This simple network trace shows the essential elements of a network interaction between a client and a server.
For our test, we use the following for the client…
import sys, socket, time
remote_ip = socket.gethostbyname(socket.gethostname())
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
#s.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 0)
s.connect((remote_ip, int(sys.argv[1])))
#s.send("foobar",socket.TCP_NODELAY)
s.send("foobar")
…and the following for the server…
import socket, sys, random
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
port = random.randint(3000,45000)
s.bind((socket.gethostname(), port))
s.listen(10)
print "started server on port ",port
while 1:
conn, addr = s.accept()
#print 'Connected with ' + addr[0] + ':' + str(addr[1])
data = conn.recv(2048)
if not data:
break
conn.sendall(data)
conn.close()
s.close()
You can then the test with the following…
[root@cmhlcarchapp02 ~]# python server.py & [11] 20465 [root@cmhlcarchapp02 ~]# started server on port 36857 [root@cmhlcarchapp02 ~]# tcpdump port 36857 -i lo -w /tmp/tcp.pcap & [12] 20469 [root@cmhlcarchapp02 ~]# tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on lo, link-type EN10MB (Ethernet), capture size 65535 bytes [root@cmhlcarchapp02 ~]# python client.py 36857
After running the /tmp/tcp.pcap file above through wireshark, we first see the three way handshake. This consists of the initial client SYN sent to the server, the server responding with the initial SYN and ACK of the client SYN, and the client responding to the server SYN with its own ACK. This sets up the conversation.
We then send data to the server represented below by the first PSH, ACK, and the next ACK. This is the client sending data and an ACK, and the server ACK’ing that it received it. Please note that if we uncommented the send call with TCP_NODELAY set and commented the other send call, we would see a PSH call with the URG (urgent) flag set.
In our test program, the server responds to the client with its own data. This is represented below by the second PSH, ACK and the next ACK. The data is PSH’d from the server with an ACK, and the client sends an ACK acknowledging that it received it.
Finally, the client closes the connection by sending a FIN and an ACK to the server, to which the server responds with its acknowledgement of the same.
