问题的提出

最近在准备客户端的新版本，在内部灰度过程中，发现一类奇怪的 dump，通过查看日志和堆栈，可以确定是因为每次连上后台就被后台断开了、导致多次重连后随机发生的崩溃。dump 和日志都无法提供进一步的信息来定位问题，本地又不复现，也没有办法去联系用户查看现场 (windows 服务崩溃后自动重启，用户不感知)。于是想到能不能自己制造这样的场景 —— 当连接建立后立即断开该连接 —— 看是否会复现崩溃。

问题的解决

tcpview

在 windows 上最直观的解决方案就是手动断开连接啦，拿出 sysinternal 工具集，翻出 tcpview，就可以看到系统上所有的 tcp 连接了：

除了能看到建立的 tcp 连接所属进程、本地地址/端口号、远端地址/端口号外、连接状态外，还可以看到一些连接上的统计信息，如收发包数和字节数等。高亮的那一行就是我想要杀掉的连接。在 tcpview 里杀连接很简单，直接右键菜单 ‘Close Connection’ 即可。但是这样做的问题是，每次从看到连接到杀死连接要经历一定时间 (手动操作)，甚至进程日志已经显示连接建立了，tcpview 还没有刷出来，总而言之就是一个字 —— 慢，杀了十几次，挂上调试器的进程纹丝不动，一点要崩溃的迹象也没有 (关键是还手疼)，汗~

tcpkill

都 2020 年了，自动化工具用起来，查了一下，tcpview 除了界面外没有提供类似命令行的功能，于是只能在网上搜 “什么命令能杀掉 tcp 连接” 了，百度到一个 tcpkill，这个命令是原生于 linux 的，需要先安装 dsniff 工具包

  1. $ sudo yum install dsniff

安装成功后就可以实操一下了

  1. $ tcpkill
  2. Version: 2.4
  3. Usage: tcpkill [-i interface] [-1..9] expression

help 和 man 都太过简单，其实重点就是最后这个参数 expression，貌似是使用和 tcpdump 相同的格式，为了验证 tcpkill，我先搭建了一个简单的测试环境：

  1. $ nc -4 -l -p 5555

使用 nc 创建一个在 5555 端口监听的进程；

  1. $ nc -4 localhost 5555 -p 6666

在另外一个终端中创建一个进程去连接 5555 端口，它自己的端口是 6666；

  1. $ netstat -antp
  2. (Not all processes could be identified, non-owned process info
  3.  will not be shown, you would have to be root to see it all.)
  4. Active Internet connections (servers and established)
  5. Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
  6. ……
  7. tcp        0      0 127.0.0.1:5555          127.0.0.1:6666          ESTABLISHED 2451/nc
  8. tcp        0      0 127.0.0.1:6666          127.0.0.1:5555          ESTABLISHED 2470/nc
  9. ……

可以通过 netstat 命令查看到建立的这个连接及其端口号。下面用 tcpkill 杀掉这个连接，这里使用指定 6666 端口的方式：

  1. $ sudo tcpkill -i lo port 6666
  2. tcpkill: listening on lo [port 6666]
  3. 127.0.0.1:6666 > 127.0.0.1:5555: R 18446744073486680909:18446744073486680909(0) win 0
  4. 127.0.0.1:6666 > 127.0.0.1:5555: R 18446744073486681251:18446744073486681251(0) win 0
  5. 127.0.0.1:6666 > 127.0.0.1:5555: R 18446744073486681935:18446744073486681935(0) win 0
  6. 127.0.0.1:5555 > 127.0.0.1:6666: R 18446744071881223293:18446744071881223293(0) win 0
  7. 127.0.0.1:5555 > 127.0.0.1:6666: R 18446744071881223635:18446744071881223635(0) win 0
  8. 127.0.0.1:5555 > 127.0.0.1:6666: R 18446744071881224319:18446744071881224319(0) win 0

打印了一堆莫名其妙的信息，看 netstat 输出的话，那个连接还是 ESTABLISHED 状态，但是通过在控制台输入一些字符 (例如 abc) 来发送数据后，连接中断、进程退出

  1. $ nc -4 localhost 5555 -p 6666
  2. hello
  3. world
  4. abc
  5. Ncat: Connection reset by peer.

