近幾年，企業(yè)基礎(chǔ)設(shè)施云原生化的趨勢越來越強(qiáng)烈，從最開始的IaaS化到現(xiàn)在的微服務(wù)化，客戶的顆粒度精細(xì)化和可觀測性的需求更加強(qiáng)烈。容器網(wǎng)絡(luò)為了滿足客戶更高性能和更高的密度，也一直在高速的發(fā)展和演進(jìn)中，這必然對客戶對云原生網(wǎng)絡(luò)的可觀測性帶來了極高的門檻和挑戰(zhàn)。鳥瞰容器網(wǎng)絡(luò)，整個(gè)容器網(wǎng)絡(luò)可以分為三個(gè)部分：Pod網(wǎng)段，Service網(wǎng)段和Node網(wǎng)段。這三個(gè)網(wǎng)絡(luò)要實(shí)現(xiàn)互聯(lián)互通和訪問控制，那么實(shí)現(xiàn)的技術(shù)原理是什么？整個(gè)鏈路又是什么，限制又是什么呢？Flannel，Terway有啥區(qū)別？不同模式下網(wǎng)絡(luò)性能如何？這些，需要客戶在下搭建容器之前，就要依據(jù)自己的業(yè)務(wù)場景進(jìn)行選擇，而搭建完畢后，相關(guān)的架構(gòu)又是無法轉(zhuǎn)變，所以客戶需要對每種架構(gòu)特點(diǎn)要有也可能是其他ECS，這些在不同模式下，數(shù)據(jù)鏈轉(zhuǎn)發(fā)模式是不同的，從業(yè)務(wù)側(cè)表現(xiàn)結(jié)果也是不一樣的。為了提高云原生網(wǎng)絡(luò)的可觀測性，同時(shí)便于客戶和前后線同學(xué)增加對業(yè)務(wù)鏈路的可讀性，ACK產(chǎn)研和GTS-AES聯(lián)合共建，合網(wǎng)絡(luò)數(shù)據(jù)面可觀測性系列，幫助客戶和前后線同學(xué)了解云原生網(wǎng)絡(luò)架構(gòu)體系，簡化對云原生網(wǎng)絡(luò)的可觀測性的門檻，優(yōu)化客戶運(yùn)維和售后同學(xué)處理疑難問題的體驗(yàn)，提高云原生網(wǎng)絡(luò)的鏈路的穩(wěn)定性。 6 29 29 154 190 294 一、容器網(wǎng)絡(luò)內(nèi)核原理1.概述●傳輸層完成處理后，內(nèi)核會將真正的報(bào)文數(shù)據(jù)提取出來并交給socket子系統(tǒng)，2.netfilter框架#defineNF_IP_LOCAL_IN1●數(shù)據(jù)包經(jīng)過入向的路由選擇后，確認(rèn)是由本機(jī)的傳輸層進(jìn)行處理的，會進(jìn)入到//priority定義了回調(diào)函數(shù)的優(yōu)先級，通過每個(gè)hook時(shí)機(jī)都會有多個(gè){{{{{}caseNF_ACCEPT:caseNF_DROP:caseNF_QUEUE:*nonconventionalverdicts.}}conntrack在內(nèi)核中也是通過注冊在netfilter上的hook函數(shù)進(jìn)行工作的，此外，conntrack機(jī)制還依賴于按照cpu的數(shù)量來為每一個(gè)cpu分配一塊用于存放conntrack{{{{{{{{{{##查看ipvsconnection信息，在出節(jié)點(diǎn)是，ipvsconnection是獨(dú)立并且優(yōu)先于conntrack機(jī)制的選擇，即流量會優(yōu)先匹配到ipvs的規(guī)則，如果沒有命中，才會進(jìn)入管理，通常cni插件會采用iptables隊(duì)policy未放行的流量進(jìn)行屏蔽操作，實(shí)現(xiàn)3.tc子系統(tǒng)LinuxTrafficControl(TC)子系統(tǒng)是Li●Qdisc是queueingdiscipline的簡寫，與我們理解的網(wǎng)卡的隊(duì)列(queue)不同，qdisc是sk_buff報(bào)文進(jìn)行{}}}{}}}}送條件的數(shù)據(jù)包進(jìn)行出隊(duì)動作，也就是調(diào)用網(wǎng)卡的操作方法進(jìn)行數(shù)據(jù)的發(fā)送，以{intband=prio2band[skb->priority&TC_PRIO_Mstructpfifo_fast_priv*p//獲取通道列表的head}}{structpfifo_fast_priv*pqdisc->q.qlen--;}}Cgroup子系統(tǒng)是容器技術(shù)的基礎(chǔ)，通常我們對cgroup的理解都在于cgroup通過mkdirmkdir/sys/fs/cgroup/net_cl種配置網(wǎng)卡和對應(yīng)的優(yōu)先級數(shù)值，使對應(yīng)的cgroup中管理的進(jìn)程創(chuàng)建出來的socket{}{}{}4.eBPF技術(shù)●提供了高效的jit，eBPF的代碼在內(nèi)核中會被編●通過各種開發(fā)框架進(jìn)行初步的檢查，然后通過bpf()系統(tǒng)調(diào)用進(jìn)行加載，在這個(gè)過●kprobe,kretprobe,fentry,此外，eBPF在容器網(wǎng)絡(luò)中也扮演著越來越關(guān)鍵的角色，包括二、全景剖析阿里云容器網(wǎng)絡(luò)數(shù)據(jù)鏈路1.Flannel模式架構(gòu)設(shè)計(jì)node3:ap-southeast-.180(該節(jié)無后端pod)ap-southeast-.180:2.TerwayENI模式架構(gòu)設(shè)計(jì)eni-t4naaozjxiehvmg2lwfo。