Ukuhlolwa kokushintsha: ingabe i-TCP stream esivele isunguliwe iyasinda?

Imiphumela emibili icashile emshweni wokuthi isipele siyasebenza. Isicelo esisha siyaphumelela, lokho ukubuyiselwa. Ukudluliswa okusuvele kuqhubeka kuyaghubeka, lokho ukuqhubeka. Lezi zethembiso ezihlukene, futhi iningi lamadizayini okushintsha linikeza eyokuqala kuyilapho eyesibili iphelelwa isikhathi buthule. Thatha isinqumo sokuthi iyiphi oyidingayo ngaphambi kokukhetha indlela, futhi bhala ukuhlolwa ukuze kukwazi ukuhlukanisa zombili.

Imiphumela emibili ebukeka njengempumelelo eyodwa

Cabanga ngeklayenti ku-10.90.0.42 elinokuxhumana ku-198.51.100.20:443. Indawo yokuphuma eyinhloko iyihumusha ibe ikheli elilodwa lomphakathi kanye nechweba, kanti indawo yokuphuma eyisipele iyihumusha ibe elinye. Ikheli langaphakathi leklayenti alishintshi nanini, yingakho abantu belindela ukuthi ukuxhumana kuzosinda.

Iseva ayiboni ikheli langaphakathi. Ibona iphoyinti lokugcina elihumushiwe, futhi lelo phoyinti lihlukile ngemva kokushintsha.

Ngakho i-stream endala iyaphela ngesikhathi kuyilapho ukuxhumana okusha kuleyo nsizakalo kusebenza ngokushesha. Kokubili ukubona kuyiqiniso ngesikhathi esisodwa.

Iseva ibona ini lapho indawo yokuphuma ishintsha

Ukuxhumana kwe-TCP kubonakala ngezingxenye zako ezine, futhi ukushintsha ikheli noma ichweba lomthombo kwakha okunye ukuxhumana ngokombono womsingathi owamukelayo. Amaphakethe afika evela emthonjeni omusha kuxhumano iseva engayazi ayalahlwa noma aphendulwe ngokusetha kabusha. Akukho lutho ekhelini leklayenti le-VPN okugcina ukuxhumana phakathi nalolo shintsho.

Ukushintsha okunesimo kukhona khona ukuze kugwenywe lokhu, futhi kusebenza ngokushintshana kwesimo sokuhumusha nesimo sokuxhumana phakathi kwamadivayisi adlulisayo. Lesi yisici sombhangqwana, hhayi somhubhe, futhi kufanele kuklanywe futhi kuhlolwe esikhundleni sokucatshangwa.

Hlola ukuthi umbhangqwana ugcina ngempela isimo ngaphambi kokuthembisa othile ukuqhubeka. Imiyalo ngezansi ikhombisa isimo samanje ezinhlangothini zombili.

conntrack -L -d 198.51.100.20 2>/dev/null | head
ss -tin dst 198.51.100.20
tcpdump -ni any host 198.51.100.20 -c 10

Kungani ikheli elifanayo lomphakathi linele

Ukugcina ikheli elilodwa lomphakathi ezindleleni zombili isiqalo esihle, ngoba iseva ibona iphoyinti lomthombo elifanayo. Kodwa lokho kuphela akwanele. Idivayisi edlulisayo isadinga isimo sokuhumusha, isimo somlilo kanye nendlela yokubuya esebenzisekayo, futhi lokho kufanele kube khona kudivayisi ethwala ithrafikhi ngemva kokushintsha.

I-RFC 3022 ichaza ukuhumusha kwamakheli futhi ithatha ukushintshana kwesimo phakathi kwamadivayisi ahumushayo njengengxenye yedizayini yesipele. Ikheli elintantayo noma iphrofayela ekhoshiwe ihambisa ukumiswa kodwa ayihambisi isimo.

Yingakho ukuhlolwa okwenza i-ping kuphela ngesipele kufakazela okuncane kakhulu. I-ping ayinaso isimo sokuxhumana engasingalahla.

Thatha isinqumo sokuthi isidingo sinamandla kangakanani

Uma abasebenzisi bengakwazi ukuxhumanisa kabusha ngemva kokwehluleka, idizayini iyidizayini yokubuyisela futhi ukuhlolwa kokwamukela kuyisicelo esisha. Uma ukudluliswa kwefayela kufanele kusinde, idizayini idinga ukuvumelanisa kwesimo nokuhlolwa okuqaphele kakhulu. Uma iseshini ekude kufanele isinde, isidingo sinamandla nakakhulu futhi kungase kudingeke indlela yezinga lohlelo esikhundleni sezinga lenethiwekhi.

Bhala isidingo njengomusho onomphumela okalekayo, isibonelo ukulayisha kuphela ngaphandle kokuqala kabusha noma umsebenzi uxhumana kabusha phakathi komzuzu. Bese ukhetha indlela eshibhile eyanelisa lokho, futhi ngokuvamile yilowo dizayini wokubuyisela.

Shono ngokusobala ukuthi kwenzekani lapho indlela eyinhloko ibuya, ngoba ukubuyela okuzenzakalelayo kungase kunqamule ukuxhumana okusanda kubuyiselwa kusipele. Lelo cala liyingxenye yohlelo lokuhlola, hhayi umbhalo waphansi.

Hlola i-stream endala nesicelo esisha

Qala ukudluliswa okude okungenabungozi ngendlela eyinhloko, bese kuba isicelo esisha esihlukile kuleyo nsizakalo. Rekhoda umongo wohlelo, ikheli lokuphuma eliboniwe kanye nesikhathi. Nqamula indlela eyinhloko ngendlela evunyelwe futhi uqhubeke ubuka ukudluliswa kwasekuqaleni ngenkathi uthumela isicelo esisha ngesipele.

Bika amanani amathathu: ingabe i-stream endala yaqhubeka, yasethwa kabusha noma yaphela ngesikhathi; ukuthi umsebenzi omusha waqala nini ukusebenza; nokuthi ukubuyela kunqamule ini. Leyo mithathu imigqa iyirekhodi lokwamukela.

ss -tin dst 198.51.100.20
curl -sS -o /dev/null -w '%{http_code} %{time_total}\n' https://198.51.100.20/
tcpdump -ni any port 443 -c 20

Uma umthwalo womsebenzi ubhala idatha, ungaphindi ngobumpumputhe umsebenzi ongaqinisekile ngemva kokuphela kwesikhathi. Ukubhala kungenzeka kwafika ngaphambi kokulahleka kwempendulo. Buza uhlelo umphumela, noma phinda uzame kuphela lapho umsebenzi u-idempotent. Bese bhala isitatimende sokwamukela ngezingxenye ezintathu: imisebenzi emisha iyabuyiselwa ngaphansi kwenqubomgomo yokuphuma, imifudlana ekhona inokuziphatha kokuphazamiseka okurekhodiwe, futhi uhlelo luqhubeka ngokuphephile. Leso sitatimende siyahloleka, futhi sithembekile mayelana nalokho idizayini engakuthembisi.