在 5555 端口监听的进程由于连接中断也自动退出了

  1. $ nc -4 -l -p 5555
  2. hello
  3. world
  4. abc

此时再看 netstat 输出，就看不到这条连接的相关信息了。看相关文章，貌似是这个命令向连接发送了伪造的 rst 包，所以只有当下次客户端再请求时，才会发现连接已经中断了。而且 tcpkill 好像会一直运行，只要它发现在 6666 这个端口建立了连接，就会去尝试中断。虽然后面这个特性挺好，但是连接只有在下一次发送数据时才能检测到中断这事，实效性差那么点儿意思；最麻烦的是我在 windows 的 msys2 环境中，没有这个命令可用，看来这个命令依赖的一些 linux 底层机制在 win32 上不太好实现，于是果断放弃。

cports

下面百度的重点就放在了 “windows 上可以杀掉 tcp 连接的命令” 了，结果还真被找到一个 —— CurrPorts，它本身是个 UI 工具，界面和 tcpview 很类似：

输出的信息大同小异，都是进程、协议、本地地址/端口、远程地址/端口、连接状态等 (其实还少了一些连接上的统计信息)。然后关闭连接也是通过选中项目后右键菜单来实现的：

光看菜单的话，感觉比 tcpview 功能丰富多了，比如光选项就有这么多：

确实比 tcpview 要好用一些，但是使用右键菜单来关闭连接，貌似和之前没有多大分别呢 (虽然可以使用 Ctrl+T 快捷方式)。不要急，下面着重说一下 CurrPorts 的命令行参数，这是区别于 tcpview 的一大优势：

/stext <Filename> Save the list of all opened TCP/UDP ports into a regular text file.
/stab <Filename> Save the list of all opened TCP/UDP ports into a tab-delimited text file.
/scomma <Filename> Save the list of all opened TCP/UDP ports into a comma-delimited text file.
/stabular <Filename> Save the list of all opened TCP/UDP ports into a tabular text file.
/shtml <Filename> Save the list of all opened TCP/UDP ports into HTML file (Horizontal).
/sverhtml <Filename> Save the list of all opened TCP/UDP ports into HTML file (Vertical).
/sxml <Filename> Save the list of all opened TCP/UDP ports to XML file.
/CaptureTime <Milliseconds> Specifies the capture time in milliseconds for the save command-line options (/stext, /stab, /scomma, and so on...)

Example:


cports.exe /RunAsAdmin /scomma c:\temp\ports1.csv /CaptureTime 15000
/RunAsAdmin Runs CurrPorts as Administrator.
/sort <column> This command-line option can be used with other save options for sorting by the desired column.
If you don't specify this option, the list is sorted according to the last sort that you made from the user interface.
The <column> parameter can specify the column index (0 for the first column, 1 for the second column, and so on) or
the name of the column, like "Remote Port" and "Remote Address".
You can specify the '~' prefix character (e.g: "~Remote Address") if you want to sort in descending order.
You can put multiple /sort in the command-line if you want to sort by multiple columns.

Examples:

cports.exe /shtml "f:\temp\1.html" /sort 2 /sort ~1

cports.exe /shtml "f:\temp\1.html" /sort "Protocol" /sort "~Remote Address"
/nosort When you specify this command-line option, the list will be saved without any sorting.
/filter <filter string> Start CurrPorts with the specified filters.
If you want to specify more than one filter, use the ';' character as a delimiter.
/cfg <cfg filename> Start CurrPorts with the specified config file.

/MarkPorts

/DisplayUdpPorts

/DisplayTcpPorts

/DisplayClosedPorts

/MarkNewModifiedPorts

/SortOnAutoRefresh

/AlwaysOnTop

/AskBefore

/DisplayIPv6Ports

/DisplayListening

/DisplayEstablished

/DisplayNoState

/DisplayNoRemoteIP

/ResolveAddresses

/RememberLastFilter

/DisplayPortInAddress

/AutoRefresh,

/ShowInfoTip

/TrayIcon

/TrayIconOneClick

/StartAsHidden

/LogChanges

/LogFilename

/DisabledFilters

/AddExportHeaderLine

 You can use all these parameters to control the options that are available under the Options and View menus.


For example, if you want to start CurrPorts with 'Display UDP Ports' turned off and 'Display Closed' turned on:

cports.exe /DisplayUdpPorts 0 /DisplayClosedPorts 1

You can also use these parameters in conjunction with all save parameters. For example:
If you want to save into tab-delimited file only the UDP ports:

cports.exe /DisplayUdpPorts 1 /DisplayTcpPorts 0 /stab "c:\temp\udp.txt"

看了一圈儿，好像都是将结果保存到文件的一些选项，还好下面有一段话是专门说明如何关闭连接的：

  1. Closing a Connection From Command-Line
  2. Starting from version 1.09, you can close one or more connections from command-line, by using /close parameter.
  3. The syntax of /close command:
  4. /close <Local Address> <Local Port> <Remote Address> <Remote Port> {Process Name/ID}
  5.  
  6. For each parameter, you can specify "*" in order to include all ports or addresses. The process name is an optional parameter. If you specify a process, only the ports of the specified process will be closed.
  7. Examples:
  8.  
  9.     Close all connections with remote port 80 and remote address 192.168.1.10:
  10.     /close * * 192.168.1.10 80
  11.     Close all connections with remote port 80 (for all remote addresses):
  12.     /close * * * 80
  13.     Close all connections to remote address 192.168.20.30:
  14.     /close * * 192.168.20.30 *
  15.     Close all connections with local port 80:
  16.     /close * 80 * *
  17.     Close all connections of Firefox with remote port 80:
  18.     /close * * * 80 firefox.exe
  19.     Close all connections of the process that its ID is 3276:
  20.     /close * * * * 3276