3.TerwayENIIP模式架構(gòu)設(shè)計(jì)●同主機(jī)上的容器通信直接通過主機(jī)上的路由到同一個(gè)主機(jī)上別的容器對應(yīng)的veth●容器和其所在的宿主機(jī)之間的通信直接通過連接到宿主機(jī)namespace的vethcn-hongkong.9節(jié)點(diǎn)上存在nginx-●●協(xié)議棧;cn-hongkong.cn-hongkong.9cn-hongkong.9cn-hongkong.cn-hongkong.9cn-hongkong.cn-hongkong.10.0.3.4.TerwayIPVLAN+EBPF模式架構(gòu)設(shè)計(jì)個(gè)IP（2和8）都屬于同一個(gè)MAC地址00:16:3e:01:b7:bd和00:為00:16:3e:04:08:3a的ENI網(wǎng)卡?？蛻舳说腸entos-6c48766848-znkl8網(wǎng)絡(luò)命名空間內(nèi)eth0抓包，抓包地址是目的個(gè)IP（2和8）都屬于同一個(gè)MAC地址00:16:3e:04:08:3a，說明這兩個(gè)IP屬于不同ENI，進(jìn)而可以推斷出為00:16:3e:04:08:3a的ENI網(wǎng)卡。/document_detail/97467.html#section-krj-kqf-14s/document_detail/55206.htm/document_detail/197320.htm/document_detail/113090.html#p-lim-520-w07●●●●●5.TerwayENI-Trunking模式架構(gòu)設(shè)計(jì)、7。0。7。5。7。0?！瘛瘛瘛?。5。●●●●這三個(gè)網(wǎng)卡的安全組的配置都會影響數(shù)據(jù)鏈路7。5。7。0。7。0?！瘛?.ASMIstio模式架構(gòu)設(shè)計(jì)圖:服務(wù)網(wǎng)格示例圖Istio數(shù)據(jù)面示意圖●將原來集成在同一個(gè)ECS上的服務(wù)拆分成不同的模塊，這些模塊之間調(diào)用涉及跨則會設(shè)置將符合條件的入方向流量避免轉(zhuǎn)發(fā)到15006端口，直接轉(zhuǎn)/document_detail/464794.html。https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol程/usr/local/bin/envoy。其中/etc/istio/proxy/envoy-rev.json是envoy初始化的dynamic_resourcesstatic_resources我們在這里還是以官方例子來舉例。訪問http://<gatewayIP>/productpage，{"upstream_host":"10.0.1{"upstream_host":"30:49586","downstream_local_address":"1uster.local","path":"/details/0","protocol":"HTTP/1.1","ual_address":"30:50026","method":"GET","userSafari/537.36","route_name":"default","request_a7-af11-8491df9ab4f8","start_time":"2023-01-31T14:2eam_transport_failure_reason":null,"upstream_service_onse_flags":"-","bytes_received":0,"authority_for":uthority":"details:9080","requested_server_name":null,"isstatus":null,"trace_id":"9712c9f3da936a8c927_code":200,"x_forwarded_for":null,"bytes_sent":178}{"x_forwarded_for":null{"x_forwarded_for":nullhod":"GET","response_flags":"-","route_name":"default","i_status":null,"requested_server_name":"outbound_.9080_._.details.istio-inject.svc.cluster.local","bytes_received":c2-435f-94a7-af11-8491df9ab4f8","response_code":200,"upstream_host":"27:9080","trace_id":"9712c9f3nstream_remote_address":"30:50026","protocol":"tes_sent":178,"upstream_transport_failure_reason":nocal_address":"27:9080","upstream_local_address":":46225","authority":"details:9080","authoritySafari/537.36"}●"start_time":"2023-01-31T14●"upstream_transport_failure_reason":null；●"authority_for":"details●"requested_server_name":null；https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usageupstream_local_address相對應(yīng)。