604: P
1:277(276) ack 169 win 54 <nop,nop,timestamp 5010225 5200249>
11:10:29.430829 IP (tos 0x0, ttl 63, id 33671, offset 0, flags [DF], proto: TCP (6), length: 328) 202.106.0.254.80 > 202.106.0.1.45604: P 1
:277(276) ack 169 win 54 <nop,nop,timestamp 5010225 5200249>
11:10:29.430884 IP (tos 0x0, ttl 64, id 33672, offset 0, flags [DF], proto: TCP (6), length: 52) 192.168.0.118.80 > 202.106.0.1.45604: F,
cksum 0x8a1c (correct), 277:277(0) ack 169 win 54 <nop,nop,timestamp 5010225 5200249>
11:10:29.430894 IP (tos 0x0, ttl 63, id 33672, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.254.80 > 202.106.0.1.45604: F,
cksum 0x7fd2 (correct), 277:277(0) ack 169 win 54 <nop,nop,timestamp 5010225 5200249>
11:10:29.430986 IP (tos 0x0, ttl 64, id 16335, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.1.45604 > 202.106.0.254.80: .,
cksum 0x7fd0 (correct), 169:169(0) ack 277 win 54 <nop,nop,timestamp 5200252 5010225>
11:10:29.430998 IP (tos 0x0, ttl 64, id 16335, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.1.45604 > 192.168.0.118.80: .,
cksum 0x8a1a (correct), 169:169(0) ack 277 win 54 <nop,nop,timestamp 5200252 5010225>
11:10:29.431174 IP (tos 0x0, ttl 64, id 16336, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.1.45604 > 202.106.0.254.80: F,
cksum 0x7fce (correct), 169:169(0) ack 278 win 54 <nop,nop,timestamp 5200252 5010225>
11:10:29.431183 IP (tos 0x0, ttl 64, id 16336, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.1.45604 > 192.168.0.118.80: F,
cksum 0x8a18 (correct), 169:169(0) ack 278 win 54 <nop,nop,timestamp 5200252 5010225>
11:10:29.432653 IP (tos 0x0, ttl 64, id 33673, offset 0, flags [DF], proto: TCP (6), length: 52) 192.168.0.118.80 > 202.106.0.1.45604: .,
cksum 0x8a16 (correct), 278:278(0) ack 170 win 54 <nop,nop,timestamp 5010227 5200252>
11:10:29.432669 IP (tos 0x0, ttl 63, id 33673, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.254.80 > 202.106.0.1.45604: .,
cksum 0x7fcc (correct), 278:278(0) ack 170 win 54 <nop,nop,timestamp 5010227 5200252>
11:10:30.182850 IP (tos 0x0, ttl 64, id 9134, offset 0, flags [DF], proto: TCP (6), length: 60) 202.106.0.1.45605 > 202.106.0.254.80: S,
cksum 0x4d57 (correct), 3205595074:3205595074(0) win 5840 <mss 1460,sackOK,timestamp 5201004 0,nop,wscale 7>
11:10:30.182887 IP (tos 0x0, ttl 64, id 9134, offset 0, flags [DF], proto: TCP (6), length: 60) 202.106.0.1.45605 > 192.168.0.59.80: S,
cksum 0x57dc (correct), 3205595074:3205595074(0) win 5840 <mss 1460,sackOK,timestamp 5201004 0,nop,wscale 7>
11:10:30.183007 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto: TCP (6), length: 60) 192.168.0.59.80 > 202.106.0.1.45605: S,
cksum 0xc48d (correct), 3188655385:3188655385(0) ack 3205595075 win 5792 <mss 1460,sackOK,timestamp 4444161 5201004,nop,wscale 7>
11:10:30.183037 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto: TCP (6), length: 60) 202.106.0.254.80 > 202.106.0.1.45605: S,