给出了丰富的示例，例如针对我们的场景，可以这样调用 cports (UI 叫 CurrPorts，但命令名为 cports.exe)：

  1.  cports /close * * xxx.xxx.xx.xx 3570 gdphost.exe

其中 xxx 部分是连接的远端 IP 地址，3570 是远端端口，gdphost.exe 是发起连接的进程名。当 cmd 以管理员权限运行，上面的调用是可以杀死连接的，但是在 msys2 bash (其实就是 git bash 啦) 中运行却直接启动了 CurrPorts 工具的 UI 界面。问题可能出在 /close 被 bash 作了转义识别上，用双引号将它们包含一下：

  1. cports "/close" "*" "*" "xxx.xxx.xx.xx" "3570" "gdphost.exe"

结果还是不行，经过一翻研究，改成下面这样就可以了：

  1. cports "//close" "*" "*" "xxx.xxx.xx.xx" "3570" "gdphost.exe"

在 msys2 bash 中要对 win32 命令的选项开始符 '/' 使用转义符前缀，否则 bash 会认为 /close 是一个目录(?)而非参数，从而进行某种转换(?)。又研究了一下双引号的作用，发现对于星号还是必需加上的，其它的参数可以不加，于是最后版本就成了这样：

  1. cports "//close" "*" "*" xxx.xxx.xx.xx 3570 gdphost.exe

注意 cports 所在目录我是添加到了 Path 环境变量，所以可以这样直接写命令，否则必需提供 cports 的完整路径。另外这个 bash 也必需以管理员权限启动，不然命令虽然可以返回，但是没有发生任何实质性影响。

完整脚本

有了 cports 的底层支持，我们就可以这样写脚本来自动断开连接“伪造”事发现场啦：

  1.  1 #! /bin/sh
  2.  2 while true
  3.  3 do
  4.  4   n=$(netstat -ano | grep 3570 | wc -l)
  5.  5   if [ $n -gt 0 ]; then
  6.  6     cports "//close" "*" "*" "*" 3570 gdphost.exe
  7.  7     echo "close connection"
  8.  8   else
  9.  9     echo "no connection find"
  10. 10   fi
  11. 11 done

加了一点简单的逻辑，在运行循环中首先通过 netstat 判断有没有在 3570 端口建立的连接，如果有就调用 cports 去断开；如果没有就继续循环，直到 Ctrl+C 结束。脚本运行起来后，结合图形界面、可以看到这个进程到后台的连接在不停的断开重连，下面是观察到脚本的一些输出 (内容较多、展开慎重)：

