8

According to tcpdump, my server receives the following TCP packet:

12:52:29.603233 00:19:e2:9e:df:f0 
00:16:3e:6a:25:3f, ethertype IPv4 (0x0800), length 74: 10.10.10.65.38869 
192.168.215.82.22: Flags [S], seq 567054335, win 5840, options [mss 1460,sackOK,TS val 2096335479 ecr 0,nop,wscale 0], length 0

As seen above, it's a TCP SYN packet to TCP port 22, where in my case listens a sshd. I would like to see, if this TCP packet reaches the sshd process. I guess one option would be to restart the sshd in debug mode. However, are there any other clever tools/methods to see if process listening on TCP port receives a message? In case of TCP SYN packet, I guess it's the kernel TCP/IP stack which will send the TCP SYN+ACK and not the sshd?

14

However, are there any other clever tools/methods to see if process listening on TCP port receives a message?

You can use strace with -e trace=network. This is what it prints on accepting a TCP connection, receiving an HTTP request, sending an HTTP response and closing the connection:

$ strace -v -f -e trace=network -p `cat logs/my_server.pid`
Process 2361 attached with 44 threads - interrupt to quit
[pid  2422] accept(11, {sa_family=AF_INET, sin_port=htons(56289), sin_addr=inet_addr("172.30.1.60")}, [16]) = 14
[pid  2422] getsockname(14, {sa_family=AF_INET, sin_port=htons(7754), sin_addr=inet_addr("172.30.1.60")}, [16]) = 0
[pid  2422] setsockopt(14, SOL_TCP, TCP_NODELAY, [1], 4) = 0
[pid  2422] setsockopt(14, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0
[pid  2422] getsockopt(14, SOL_SOCKET, SO_OOBINLINE, [515004615020773376], [4]) = 0
[pid  2388] recvfrom(14, "GET /OPEN_", 10, MSG_PEEK, NULL, NULL) = 10
[pid  2388] recvfrom(14, "GET /OPEN_SESSION?LOGIN=HAS_ADMI"..., 4096, 0, NULL, NULL) = 246
[pid  2388] sendto(14, "HTTP/1.1 200 OK\r\nServer: MY_SER"..., 192, 0, NULL, 0) = 192
[pid  2388] sendto(14, "<?xml version='1.0' encoding = '"..., 680, 0, NULL, 0) = 680
[pid  2361] --- SIGIO (I/O possible) @ 0 (0) ---
[pid  2388] recvfrom(14, "", 4096, 0, NULL, NULL) = 0
[pid  2388] shutdown(14, 2 /* send and receive */) = 0
  • And with colors: strace $CMD 2>&1 > /dev/null | vim -c ':set syntax=strace' -. – Pablo Bianchi Aug 27 '17 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.