TCP, UDP and applications

0 of 37 nailed

Practice this track Run a scenario

Cisco IOS4

ip tcp adjust-mss 1360: Rewrites the MSS in TCP SYNs entering or leaving the interface down to this value (500 to 1460). Usual on tunnels with ip mtu 1400.
ip mtu 1400: Sets the largest IPv4 packet on the interface without changing the layer 2 MTU. On a tunnel, this is the size before encapsulation.
ping 10.2.0.10 source 10.1.0.1 size 1400 df-bit: Sends pings of an exact size with DF set from a chosen source, to test the MTU of a path such as a tunnel.
show tcp brief: Lists TCP connections that terminate on the router itself (SSH, BGP, TACACS+) with local and foreign address and state.

Junos1

set security flow tcp-mss ipsec-vpn mss 1350: On an SRX, clamps the MSS of TCP sessions that enter IPsec VPN tunnels.

Linux25

ss -tan: Lists all TCP sockets with numeric addresses and their state (ESTAB, TIME-WAIT, CLOSE-WAIT and so on). The modern replacement for netstat -tan.
ss -tanp state close-wait: Lists sockets in CLOSE-WAIT with the owning process and file descriptor. A growing list means the application is not closing sockets.
Example
Output
sudo ss -tanp state close-wait '( dport = :8443 )'
ss -tano state time-wait: Lists TIME-WAIT sockets with the remaining timer, for example timer:(timewait,41sec,0). Shows which side closed first.
ss -ti dst 10.2.20.30: Shows TCP internals per connection on the sender, including congestion control, wscale, rtt, rto, mss, pmtu, cwnd, retrans and rwnd_limited time.
ss -lnt: Lists listening TCP sockets. For LISTEN lines, Recv-Q is the accept queue length and Send-Q is the backlog limit.
tcpdump -ni eth0 'tcp[tcpflags] & (tcp-syn|tcp-fin|tcp-rst) != 0': Captures only connection setup and teardown segments (SYN, FIN, RST), with their TCP options, which keeps captures small on busy links.
tcpdump -ni eth0 -S 'host 10.0.0.20 and tcp port 80': Captures one conversation with absolute sequence numbers (-S) so seq and ack arithmetic can be checked line by line.
tcpdump -ni eth0 'icmp[icmptype] == icmp-unreach and icmp[icmpcode] == 4': Captures ICMP fragmentation needed messages. Their absence on the sender during a large transfer is the sign of a PMTUD black hole.
ping -M do -s 1472 -c 3 10.30.0.10: Sends pings with the DF bit set and 1,500-byte packets (1472 + 8 + 20). Lower -s until it passes to find the path MTU.
tracepath -n 10.30.0.10: Traces the path and reports the path MTU at each hop where it drops, without needing root.
ip route get 10.30.0.10: Shows the route used for a destination, including a cached path MTU (cache expires ... mtu 1476) learned from ICMP.
sysctl net.ipv4.tcp_congestion_control net.ipv4.tcp_available_congestion_control: Shows the current congestion control algorithm (cubic by default) and the ones that are loaded and available, such as bbr.
sysctl net.ipv4.tcp_rmem net.ipv4.tcp_wmem: Shows the minimum, default and maximum TCP receive and send buffer sizes used by autotuning. The maximum must cover the bandwidth-delay product.
Example
Output
sudo sysctl -w net.ipv4.tcp_rmem='4096 131072 33554432'
sysctl net.ipv4.tcp_keepalive_time net.ipv4.tcp_keepalive_intvl net.ipv4.tcp_keepalive_probes: Shows system-wide TCP keepalive defaults (7200 s idle, 75 s interval, 9 probes) for sockets that enable SO_KEEPALIVE.
sysctl net.ipv4.ip_local_port_range: Shows the ephemeral source port range, 32768 to 60999 by default. Its size caps outgoing connections per destination IP and port.
sysctl -w net.ipv4.tcp_mtu_probing=1: Enables packetization layer PMTUD, so TCP probes with smaller segments when it detects a black hole instead of relying on ICMP.
nstat -az TcpRetransSegs TcpExtListenOverflows TcpExtSyncookiesSent: Shows kernel counters for retransmitted segments, accept queue overflows and SYN cookies sent, for spotting loss, slow accept and SYN floods.
iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu: Clamps the MSS in forwarded SYNs to the outgoing route MTU minus 40 on a Linux router. Use --set-mss for a fixed value.
openssl s_client -connect shop.example.com:443 -servername shop.example.com -showcerts: Opens a TLS connection with SNI and prints every certificate the server sends, the verify result and the negotiated protocol and cipher.
openssl s_client -connect shop.example.com:443 -servername shop.example.com -alpn h2 -brief: Prints a short summary of the handshake (protocol version, cipher suite, peer certificate, verification) and tests whether the server accepts HTTP/2 via ALPN.
openssl x509 -in cert.pem -noout -subject -issuer -dates -ext subjectAltName: Shows a certificate's subject, issuer, validity dates and SAN names. The issuer must match the next certificate's subject in the chain.
curl -v https://shop.example.com/: Shows each step of a request, including address tried, TLS handshake messages, ALPN result, certificate checks, and request and response headers.
curl -o /dev/null -s -w '%{time_connect} %{time_appconnect} %{time_starttransfer}\n' https://shop.example.com/: Prints cumulative seconds to TCP connect, TLS done and first byte, showing which layer is slow. Add %{time_namelookup} for DNS.
Example
Output
curl -o /dev/null -s -w 'dns %{time_namelookup} connect %{time_connect} tls %{time_appconnect} ttfb %{time_starttransfer}\n' https://shop.example.com/
curl -sI --http3 https://shop.example.com/: Fetches headers over HTTP/3 (QUIC on UDP 443). Needs a curl built with HTTP/3 support; --http3-only refuses to fall back to TCP.
iperf3 -c 10.2.20.30 -t 30 -P 4: Measures TCP throughput to an iperf3 server with four parallel streams. Compare with -P 1 to tell a per-flow window limit from a path limit.