  1. $ ./kill.sh
  2. close connection
  3. no connection find
  4. no connection find
  5. no connection find
  6. no connection find
  7. no connection find
  8. no connection find
  9. no connection find
  10. no connection find
  11. no connection find
  12. no connection find
  13. no connection find
  14. no connection find
  15. no connection find
  16. no connection find
  17. no connection find
  18. no connection find
  19. no connection find
  20. no connection find
  21. no connection find
  22. no connection find
  23. no connection find
  24. no connection find
  25. no connection find
  26. no connection find
  27. no connection find
  28. no connection find
  29. no connection find
  30. no connection find
  31. no connection find
  32. no connection find
  33. no connection find
  34. no connection find
  35. no connection find
  36. no connection find
  37. no connection find
  38. no connection find
  39. no connection find
  40. no connection find
  41. no connection find
  42. no connection find
  43. no connection find
  44. no connection find
  45. no connection find
  46. no connection find
  47. no connection find
  48. no connection find
  49. no connection find
  50. no connection find
  51. no connection find
  52. no connection find
  53. no connection find
  54. no connection find
  55. no connection find
  56. no connection find
  57. no connection find
  58. no connection find
  59. no connection find
  60. no connection find
  61. no connection find
  62. no connection find
  63. no connection find
  64. no connection find
  65. no connection find
  66. no connection find
  67. no connection find
  68. no connection find
  69. no connection find
  70. no connection find
  71. no connection find
  72. no connection find
  73. no connection find
  74. no connection find
  75. no connection find
  76. no connection find
  77. no connection find
  78. no connection find
  79. no connection find
  80. close connection
  81. no connection find
  82. no connection find
  83. no connection find
  84. no connection find
  85. no connection find
  86. no connection find
  87. no connection find
  88. no connection find
  89. no connection find
  90. no connection find
  91. no connection find
  92. no connection find
  93. no connection find
  94. no connection find
  95. no connection find
  96. no connection find
  97. no connection find
  98. no connection find
  99. no connection find
  100. no connection find
  101. no connection find
  102. no connection find
  103. no connection find
  104. no connection find
  105. no connection find
  106. no connection find
  107. no connection find
  108. no connection find
  109. no connection find
  110. no connection find
  111. no connection find
  112. no connection find
  113. no connection find
  114. no connection find
  115. no connection find
  116. no connection find
  117. no connection find
  118. no connection find
  119. no connection find
  120. no connection find
  121. no connection find
  122. no connection find
  123. no connection find
  124. no connection find
  125. no connection find
  126. no connection find
  127. no connection find
  128. no connection find
  129. no connection find
  130. no connection find
  131. no connection find
  132. no connection find
  133. no connection find
  134. no connection find
  135. no connection find
  136. no connection find
  137. no connection find
  138. no connection find
  139. no connection find
  140. no connection find
  141. no connection find
  142. no connection find
  143. no connection find
  144. no connection find
  145. no connection find
  146. no connection find
  147. no connection find
  148. no connection find
  149. no connection find
  150. no connection find
  151. no connection find
  152. no connection find
  153. no connection find
  154. no connection find
  155. no connection find
  156. no connection find
  157. close connection
  158. no connection find
  159. no connection find
  160. no connection find
  161. no connection find
  162. no connection find
  163. no connection find
  164. no connection find
  165. no connection find
  166. no connection find
  167. no connection find
  168. no connection find
  169. no connection find
  170. no connection find
  171. no connection find
  172. no connection find
  173. no connection find
  174. no connection find
  175. no connection find
  176. no connection find
  177. no connection find
  178. no connection find
  179. no connection find
  180. no connection find
  181. no connection find
  182. no connection find
  183. no connection find
  184. no connection find
  185. no connection find
  186. no connection find
  187. no connection find
  188. no connection find
  189. no connection find
  190. no connection find
  191. no connection find
  192. no connection find
  193. no connection find
  194. no connection find
  195. no connection find
  196. no connection find
  197. no connection find
  198. no connection find
  199. no connection find
  200. no connection find
  201. no connection find
  202. no connection find
  203. no connection find
  204. no connection find
  205. no connection find
  206. no connection find
  207. no connection find
  208. no connection find
  209. no connection find
  210. no connection find
  211. no connection find
  212. no connection find
  213. no connection find
  214. no connection find
  215. no connection find
  216. no connection find
  217. no connection find
  218. no connection find
  219. no connection find
  220. no connection find
  221. no connection find
  222. no connection find
  223. no connection find
  224. no connection find
  225. no connection find
  226. no connection find
  227. no connection find
  228. no connection find
  229. no connection find
  230. no connection find
  231. no connection find
  232. no connection find
  233. no connection find
  234. no connection find
  235. close connection
  236. no connection find
  237. no connection find
  238. no connection find
  239. no connection find
  240. no connection find
  241. no connection find
  242. no connection find
  243. no connection find
  244. no connection find
  245. no connection find
  246. no connection find
  247. no connection find
  248. no connection find
  249. no connection find
  250. no connection find
  251. no connection find
  252. no connection find
  253. no connection find
  254. no connection find
  255. no connection find
  256. no connection find
  257. no connection find
  258. no connection find
  259. no connection find
  260. no connection find
  261. no connection find
  262. no connection find
  263. no connection find
  264. no connection find
  265. no connection find
  266. no connection find
  267. no connection find
  268. no connection find
  269. no connection find
  270. no connection find
  271. no connection find
  272. no connection find
  273. no connection find
  274. no connection find
  275. no connection find
  276. no connection find
  277. no connection find
  278. no connection find
  279. no connection find
  280. no connection find
  281. no connection find
  282. no connection find
  283. no connection find
  284. no connection find
  285. no connection find
  286. no connection find
  287. no connection find
  288. no connection find
  289. no connection find
  290. no connection find
  291. no connection find
  292. no connection find
  293. no connection find
  294. no connection find
  295. no connection find
  296. no connection find
  297. no connection find
  298. no connection find
  299. no connection find
  300. no connection find
  301. no connection find
  302. no connection find
  303. no connection find
  304. no connection find
  305. no connection find
  306. no connection find
  307. no connection find
  308. no connection find
  309. no connection find
  310. no connection find
  311. no connection find
  312. no connection find
  313. no connection find
  314. no connection find
  315. close connection
  316. no connection find
  317. no connection find
