用Wireshark抓包分析超过70秒的请求

超过70秒的请求是通过分析IIS日志发现的:

用Wireshark抓包分析超过70秒的请求

10.159.63.104是SLB的内网IP。

通过Wireshark抓包分析请求是9:22:21收到的(tcp.stream eq 23080):

09:22:21.299838000    10.159.63.104    10.161.241.208    HTTP    291    GET /eastsea/p/3764040.html HTTP/1.0 

这个请求响应内容的长度是:Content-Length 1154110(1.1MB)

云服务器(ECS)在收到请求后,发了一个ACK包:

09:22:21.354730000    10.161.241.208    10.159.63.104    TCP    66    http > 60895 [ACK] Seq=1 Ack=226 Win=66560 Len=0 TSval=16270579 TSecr=1049527471

接下来就是一堆的TCP segment of a reassembled PDU:

10.161.241.208    10.159.63.104    TCP    1514    [TCP segment of a reassembled PDU]

中间会出现一些错误:

1. TCP Dup ACK

10.159.63.104    10.161.241.208    TCP    78    [TCP Dup ACK 619713#1] 60895 > http [ACK] Seq=226 Ack=57921 Win=61440 Len=0 TSval=1049527542 TSecr=16270581 SLE=63713 SRE=75297

2. TCP Out-Of-Order

10.161.241.208    10.159.63.104    TCP    1514    [TCP Out-Of-Order] [TCP segment of a reassembled PDU]

3. TCP Fast Retransmission

10.161.241.208    10.159.63.104    TCP    1514    [TCP Fast Retransmission] [TCP segment of a reassembled PDU]

另外,中间也出现了大量的TCP Window Update:

10.159.63.104    10.161.241.208    TCP    66    [TCP Window Update] 60895 > http [ACK] Seq=226 Ack=175209 Win=16384 Len=0 TSval=1049528183 TSecr=16270632

最后在9:23:32才完成了响应内容的发送:

09:23:32.865387000    10.161.241.208    10.159.63.104    HTTP    486    HTTP/1.1 200 OK  (text/html)

Wireshark中记录的中整个发送耗时:

Time since request: 71.565549000 seconds
上一篇:wireshark怎么抓包、wireshark抓包详细图文教程


下一篇:.net使用OpenPop自动收邮件,并将邮件内容存入数据库