apiVersion:apiVersion:networkingcreationTimestamp:'20uid:63f715c9-b253-4fbb-8351-5-reviews.istio-inj其中在reviewsvs的定義了集群內(nèi)訪問reviews.istio-inject.svc.cluster.local是的apiVersion:apiVersion:networkingcreationTimestamp:'20uid:fdbdfcea-1fcd-453e-96fb-cmaxRequestsPerConnectionconsecutive5xxErrors:7感興趣的同學(xué)可以自行研究下，下文會針對此config_dump信息中的cluster，kubectlkubectlexec-nistio-injectp務(wù)動作，而是根據(jù)"use_origihttps://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/#MeshConfi只有被注冊到服務(wù)網(wǎng)格集群內(nèi)的serviceentry才可以被成功轉(zhuǎn)發(fā)從配置上可以看到filter中并沒有特殊的志敏篩選條件，說明接受任何流量，其中剛知道是哪個(gè)service？是如何判斷如果目的端口未9080可能有小伙伴很奇怪productpage不直接調(diào)用ratings服務(wù)，所有的配置信息都下發(fā)到被注入的envoy里面，這樣https://istio.io/latest/docs/reference/config/networking/sidecar/{{"version_info":"2023-01-30T06:25:21Z/19","@type":"/envoy.config.route.v3.RouteConfiguration",{{"cluster":"PassthroughCluster",}{"name":"details.istio-inject.svc.cluster.local:9080","details.istio-inject.svc.cluster.local","details.istio-inject.svc.cluster.local:9080","details","details:9080","details.istio-inject.svc","details.istio-inject.svc:9080","details.istio-inject","details.istio-inject:9080","25",{"retry_on":"connect-failure,refused-stream,unavaius-codes","num_retries":2,{"name":"envoy.retry_host_predicates.previous_hosts","@type":"/envoy.extensions.retry.host.previous"/envoy.extensions.retry.host.previousreviousHostsPredicate"}}"host_selection_retry_max_attempts":"5",]"max_stream_duration":"0s","grpc_timeout_header_max":"0}"operation":"details.istio-inject.svc.cluster.local:9080/}{"name":"istio-ingressgateway.istio-system.svc.cluster.local:9080","istio-ingressgateway.istio-system.svc.cluster.local","istio-ingressgateway.istio-system.svc.cluster.local:9080","istio-ingressgateway.istio-system","istio-ingressgateway.istio-system:9080","istio-ingressgateway.istio-system.svc","istio-ingressgateway.istio-system.svc:9080","50",{"cluster":"retry_on":"connect-failure,refused-stream,unavaiusus-codes","num_retries":2,{"name":"envoy.retry_host_predicates.previous_hosts","@type":"/envoy.extensions.retry.host.previousreviousHostsPredicate"}}"host_selection_retry_max_attempts":"5",]"max_stream_duration":"0s","grpc_timeout_header_max":"0}"operation":"istio-ingressgateway.istio-system.svc.cluster.local:9080/}{"name":"productpage.istio-inject.svc.cluster.local:9080