  318. no connection find
  319. no connection find
  320. no connection find
  321. no connection find
  322. no connection find
  323. no connection find
  324. no connection find
  325. no connection find
  326. no connection find
  327. no connection find
  328. no connection find
  329. no connection find
  330. no connection find
  331. no connection find
  332. no connection find
  333. no connection find
  334. no connection find
  335. no connection find
  336. no connection find
  337. no connection find
  338. no connection find
  339. no connection find
  340. no connection find
  341. no connection find
  342. no connection find
  343. no connection find
  344. no connection find
  345. no connection find
  346. no connection find
  347. no connection find
  348. no connection find
  349. no connection find
  350. no connection find
  351. no connection find
  352. no connection find
  353. no connection find
  354. no connection find
  355. no connection find
  356. no connection find
  357. no connection find
  358. no connection find
  359. no connection find
  360. no connection find
  361. no connection find
  362. no connection find
  363. no connection find
  364. no connection find
  365. no connection find
  366. no connection find
  367. no connection find
  368. no connection find
  369. no connection find
  370. no connection find
  371. no connection find
  372. no connection find
  373. no connection find
  374. no connection find
  375. no connection find
  376. no connection find
  377. no connection find
  378. no connection find
  379. no connection find
  380. no connection find
  381. no connection find
  382. no connection find
  383. no connection find
  384. no connection find
  385. no connection find
  386. no connection find
  387. no connection find
  388. no connection find
  389. no connection find
  390. no connection find
  391. no connection find
  392. no connection find
  393. close connection
  394. no connection find
  395. no connection find
  396. no connection find
  397. no connection find
  398. no connection find
  399. no connection find
  400. no connection find
  401. no connection find
  402. no connection find
  403. no connection find
  404. no connection find
  405. no connection find
  406. no connection find
  407. no connection find
  408. no connection find
  409. no connection find
  410. no connection find
  411. no connection find
  412. no connection find
  413. no connection find
  414. no connection find
  415. no connection find
  416. no connection find
  417. no connection find
  418. no connection find
  419. no connection find
  420. no connection find
  421. no connection find
  422. no connection find
  423. no connection find
  424. no connection find
  425. no connection find
  426. no connection find
  427. no connection find
  428. no connection find
  429. no connection find
  430. no connection find
  431. no connection find
  432. no connection find
  433. no connection find
  434. no connection find
  435. no connection find
  436. no connection find
  437. no connection find
  438. no connection find
  439. no connection find
  440. no connection find
  441. no connection find
  442. no connection find
  443. no connection find
  444. no connection find
  445. no connection find
  446. no connection find
  447. no connection find
  448. no connection find
  449. no connection find
  450. no connection find
  451. no connection find
  452. no connection find
  453. no connection find
  454. no connection find
  455. no connection find
  456. no connection find
  457. no connection find
  458. no connection find
  459. no connection find
  460. no connection find
  461. no connection find
  462. no connection find
  463. no connection find
  464. no connection find
  465. no connection find
  466. no connection find
  467. no connection find
  468. no connection find
  469. no connection find
  470. no connection find
  471. close connection
  472. no connection find
  473. no connection find
  474. no connection find
  475. no connection find
  476. no connection find
  477. no connection find
  478. no connection find
  479. no connection find
  480. no connection find
  481. no connection find
  482. no connection find
  483. no connection find
  484. no connection find
  485. no connection find
  486. no connection find
  487. no connection find
  488. no connection find
  489. no connection find
  490. no connection find
  491. no connection find
  492. no connection find
  493. no connection find
  494. no connection find
  495. no connection find
  496. no connection find
  497. no connection find
  498. no connection find
  499. no connection find
  500. no connection find
  501. no connection find
  502. no connection find
  503. no connection find
  504. no connection find
  505. no connection find
  506. no connection find
  507. no connection find
  508. no connection find
  509. no connection find
  510. no connection find
  511. no connection find
  512. no connection find
  513. no connection find
  514. no connection find
  515. no connection find
  516. no connection find
  517. no connection find
  518. no connection find
  519. no connection find
  520. no connection find
  521. no connection find
  522. no connection find
  523. no connection find
  524. no connection find
  525. no connection find
  526. no connection find
  527. no connection find
  528. no connection find
  529. no connection find
  530. no connection find
  531. no connection find
  532. no connection find
  533. no connection find
  534. no connection find
  535. no connection find
  536. no connection find
  537. no connection find
  538. no connection find
  539. no connection find
  540. no connection find
  541. no connection find
  542. no connection find
  543. no connection find
  544. no connection find
  545. no connection find
  546. no connection find
  547. no connection find
  548. no connection find
  549. no connection find
  550. no connection find
  551. close connection
  552. no connection find
  553. no connection find
  554. no connection find
  555. no connection find
  556. no connection find
  557. no connection find
  558. no connection find
  559. no connection find
  560. no connection find
  561. no connection find
  562. no connection find
  563. no connection find
  564. no connection find
  565. no connection find
  566. no connection find
  567. no connection find
  568. no connection find
  569. no connection find
  570. no connection find
  571. no connection find
  572. no connection find
  573. no connection find
  574. no connection find
  575. no connection find
  576. no connection find
  577. no connection find
  578. no connection find
  579. no connection find
  580. no connection find
  581. no connection find
  582. no connection find
  583. no connection find
  584. no connection find
  585. no connection find
  586. no connection find
  587. no connection find
  588. no connection find
  589. no connection find
  590. no connection find
  591. no connection find
  592. no connection find
  593. no connection find
  594. no connection find
  595. no connection find
  596. no connection find
  597. no connection find
  598. no connection find
  599. no connection find
  600. no connection find
  601. no connection find
  602. no connection find
  603. no connection find
  604. no connection find
  605. no connection find
  606. no connection find
  607. no connection find
  608. no connection find
  609. no connection find
  610. no connection find
  611. no connection find
  612. no connection find
  613. no connection find
  614. no connection find
  615. no connection find
  616. no connection find
  617. no connection find
  618. no connection find
  619. no connection find
  620. no connection find
  621. no connection find
  622. no connection find
  623. no connection find
  624. no connection find
  625. no connection find
  626. no connection find
  627. no connection find
  628. close connection
  629. no connection find
  630. no connection find
