Reports that say that something hasn’t happened are always interesting to me, because as we know, there are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns—the ones we don’t know we don’t know. And if one looks throughout the history of our country and other free countries, it is the latter category that tend to be the difficult ones.
if there is new data to send
if the window size >= MSS and available data is >= MSS
send complete MSS segment now
else
if there is unconfirmed data still in the pipe
enqueue data in the buffer until an acknowledge is received
else
send data immediately
end if
end if
end if
-D Set the Don’t Fragment bit. -s packetsize Specify the number of data bytes to be sent. The default is 56, which translates into 64 ICMP data bytes when combined with the 8 bytes of ICMP header data. This option cannot be used with ping sweeps.
ping 测试
1 2 3 4 5 6 7 8 9 10 11 12 13 14
✘ ren@mac ~/Downloads ping -c 1 -D -s 1500 www.baidu.com PING www.a.shifen.com (110.242.68.4): 1500 data bytes ping: sendto: Message too long ^C --- www.a.shifen.com ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss ✘ ren@mac ~/Downloads ping -c 1 -D -s 1400 www.baidu.com PING www.a.shifen.com (110.242.68.4): 1400 data bytes 1408 bytes from 110.242.68.4: icmp_seq=0 ttl=49 time=21.180 ms
当然这里TCP协商MSS的时候应该经过 PMTUD（ This process is called “Path MTU discovery”.） 来确认整个路由上的所有最小MTU，但是有些路由器会因为安全的原因过滤掉ICMP，导致PMTUD不可靠，所以这里的PMTUD形同虚设，比如在我们的三次握手中会协商一个MSS，这只是基于Client和Server两方的MTU来确定的，链路上如果还有比Client和Server的MTU更小的那么就会出现包超过MTU的大小，同时设置了DF标志而不再进行分片被丢掉。
# show router information $ route -ne $ ip route show 192.168.11.0/24 dev ens33 proto kernel scope link src 192.168.11.111 metric 100 # modify route table $ sudo ip route change 192.168.11.0/24 dev ens33 proto kernel scope link src 192.168.11.111 metric 100 advmss 48
rotating pattern: /var/log/myapp/*.log weekly (4 rotations) empty log files are rotated, old logs are removed considering log /var/log/myapp/default.log
error: skipping "/var/log/myapp/default.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation
rotating pattern: /var/log/myapp/*.log weekly (4 rotations) empty log files are rotated, old logs are removed considering log /var/log/myapp/default.log
error: skipping "/var/log/myapp/default.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation
ipset is an extension to iptables that allows you to create firewall rules that match entire “sets” of addresses at once. Unlike normal iptables chains, which are stored and traversed linearly, IP sets are stored in indexed data structures, making lookups very efficient, even when dealing with large sets.
If you would rather deny all connections and manually specify which ones you want to allow to connect, you should change the default policy of your chains to drop. Doing this would probably only be useful for servers that contain sensitive information and only ever have the same IP addresses connect to them.