","productpage.istio-inject.svc.cluster.local","productpage.istio-inject.svc.cluster.local:9080","productpage","productpage:9080","productpage.istio-inject.svc","productpage.istio-inject.svc:9080","productpage.istio-inject","productpage.istio-inject:9080","26",{"ratings.istio-inject.svc.cluster.local","ratings.istio-inject.svc.cluster.local","ratings.istio-inject.svc.cluster.local:9080","ratings","ratings:9080","cluster":"retry_on":"connect-failure,refused-stream,unavaius-codes","num_retries":2,{"name":"envoy.retry_host_predicates.previous_hosts","@type":"/envoy.extensions.retry.host.previousreviousHostsPredicate"}}"host_selection_retry_max_attempts":"5",]"max_stream_duration":"0s","grpc_timeout_header_max":"0}"operation":"productpage.istio-inject.svc.cluster.local:9080/}{"name":"ratings.istio-inject.svc.cluster.local:9080","ratings.istio-inject.svc","ratings.istio-inject.svc","ratings.istio-inject.svc:9080","ratings.istio-inject","ratings.istio-inject:9080","72",{"retry_on":"connect-failure,refused-stream,unavaius-codes","num_retries":2,{"name":"envoy.retry_host_predicates.previous_hosts","@type":"/envoy.extensions.retry.host.previousreviousHostsPredicate"}}"host_selection_retry_max_attempts":"5",]"max_stream_duration":"0s","grpc_timeout_header_max":"0}"operation":"ratings.istio-inject.svc.cluster.local:9080/}{"name":"reviews.istio-inject.svc.cluster.local:9080","reviews.istio-inject.svc.cluster.local","reviews.istio-inject.svc.cluster.local:9080","reviews","reviews:9080","reviews.istio-inject.svc","reviews.istio-inject.svc:9080","reviews.istio-inject","reviews.istio-inject:9080","13",{{{{}"retry_on":"connect-failure,refused-stream,unavaius-codes","num_retries":2,{"name":"envoy.retry_host_predicates.previous_hosts","@type":"/envoy.extensions.retry.host.previousreviousHostsPredicate"}}"host_selection_retry_max_attempts":"5",]"max_stream_duration":"0s","grpc_timeout_header_max":"0}"config":"/apis/networking.istio.io/v1alpha3/namespaces/istio-injecservice/reviews"}}"operation":"reviews:9080/}}"last_updated":"2023-01-30T06:25:21.804-inject.svc.cluster.local"和"outbound|9080|v3|reviews.istio-inject.svc.cluster.loc"connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes"這里我們就以"outboundl9080lv1lrevie/document_detail/313187.htmlproductv1-797d845774-dndmk.istio-inject--portproductv1-797d845774-dndmk.istio-inject--nameNOTE:Thisoutputonlycontain9080istio-ingressgateway.istio-sproductv1-797d84577reviews.istio-injecreviews.istio-injec-reviews.istio-injecreviews.istio-injecreviews.istio-inject.svc.cluster.localreviews.istio-inject.svc.cluster.local9080v3productv1-797d845774-dndm相關(guān)的網(wǎng)格服務(wù)資源配置上，感興趣的小伙伴可以參考ASM官方文檔。