  631. no connection find
  632. no connection find
  633. no connection find
  634. no connection find
  635. no connection find
  636. no connection find
  637. no connection find
  638. no connection find
  639. no connection find
  640. no connection find
  641. no connection find
  642. no connection find
  643. no connection find
  644. no connection find
  645. no connection find
  646. no connection find
  647. no connection find
  648. no connection find
  649. no connection find
  650. no connection find
  651. no connection find
  652. no connection find
  653. no connection find
  654. no connection find
  655. no connection find
  656. no connection find
  657. no connection find
  658. no connection find
  659. no connection find
  660. no connection find
  661. no connection find
  662. no connection find
  663. no connection find
  664. no connection find
  665. no connection find
  666. no connection find
  667. no connection find
  668. no connection find
  669. no connection find
  670. no connection find
  671. no connection find
  672. no connection find
  673. no connection find
  674. no connection find
  675. no connection find
  676. no connection find
  677. no connection find
  678. no connection find
  679. no connection find
  680. no connection find
  681. no connection find
  682. no connection find
  683. no connection find
  684. no connection find
  685. no connection find
  686. no connection find
  687. no connection find
  688. no connection find
  689. no connection find
  690. no connection find
  691. no connection find
  692. no connection find
  693. no connection find
  694. no connection find
  695. no connection find
  696. no connection find
  697. no connection find
  698. no connection find
  699. no connection find
  700. no connection find
  701. no connection find
  702. no connection find
  703. no connection find
  704. no connection find
  705. no connection find
  706. close connection
  707. no connection find
  708. no connection find
  709. no connection find
  710. no connection find
  711. no connection find
  712. no connection find
  713. no connection find
  714. no connection find
  715. no connection find
  716. no connection find
  717. no connection find
  718. no connection find
  719. no connection find
  720. no connection find
  721. no connection find
  722. no connection find
  723. no connection find
  724. no connection find
  725. no connection find
  726. no connection find
  727. no connection find
  728. no connection find
  729. no connection find
  730. no connection find
  731. no connection find
  732. no connection find
  733. no connection find
  734. no connection find
  735. no connection find
  736. no connection find
  737. no connection find
  738. no connection find
  739. no connection find
  740. no connection find
  741. no connection find
  742. no connection find
  743. no connection find
  744. no connection find
  745. no connection find
  746. no connection find
  747. no connection find
  748. no connection find
  749. no connection find
  750. no connection find
  751. no connection find
  752. no connection find
  753. no connection find
  754. no connection find
  755. no connection find
  756. no connection find
  757. no connection find
  758. no connection find
  759. no connection find
  760. no connection find
  761. no connection find
  762. no connection find
  763. no connection find
  764. no connection find
  765. no connection find
  766. no connection find
  767. no connection find
  768. no connection find
  769. no connection find
  770. no connection find
  771. no connection find
  772. no connection find
  773. no connection find
  774. no connection find
  775. no connection find
  776. no connection find
  777. no connection find
  778. no connection find
  779. no connection find
  780. no connection find
  781. no connection find
  782. no connection find
  783. close connection
  784. no connection find
  785. no connection find
  786. no connection find
  787. no connection find
  788. no connection find
  789. no connection find
  790. no connection find
  791. no connection find
  792. no connection find
  793. no connection find
  794. no connection find
  795. no connection find
  796. no connection find
  797. no connection find
  798. no connection find
  799. no connection find
  800. no connection find
  801. no connection find
  802. no connection find
  803. no connection find
  804. no connection find
  805. no connection find
  806. no connection find
  807. no connection find
  808. no connection find
  809. no connection find
  810. no connection find
  811. no connection find
  812. no connection find
  813. no connection find
  814. no connection find
  815. no connection find
  816. no connection find
  817. no connection find
  818. no connection find
  819. no connection find
  820. no connection find
  821. no connection find
  822. no connection find
  823. no connection find
  824. no connection find
  825. no connection find
  826. no connection find
  827. no connection find
  828. no connection find
  829. no connection find
  830. no connection find
  831. no connection find
  832. no connection find
  833. no connection find
  834. no connection find
  835. no connection find
  836. no connection find
  837. no connection find
  838. no connection find
  839. no connection find
  840. no connection find
  841. no connection find
  842. no connection find
  843. no connection find
  844. no connection find
  845. no connection find
  846. no connection find
  847. no connection find
  848. no connection find
  849. no connection find
  850. no connection find
  851. no connection find
  852. no connection find
  853. no connection find
  854. no connection find
  855. no connection find
  856. no connection find
  857. no connection find
  858. no connection find
  859. no connection find
  860. no connection find
  861. close connection
  862. no connection find
  863. no connection find
  864. no connection find
  865. no connection find
  866. no connection find
  867. no connection find
  868. no connection find
  869. no connection find
  870. no connection find
  871. no connection find
  872. no connection find
  873. no connection find
  874. no connection find
  875. no connection find
  876. no connection find
  877. no connection find
  878. no connection find
  879. no connection find
  880. no connection find
  881. no connection find
  882. no connection find
  883. no connection find
  884. no connection find
  885. no connection find
  886. no connection find
  887. no connection find
  888. no connection find
  889. no connection find
  890. no connection find
  891. no connection find
  892. no connection find
  893. no connection find
  894. no connection find
  895. no connection find
  896. no connection find
  897. no connection find
  898. no connection find
  899. no connection find
  900. no connection find
  901. no connection find
  902. no connection find
  903. no connection find
  904. no connection find
  905. no connection find
  906. no connection find
  907. no connection find
  908. no connection find
  909. no connection find
  910. no connection find
  911. no connection find
  912. no connection find
  913. no connection find
  914. no connection find
  915. no connection find
  916. no connection find
  917. no connection find
  918. no connection find
  919. no connection find
  920. no connection find
  921. no connection find
  922. no connection find
  923. no connection find
  924. no connection find
  925. no connection find
  926. no connection find
  927. no connection find
  928. no connection find
  929. no connection find
  930. no connection find
  931. no connection find
  932. no connection find
  933. no connection find
  934. no connection find
  935. no connection find
  936. no connection find
  937. no connection find
  938. no connection find
  939. close connection
  940. no connection find
  941. no connection find
  942. no connection find
  943. ^C