cksum 0xba08 (correct), 3188655385:3188655385(0) ack 3205595075 win 5792 <mss 1460,sackOK,timestamp 4444161 5201004,nop,wscale 7>
11:10:30.183143 IP (tos 0x0, ttl 64, id 9135, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.1.45605 > 202.106.0.254.80: .,
cksum 0xff46 (correct), 1:1(0) ack 1 win 46 <nop,nop,timestamp 5201004 4444161>
11:10:30.183158 IP (tos 0x0, ttl 64, id 9135, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.1.45605 > 192.168.0.59.80: .,
cksum 0x09cc (correct), 1:1(0) ack 1 win 46 <nop,nop,timestamp 5201004 4444161>
11:10:30.183332 IP (tos 0x0, ttl 64, id 9136, offset 0, flags [DF], proto: TCP (6), length: 220) 202.106.0.1.45605 > 202.106.0.254.80: P
1:169(168) ack 1 win 46 <nop,nop,timestamp 5201004 4444161>
11:10:30.183344 IP (tos 0x0, ttl 64, id 9136, offset 0, flags [DF], proto: TCP (6), length: 220) 202.106.0.1.45605 > 192.168.0.59.80:
P 1:169(168) ack 1 win 46 <nop,nop,timestamp 5201004 4444161>
11:10:30.183449 IP (tos 0x0, ttl 64, id 54555, offset 0, flags [DF], proto: TCP (6), length: 52) 192.168.0.59.80 > 202.106.0.1.45605:
., cksum 0x091c (correct), 1:1(0) ack 169 win 54 <nop,nop,timestamp 4444161 5201004>
11:10:30.183462 IP (tos 0x0, ttl 63, id 54555, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.254.80 > 202.106.0.1.45605:
., cksum 0xfe96 (correct), 1:1(0) ack 169 win 54 <nop,nop,timestamp 4444161 5201004>
11:10:30.183821 IP (tos 0x0, ttl 64, id 54556, offset 0, flags [DF], proto: TCP (6), length: 347) 192.168.0.59.80 > 202.106.0.1.45605:
P 1:296(295) ack 169 win 54 <nop,nop,timestamp 4444162 5201004>
11:10:30.183833 IP (tos 0x0, ttl 63, id 54556, offset 0, flags [DF], proto: TCP (6), length: 347) 202.106.0.254.80 > 202.106.0.1.45605:
P 1:296(295) ack 169 win 54 <nop,nop,timestamp 4444162 5201004>
11:10:30.183841 IP (tos 0x0, ttl 64, id 54557, offset 0, flags [DF], proto: TCP (6), length: 52) 192.168.0.59.80 > 202.106.0.1.45605: F,
cksum 0x07f3 (correct), 296:296(0) ack 169 win 54 <nop,nop,timestamp 4444162 5201004>
11:10:30.183847 IP (tos 0x0, ttl 63, id 54557, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.254.80 > 202.106.0.1.45605: F,
cksum 0xfd6d (correct), 296:296(0) ack 169 win 54 <nop,nop,timestamp 4444162 5201004>
11:10:30.183992 IP (tos 0x0, ttl 64, id 9137, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.1.45605 > 202.106.0.254.80: .,
cksum 0xfd6d (correct), 169:169(0) ack 296 win 54 <nop,nop,timestamp 5201005 4444162>
11:10:30.184005 IP (tos 0x0, ttl 64, id 9137, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.1.45605 > 192.168.0.59.80: .,
cksum 0x07f3 (correct), 169:169(0) ack 296 win 54 <nop,nop,timestamp 5201005 4444162>
11:10:30.184187 IP (tos 0x0, ttl 64, id 9138, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.1.45605 > 202.106.0.254.80: F
, cksum 0xfd6b (correct), 169:169(0) ack 297 win 54 <nop,nop,timestamp 5201005 4444162>
11:10:30.184198 IP (tos 0x0, ttl 64, id 9138, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.1.45605 > 192.168.0.59.80: F,
