鍍金池/ 問答/網(wǎng)絡(luò)安全/ 從僵死應(yīng)用的wireshark tcp包能看出可能的問題原因嗎

從僵死應(yīng)用的wireshark tcp包能看出可能的問題原因嗎

線上有一Python應(yīng)用 偶爾會(huì)有僵死的情況 即進(jìn)程在但是調(diào)用Api接口卻提示

curl: (56) Recv failure: Connection reset by peer

在本地通過wireshark抓包 tcp包如下

"TCP","78","0.000000","51325 → 8000 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=32 TSval=736973079 TSecr=0 SACK_PERM=1"
"TCP","74","0.039896","8000 → 51325 [SYN, ACK] Seq=0 Ack=1 Win=28960 Len=0 MSS=1452 SACK_PERM=1 TSval=1018915739 TSecr=736973079 WS=128"
"TCP","66","0.040025","51325 → 8000 [ACK] Seq=1 Ack=1 Win=132480 Len=0 TSval=736973119 TSecr=1018915739"
"HTTP","280","0.040185","POST /CRFTag/textEmotionTag HTTP/1.1  (application/json)"
"TCP","280","0.221089","[TCP Retransmission] 51325 → 8000 [PSH, ACK] Seq=1 Ack=1 Win=132480 Len=214 TSval=736973299 TSecr=1018915739"
"TCP","280","0.362219","[TCP Retransmission] 51325 → 8000 [PSH, ACK] Seq=1 Ack=1 Win=132480 Len=214 TSval=736973440 TSecr=1018915739"
"TCP","280","0.804312","[TCP Retransmission] 51325 → 8000 [PSH, ACK] Seq=1 Ack=1 Win=132480 Len=214 TSval=736973881 TSecr=1018915739"
"TCP","280","1.486962","[TCP Retransmission] 51325 → 8000 [PSH, ACK] Seq=1 Ack=1 Win=132480 Len=214 TSval=736974561 TSecr=1018915739"
"TCP","74","1.624576","[TCP Spurious Retransmission] 8000 → 51325 [SYN, ACK] Seq=0 Ack=1 Win=28960 Len=0 MSS=1452 SACK_PERM=1 TSval=1018917328 TSecr=736974561 WS=128"
"TCP","66","1.624652","[TCP Dup ACK 3#1] 51325 → 8000 [ACK] Seq=215 Ack=1 Win=132480 Len=0 TSval=736974698 TSecr=1018915739"
"TCP","280","2.651312","[TCP Retransmission] 51325 → 8000 [PSH, ACK] Seq=1 Ack=1 Win=132480 Len=214 TSval=736975721 TSecr=1018915739"
"TCP","74","3.844019","[TCP Spurious Retransmission] 8000 → 51325 [SYN, ACK] Seq=0 Ack=1 Win=28960 Len=0 MSS=1452 SACK_PERM=1 TSval=1018919528 TSecr=736975721 WS=128"
"TCP","66","3.844093","[TCP Dup ACK 3#2] 51325 → 8000 [ACK] Seq=215 Ack=1 Win=132480 Len=0 TSval=736976909 TSecr=1018915739"
"TCP","280","4.779702","[TCP Retransmission] 51325 → 8000 [PSH, ACK] Seq=1 Ack=1 Win=132480 Len=214 TSval=736977841 TSecr=1018915739"
"TCP","280","7.872911","[TCP Retransmission] 51325 → 8000 [PSH, ACK] Seq=1 Ack=1 Win=132480 Len=214 TSval=736980924 TSecr=1018915739"
"TCP","280","13.848645","[TCP Retransmission] 51325 → 8000 [PSH, ACK] Seq=1 Ack=1 Win=132480 Len=214 TSval=736986884 TSecr=1018915739"
"TCP","60","13.886028","8000 → 51325 [RST] Seq=1 Win=0 Len=0"

重啟應(yīng)用后 就恢復(fù)正常了 此時(shí)的wireshark日志如下

"TCP","78","0.000000","50048 → 8000 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=32 TSval=837789964 TSecr=0 SACK_PERM=1"
"TCP","74","0.037032","8000 → 50048 [SYN, ACK] Seq=0 Ack=1 Win=28960 Len=0 MSS=1460 SACK_PERM=1 TSval=1397333536 TSecr=837789964 WS=128"
"TCP","66","0.037111","50048 → 8000 [ACK] Seq=1 Ack=1 Win=131744 Len=0 TSval=837790001 TSecr=1397333536"
"HTTP","280","0.037243","POST /CRFTag/textEmotionTag HTTP/1.1  (application/json)"
"TCP","66","0.073054","8000 → 50048 [ACK] Seq=1 Ack=215 Win=30080 Len=0 TSval=1397333572 TSecr=837790001"
"TCP","83","0.078404","[TCP segment of a reassembled PDU]"
"TCP","66","0.078473","50048 → 8000 [ACK] Seq=215 Ack=18 Win=131744 Len=0 TSval=837790042 TSecr=1397333578"
"HTTP","365","0.079349","HTTP/1.0 200 OK  (application/json)"
"TCP","66","0.079418","50048 → 8000 [ACK] Seq=215 Ack=318 Win=131424 Len=0 TSval=837790042 TSecr=1397333578"
"TCP","66","0.079570","50048 → 8000 [FIN, ACK] Seq=215 Ack=318 Win=131424 Len=0 TSval=837790043 TSecr=1397333578"
"TCP","66","0.114651","8000 → 50048 [ACK] Seq=318 Ack=216 Win=30080 Len=0 TSval=1397333614 TSecr=837790043"

從異常的tcp包中 能看出什么端倪嗎?可能是什么原因?qū)е聭?yīng)用不可用的呢?下次再有僵死的情況 該怎么確認(rèn)是不是這個(gè)原因呢?

回答
編輯回答
脾氣硬
重啟 python 應(yīng)用就恢復(fù)正常

那極可能是客戶端的問題,應(yīng)該檢查應(yīng)用層的代碼。比如 DNS 解析錯(cuò)誤。

2017年10月13日 01:14
編輯回答
我以為

可以看出TCP連接在建立的時(shí)候前兩個(gè)握手包都好像是正常的,但從第三個(gè)包開始,就可以發(fā)現(xiàn)服務(wù)器似乎“收不到”第三個(gè)包,于是服務(wù)器在中間重傳了若干次SYN, ACK包,而客戶端也重傳了好幾次對(duì)服務(wù)器的SYN, ACK包的ACK包。最終連接超時(shí),服務(wù)器重置了連接。不是很清楚到底發(fā)生了什么,可能需要在服務(wù)器端也抓個(gè)包看看。


是過一段時(shí)間就會(huì)發(fā)生連接的問題嗎?有可能是服務(wù)器負(fù)載太大了?

2018年9月20日 11:53