录取了大概一千行的输出，平均每 80 行可以观察到一次中断连接的记录，也就是说 netstat 运行 80 次左右才能轮到一次 cports，这和进程在连接中断后 5 秒进行第一次重试有关 (通过换算，netstat 一秒运行了 16 次?)，而为了“及时”杀掉进程这里也没有采用 sleep 去避免忙等待 (其实可以等待 4 秒)。

结语

今天通过一个实际场景来研究了一下如何使用 shell + cports 不断的杀死某个连接、进而构造一个 bug 复现的场景。虽然脚本写的很漂亮，但遗憾的是这个 bug 未能复现 (泪奔~)，我用调试器挂上 win32 进程跑了四个多小时也没有出现崩溃。再仔细对比 log 输出，发现伪造的场景下进程还是可以有机会输出更多信息，看来“杀”的还是不够快啊；于是我将 netstat 检测 3570 端口是否存在这步去掉了，直接在循环里调用 cports 不断的杀连接，这应该比之前快了吧，但是还是没有发生崩溃；所以我感觉下一步只能用 c++ 写个程序，模拟在 3570 端口侦听、并在连接一上来的时候就 close connection 试试了 (需要设置 host 以便将域名指向本地启动的这个模拟程序)。

虽然没能复现 bug，但是无意间得到了 cports 这个宝贝，另外它的作者 nir sofer 也是一个 windows 工具小达人，制作了一系列 win32 工具供网友免费下载使用，有兴趣的读者可以去他的网站上翻翻。

参考

[1]. Windows Sysinternals

[2]. Tcpkill

[3]. How to kill a particular tcp connection in windows?

[4]. CPorts

[5]. NirSoft

用 shell 脚本制造连接频繁中断的场景的更多相关文章

  1. 学习Linux shell脚本中连接字符串的方法

    这篇文章主要介绍了Linux shell脚本中连接字符串的方法,如果想要在变量后面添加一个字符,可以用一下方法: 代码如下: $value1=home $value2=${value1}"= ...

  2. linux下实现shell脚本自动连接mongodb数据库并创建索引

    在linux下创建shell脚本

  3. Java实践 — SSH远程执行Shell脚本（转）

    原文地址:http://www.open-open.com/lib/view/open1384351384024.html 1. SSH简介         SSH是Secure Shell的缩写,一 ...