cksum 0x07f1 (correct), 169:169(0) ack 297 win 54 <nop,nop,timestamp 5201005 4444162>
11:10:30.184259 IP (tos 0x0, ttl 64, id 54558, offset 0, flags [DF], proto: TCP (6), length: 52) 192.168.0.59.80 > 202.106.0.1.45605: .,
cksum 0x07f1 (correct), 297:297(0) ack 170 win 54 <nop,nop,timestamp 4444162 5201005>
11:10:30.184271 IP (tos 0x0, ttl 63, id 54558, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.254.80 > 202.106.0.1.45605: .,
cksum 0xfd6b (correct), 297:297(0) ack 170 win 54 <nop,nop,timestamp 4444162 5201005>
[root@RIP ~]# tcpdump -i eth0 -nn -vv port 80
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
11:17:13.762719 IP (tos 0x0, ttl 64, id 37999, offset 0, flags [DF], proto: TCP (6), length: 60) 202.106.0.1.32015 > 192.168.0.118.80: S,
cksum 0x4085 (correct), 3523101893:3523101893(0) win 5840 <mss 1460,sackOK,timestamp 5492906 0,nop,wscale 7>
11:17:13.763452 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto: TCP (6), length: 60) 192.168.0.118.80 > 202.106.0.1.32015: S,
cksum 0x4e10 (correct), 3686149135:3686149135(0) ack 3523101894 win 5792 <mss 1460,sackOK,timestamp 5302909 5492906,nop,wscale 7>
11:17:13.764064 IP (tos 0x0, ttl 64, id 38000, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.1.32015 > 192.168.0.118.80: .,
cksum 0x934d (correct), 1:1(0) ack 1 win 46 <nop,nop,timestamp 5492907 5302909>
11:17:13.764066 IP (tos 0x0, ttl 64, id 38001, offset 0, flags [DF], proto: TCP (6), length: 220) 202.106.0.1.32015 > 192.168.0.118.80: P
1:169(168) ack 1 win 46 <nop,nop,timestamp 5492907 5302909>
11:17:13.764110 IP (tos 0x0, ttl 64, id 50798, offset 0, flags [DF], proto: TCP (6), length: 52) 192.168.0.118.80 > 202.106.0.1.32015: .,
cksum 0x929c (correct), 1:1(0) ack 169 win 54 <nop,nop,timestamp 5302910 5492907>
11:17:13.765857 IP (tos 0x0, ttl 64, id 50799, offset 0, flags [DF], proto: TCP (6), length: 328) 192.168.0.118.80 > 202.106.0.1.32015: P
1:277(276) ack 169 win 54 <nop,nop,timestamp 5302912 5492907>
11:17:13.766052 IP (tos 0x0, ttl 64, id 50800, offset 0, flags [DF], proto: TCP (6), length: 52) 192.168.0.118.80 > 202.106.0.1.32015: F,
cksum 0x9185 (correct), 277:277(0) ack 169 win 54 <nop,nop,timestamp 5302912 5492907>
11:17:13.766696 IP (tos 0x0, ttl 64, id 38002, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.1.32015 > 192.168.0.118.80: .,
cksum 0x9183 (correct), 169:169(0) ack 277 win 54 <nop,nop,timestamp 5492910 5302912>
11:17:13.766698 IP (tos 0x0, ttl 64, id 38003, offset 0, flags [DF], proto: TCP (6), length: 52) 202.106.0.1.32015 > 192.168.0.118.80: F,
cksum 0x9181 (correct), 169:169(0) ack 278 win 54 <nop,nop,timestamp 5492910 5302912>
11:17:13.766734 IP (tos 0x0, ttl 64, id 50801, offset 0, flags [DF], proto: TCP (6), length: 52) 192.168.0.118.80 > 202.106.0.1.32015: .,
cksum 0x9180 (correct), 278:278(0) ack 170 win 54 <nop,nop,timestamp 5302913 5492910>
