拦截传输层之上的流量
首先，我对网络编程还比较陌生。我想在 HTTP 流量到达服务器应用程序之前拦截并延迟它。我深入研究了 libnetfilter_queue ，它为我提供了适当延迟所需的所有信息，但级别太低。我可以延迟那里的流量，但除非我几乎立即接受IP数据报（因此当我想延迟它们时将它们发送到堆栈），它们将被重新发送（当没有ACK到达时），这不是我想要的。
我不想或不需要处理 TCP，只处理它提供的有效负载。所以我的问题是，如何在特定端口上的流量到达目的地之前、TCP 确认并检查之后拦截该流量？
谢谢
编辑：希望从标签和 libnetfilter_queue 中可以明显看出 - 这是针对 Linux 的
Firstly, I'm relatively new to network programming. I want to intercept and delay HTTP traffic before it gets to the server application. I've delved into libnetfilter_queue which gives me all the information I need to delay suitably, but at too low a level. I can delay traffic there, but unless I accept the IP datagrams almost immediately (so sending them up the stack when I want to delay them), they will get resent (when no ACK arrives), which isn't what I want.
I don't want or need to have to deal with TCP, just the payloads it delivers. So my question is how do I intercept traffic on a particular port before it reaches its destination, but after TCP has acknowledged and checked it?
Thanks
Edit: Hopefully it's obvious from the tag and libnetfilter_queue - this is for Linux
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
通过 HTTP 代理劫持连接。如果您不能只在客户端上设置 HTTP_PROXY，或者设置使用当前服务器的 IP 和端口号运行的过滤器，将真实服务器移动到另一个 IP，Google 会找到一个好方法来做到这一点。
所以实际的 TCP 连接是在客户端和您之间，然后从您到服务器。那么您就不必处理 ACK，因为 TCP 总是认为任务已完成。
编辑：我看到原文的评论已经提出了这个想法，使用 iptables 通过同一台机器上的透明代理进程重定向流量。
Hijack the connections through an HTTP proxy. Google up a good way to do this if you can't just set HTTP_PROXY on the client, or set up your filter running with the IP and port number of the current server, moving the real server to another IP.
So the actual TCP connections are between the client and you, then from you to the server. Then you don't have to deal with ACKs, because TCP always sees mission accomplished.
edit: I see the comments on the original already came up with this idea using iptables to redirect the traffic through your transparent proxy process on the same machine.
好吧，我已经按照我的评论中的建议做了，而且它有效，即使它确实感觉是一种冗长的做法。
可以理解的是，现在的（或一个）问题是 Web 服务器认为每个请求都来自本地主机。我真的希望这种延迟对客户端和服务器都是透明的（当然除了时间！）。我能做些什么吗？
如果不是，会有什么影响？每个 HTTP 会话都通过不同的端口进行 - 这足以让它们按照应有的方式完全分离吗？大概是这样，考虑到它在 NAT 后面工作，其中许多会话的地址是相同的。
Well I've done what I suggested in my comment, and it works, even if it did feel a long-winded way of doing it.
The (or a) problem is that the web server now, understandably, thinks that every request comes from localhost. Really I would like this delay to be transparent to both client and server (except in time of course!). Is there anything I can do about this?
If not, what are the implications? Each HTTP session happens through a different port - is that enough for them to be separated completely as they should be? Presumably so considering it works when behind a NAT where the address for many sessions is the same.