  4. Java实践 — SSH远程执行Shell脚本

    1. SSH简介         SSH是Secure Shell的缩写,一种建立在应用层和传输层基础上的安全协议.SSH在连接和传送过程中会加密所有数据,可以用来在不同系统或者服务器之间进行安全连接 ...

  5. 【Linux】通过shell脚本对mysql的增删改查以及my.cnf的配置

    目录 shell操作mysql 1.获取mysql默认密码 2.修改my.cnf文件 3.shell创建mysql数据库 4.shell创建mysql表 5.shell添加数据 6.shell删除数据 ...

  6. 网络分析shell脚本(实时流量+连接统计)

    介绍一个强大的分析网络的shell脚本,此脚本是从EZHTTP拆分出来的,觉得有必要单独介绍下.脚本运行效果截图: 此脚本包含的功能有: 1.实时监控任意网卡的流量 2.统计10秒内平均流量 3.统计 ...

  7. java连接ssh执行shell脚本

    在liunx上写了一个shell脚本,想通过java去调用这个shell脚本,不知道怎么去调用,在网上说使用process这个进程方式,但是我执行机和我shell脚本都不在同一台电脑,老大说java中 ...

  8. 树莓派保持网络连接shell脚本

    源:http://www.jianshu.com/p/96aa26d165c3 (我的简书文章) 故事背景 树莓派3b现在有了板载无线网卡,可以很方便的连接到wifi.但是无线路由器不能保证永远正常工 ...

  9. notepad++使用NppFTP连接linux，编写shell脚本无法保存上传的问题

    下载安装NppFTP插件之后,重启打开notepad++连接到linux主机,之后进行编辑shell脚本,出现无法保存上传至linux主机的问题. 分析的原因:可能的原因是Windows防火墙阻止了应 ...

随机推荐

  1. android分析之Thread类

    线程与线程类要区分开来. 抽象来说,线程是CPU调度的最小单位,但是线程总要执行代码,这个代码就在线程类里说明(即Thread类).无论如何,Thread只是一个类,但其功能就是"启动一个线 ...

  2. jqgrid 实现表格随select框内容改变而刷新

    要实现的功能如下:当选择框选择数据源由原始数据切换到组合后数据时,界面左侧jqgrid表格随之改变.效果如下: 实现代码: 界面顶部select选择框:要点是用localStory将选择框的选择信息记 ...

  3. HTML标签解读

    因为最近在学习爬虫,那么在爬取网页内容时,就要求我们能够简单的看懂这个网页的基本结构,才能更好的去爬取我们所需要的内容. 这篇随笔也只是简单的说明了一些标签的含义. 标签关系 包含关系 eg:< ...

  4. 一种借助POI粗略的标注城市也许重要的区域的方法

    第一部分 很久以前,我住在村子里,因为村子小,所以对村子的一草一木都很熟悉,在熟悉的环境里就很有安全感. 后来我到了大城市,却发现城市太大了,一辈子都熟悉不完. 这个城市的绝大部分地方我都没有去过,就 ...

  5. IPFS挖矿硬盘满了会怎样？

    IPFS是一个互联网协议,对标现在的HTTP.所以,可以想见未来IPFS有多大的价值.所谓IPFS挖矿,是基于IPFS,挖的是filecoin,称其为filecoin挖矿倒是更为贴切.许多初接触IPF ...

  6. 你说，怎么把Bean塞到Spring容器？

    作者:小傅哥 博客:https://bugstack.cn 沉淀.分享.成长,让自己和他人都能有所收获! 一.前言 小傅哥,你是怎么学习的? 有很多初学编程或者码了几年CRUD砖的小伙伴问我,该怎么学 ...

  7. vue自定义插件封装，实现简易的elementUi的Message和MessageBox

    vue自定义插件封装示例 1.实现message插件封装(类似简易版的elementUi的message) message组件 <template>     <transition  ...

  8. HTML5-本地存储浅谈

    Web Storage是HTML5里面引入的一个类似于cookie的本地存储功能,可以用于客户端的本地存储 sessionStorage && localStorage session ...

  9. 开源一周岁，MindSpore新特性巨量来袭

    摘要:MindSpore很多新特性与大家见面了,无论是在效率提升.易用性,还是创新方面,都是干货满满. 最近,AI计算框架是业界的热点,各大厂商纷纷投身AI框架的自研发,究其原因:AI框架在整个人工智 ...

  10. 13. VUE 组件之间数据传递

    组件数据传递: 父组件向内传递属性---动态属性 子组件向外发布事件 solt 插槽传递模板---具名solt 1. 父组件向子组件传递数据 子组件在父组件的并作为标签引入,通过设置标签的属性传递数据 ...