我在 Linux 系統中發現了一個奇怪的行為,當我捲曲網頁時,收到的 TCP 段明顯大於 MSS。
這是 tcpdump 的輸出:
00:00:00.000000 IP 10.15.71.190.44503 > 115.239.210.27.80:標誌 [S],seq 248491621,win 29200,選項 [mss 1460,sackOK,TS val 294137 ecr 0,nop,wscale 7],長度0 00:00:00.004210 IP 115.239.210.27.80 > 10.15.71.190.44503:標誌[S.],seq 1384820706,ack 248491622,win 29200,選項[mss 1380,sackOK,nop,nop,nop,no p,不, nop,nop,nop,nop,nop,nop,wscale 7],長度 0 00:00:00.000063 IP 10.15.71.190.44503 > 115.239.210.27.80:標誌[.],ack 1,win 229,長度0 00:00:00.000082 IP 10.15.71.190.44503 > 115.239.210.27.80:標誌 [P.],seq 1:78,ack 1,win 229,長度 77 00:00:00.004187 IP 115.239.210.27.80 > 10.15.71.190.44503:標誌[.],ack 78,win 193,長度0 00:00:00.002929 IP 115.239.210.27.80 > 10.15.71.190.44503:標誌 [P.],seq 1:819,ack 78,win 193,長度 818 00:00:00.000032 IP 10.15.71.190.44503 > 115.239.210.27.80:標誌[.],ack 819,win 241,長度0 00:00:00.000075 IP 115.239.210.27.80 > 10.15.71.190.44503:標誌 [P.],seq 819:16385,ack 78,win 193,長度 15566 00:00:00.000016 IP 10.15.71.190.44503 > 115.239.210.27.80:標誌[.],ack 16385,win 485,長度0 00:00:00.000016 IP 115.239.210.27.80 > 10.15.71.190.44503:標誌 [.],seq 16385:19105,ack 78,win 193,長度 2720 00:00:00.000009 IP 10.15.71.190.44503 > 115.239.210.27.80:標誌[.],ack 19105,win 527,長度0 00:00:00.000086 IP 115.239.210.27.80 > 10.15.71.190.44503:標誌 [.],seq 19105:20465,ack 78,win 193,長度 1360 00:00:00.000009 IP 10.15.71.190.44503 > 115.239.210.27.80:標誌[.],ack 20465,win 548,長度0 00:00:00.001338 IP 115.239.210.27.80 > 10.15.71.190.44503:標誌 [.],seq 20465:28625,ack 78,win 193,長度 8160 00:00:00.000015 IP 10.15.71.190.44503 > 115.239.210.27.80:標誌[.],ack 28625,win 676,長度0 00:00:00.132259 IP 115.239.210.27.80 > 10.15.71.190.44503:標誌 [.],seq 28625:42225,ack 78,win 193,長度 13600 00:00:00.000027 IP 10.15.71.190.44503 > 115.239.210.27.80:標誌[.],ack 42225,win 888,長度0 00:00:00.003511 IP 115.239.210.27.80 > 10.15.71.190.44503:標誌 [P.],seq 42225:55825,ack 78,win 1930,長度 13600 00:00:00.000035 IP 10.15.71.190.44503 > 115.239.210.27.80:標誌[.],ack 55825,win 1101,長度0 00:00:00.000041 IP 115.239.210.27.80 > 10.15.71.190.44503:標誌 [.],seq 55825:58545,ack 78,win 193,長度 2720 00:00:00.000033 IP 10.15.71.190.44503 > 115.239.210.27.80:標誌[.],ack 58545,win 1143,長度0 00:00:00.001683 IP 115.239.210.27.80 > 10.15.71.190.44503:標誌 [.],seq 58545:61265,ack 78,win 193,長度 2720 00:00:00.000012 IP 10.15.71.190.44503 > 115.239.210.27.80:標誌[.],ack 61265,win 1186,長度0 00:00:00.000027 IP 115.239.210.27.80 > 10.15.71.190.44503:標誌 [.],seq 61265:63985,ack 78,win 193,長度 2720 00:00:00.000007 IP 10.15.71.190.44503 > 115.239.210.27.80:標誌[.],ack 63985,win 1228,長度0 00:00:00.000034 IP 115.239.210.27.80 > 10.15.71.190.44503:標誌 [.],seq 63985:69425,ack 78,win 193,長度 5440 00:00:00.000008 IP 10.15.71.190.44503 > 115.239.210.27.80:標誌[.],ack 69425,win 1313,長度0 00:00:00.001476 IP 115.239.210.27.80 > 10.15.71.190.44503:標誌 [.],seq 69425:83025,ack 78,win 1930 00:00:00.000033 IP 10.15.71.190.44503 > 115.239.210.27.80:標誌[.],ack 83025,win 1300,長度0 00:00:00.004061 IP 115.239.210.27.80 > 10.15.71.190.44503:標誌 [P.],seq 83025:89274,ack 78,win 193,長度 624 00:00:00.000026 IP 10.15.71.190.44503 > 115.239.210.27.80:標誌[.],ack 89274,win 1380,長度0 00:00:00.000139 IP 10.15.71.190.44503 > 115.239.210.27.80:標誌 [F.],seq 78,ack 89274,win 1411,長度 0 00:00:00.004609 IP 115.239.210.27.80 > 10.15.71.190.44503:標誌[.],ack 79,win 193,長度0 00:00:00.000038 IP 115.239.210.27.80 > 10.15.71.190.44503:標誌 [F.],seq 89274,ack 79,win 193,長度 0 00:00:00.000018 IP 10.15.71.190.44503 > 115.239.210.27.80:標誌[.],ack 89275,win 1411,長度0
可以看到,在TCP握手中,MSS是1380。
我不知道怎麼會發生這種情況,我的本地連結的 MTU 為 1500。
答案1
也許 Linux 系統中的 NIC 啟用了一些硬體 TCP 卸載功能,因此核心在 NIC 處理封包之前不會看到封包(從而修改結果)。