三、容器網(wǎng)絡(luò)常見觀測工具及特點(diǎn)1.常見網(wǎng)絡(luò)排查工具##下載遠(yuǎn)程服務(wù)器渲染后的html文件到本地curl-othatpage.htmlhttcurlhttp://[2001:1890:1112:curl在問題排查過程中主要的作用是用于定界問題的邊界，通常如果curl可以正常訪lsof命令用于查找套接字監(jiān)聽相關(guān)的進(jìn)程，通常我們也可以依賴ss命#查看當(dāng)前存在的網(wǎng)絡(luò)連接信息,這里不會顯示具體的地址端口信息,但是會有句柄相關(guān)的信息?ipnetnsexeccni-d7108c65-eb71-3294ipnetnsexeccni-d7108c65-eb71-3294-2bip命令能夠讓我們在排查問題時(shí)較快的掌握排查的網(wǎng)元的狀態(tài)信息，尤其是在容器場sar工具是一個(gè)sysstat工具集提供的功能強(qiáng)大的性能2.NetExporter技術(shù)原理YesYesYesYes異常事件的現(xiàn)Yes內(nèi)核網(wǎng)絡(luò)高階YesYes1.Prometheus+Grafana配置Kubernetes可以根據(jù)annotation來獲取應(yīng)用自主暴露監(jiān)控指標(biāo)的服務(wù)。應(yīng)用添加prometheus.io/app-metrics:'true'獲知對應(yīng)的en--"--storage.tsdb.retention.time=24h"securityContext:#指定運(yùn)行的用戶為args:-"--config.file=/etc/prometheus/pr-"--web.enable-admin-api"-mountPath:"/etc/prometheus"name:prometheus-config#定義的prometeus.yaapiVersion:rbac.author--apiVersion:rbac.author__meta_kubernetes_pod_annotation_prometheus_io_port]adminuserandadminpassword.登錄Grafana的對外暴露端口，我們需要設(shè)置采集源，設(shè)置Grafana的數(shù)據(jù)源來自的配置相關(guān)的服務(wù)發(fā)現(xiàn)和Grafana大ACKNetExporter支持輸出到務(wù)發(fā)現(xiàn)功能自動獲取到所有正常提供服務(wù)的ACKNetExporter實(shí)例，您可以通過在__meta_kubernetes_pod_annotation_prometheus_io_port]對于使用Grafana進(jìn)行可視化圖形顯示的配置，可以參照上述的指標(biāo)格式，對指標(biāo)的{{namespace}}/{{pod}}/{{node/acs/inspector:Namespace=kube-systemPod=kube-proxy-workerNode=iZbp1jesgumdx66l8ym8#{"time":"2023-02-03T09:01:03.402118044Z","level":"INFO","source":"/#{"time":"2023-02-03T09:01:03.402118044Z","level":"INFO","source":"/go/src/net-exporter/cmd/watch.go:63","msg":"TCPRESET_Pdport=44226state:TCP_OTHER"}3.典型問題排查指南inspector_pod_udpsndbuferrorsUDP協(xié)議通過網(wǎng)絡(luò)層方法發(fā)送時(shí)出現(xiàn)報(bào)錯(cuò)的次數(shù)inspector_pod_udpincsumerrorsUDP接收報(bào)文時(shí)出現(xiàn)CSUM校驗(yàn)錯(cuò)誤的次數(shù)inspector_pod_udpnoports網(wǎng)絡(luò)層調(diào)用__udp4_lib_rcv收包時(shí)找不到對應(yīng)端inspector_pod_udpinerrorsUDP接收報(bào)文時(shí)出現(xiàn)錯(cuò)誤的次數(shù)inspector_pod_udpoutdatagramsUDP協(xié)議通過網(wǎng)絡(luò)層方法成功發(fā)送報(bào)文的數(shù)量inspector_pod_udprcvbuferrorsUDP在將應(yīng)用層協(xié)議數(shù)據(jù)拷貝到Socket接收隊(duì)列時(shí)由于隊(duì)列不足導(dǎo)致的報(bào)錯(cuò)次數(shù)inspector_pod_tcpextlinspector_pod_tcppassiveopensinspector_pod_tcpretraninspector_pod_conntrackinvalinspector_pod_tcpsummarytcpestaTCP連接的發(fā)送隊(duì)列中存在的數(shù)TCP連接的接收隊(duì)列中存在的數(shù)inspector_pod_tcpexttcp報(bào)錯(cuò)時(shí)計(jì)數(shù)，說明重傳無法正常inspector_pod_tcpexttcpabortontimeout由于keepalive/windowprobe/重傳的調(diào)用超過上限發(fā)送Reset時(shí)會更新此計(jì)數(shù)inspector_pod_tcpexttcpabortonlingerFIN_WAIT2的連接時(shí)發(fā)送Reset的次數(shù)inspector_pod_tcpexttcpabortonclose狀態(tài)機(jī)之外的原因關(guān)閉TCP連接時(shí)，仍有數(shù)據(jù)沒有讀取而發(fā)送Reset報(bào)文，則會進(jìn)行指標(biāo)計(jì)數(shù)inspector_pod_tcpexttcpabortonmemory在需要分配tw_sock/tcp_sock等邏輯中有由于tcp_check_oom出發(fā)內(nèi)存不足而發(fā)送Reset結(jié)束連接的次數(shù)inspector_pod_tcpexttcpabortondata*由于Linger/Linger2選項(xiàng)開啟而通過Reset進(jìn)行連接的快速回收時(shí)發(fā)送Reset的計(jì)數(shù)inspector_pod_tcpexttcpackskippedsynrecv在SYN_RECV狀態(tài)的Sock不回復(fù)ACK的次數(shù)inspector_pod_tcpexttcpackskippedpaws由于PAWS機(jī)制觸發(fā)校正，但是OOW限速限制了ACK報(bào)文發(fā)送的次數(shù)inspector_pod_tcpestabresets單個(gè)Pod內(nèi)異常關(guān)閉TCP連接的次數(shù)，這里僅僅從結(jié)果層面統(tǒng)計(jì)inspector_pod_tcpoutrsts單個(gè)Pod內(nèi)TCP發(fā)送的Reset報(bào)文TCP_SEND_RST發(fā)送了TCPReset報(bào)文，排除下方兩個(gè)常見場景，其余發(fā)送Reset報(bào)文均會出發(fā)此事件TCP_SEND_RST_NOSock由于本地沒有Sock而發(fā)送了TCPReset報(bào)文TCP_SEND_RST_ACTIVEReset報(bào)文TCP_RCV_RST_SYN在握手階段收到了Reset報(bào)文TCP_RCV_RST_ESTAB在連接已建立狀態(tài)下收到Reset報(bào)文TCP_RCV_RST_TW在揮手階段收到了Reset報(bào)文●內(nèi)核的有狀態(tài)機(jī)制引發(fā)的延遲，如Conntrainspector_node_netsoftirqshed從軟中斷發(fā)起到ksoftirqd進(jìn)程開始執(zhí)行之間的耗時(shí)分布inspector_node_netsoftirq從ksoftirqd開始執(zhí)行軟中斷內(nèi)容到執(zhí)行完成進(jìn)入offcpu狀態(tài)的耗時(shí)分布inspector_pod_ioioreadsyscall進(jìn)程進(jìn)行文件系統(tǒng)讀操作，如read，pread的次數(shù)inspector_pod_ioiowritesyscall進(jìn)程進(jìn)行文件系統(tǒng)寫操作，如write，pwrite的次數(shù)inspector_pod_ioioreadbytes進(jìn)程從文件系統(tǒng)，通常是塊設(shè)備中讀取的Bytes數(shù)量inspector_pod_ioiowritebyres進(jìn)程向文件系統(tǒng)進(jìn)行寫入的Bytes數(shù)量inspector_node_virtsendcmdlat網(wǎng)卡操作虛擬化調(diào)用的耗時(shí)分布inspector_pod_tcpexttcptimeoutsCA狀態(tài)并未進(jìn)入recovery/loss/disorder時(shí)觸發(fā)，當(dāng)SYN報(bào)文未得到回復(fù)時(shí)進(jìn)行重傳會計(jì)數(shù)inspector_pod_tcpsummarytcpestablishedconn當(dāng)前存在的ESTABLISHED狀態(tài)的TCP連接數(shù)量inspector_pod_tcpsummarytcptimewaitconn當(dāng)前存在的TIMEWAIT狀態(tài)的TCP連接數(shù)量inspector_pod_tcpsummarytcptxqueue當(dāng)前處ESTABLISHED狀態(tài)的TCP連接的發(fā)送隊(duì)列中存在的數(shù)據(jù)包的Bytes總數(shù)inspector_pod_tcpsummarytcprxqueue當(dāng)前處ESTABLISHED狀態(tài)的TCP連接的接收隊(duì)列中存在的數(shù)據(jù)包的Bytes總數(shù)inspector_pod_softnetprocessed單個(gè)Pod內(nèi)所有CPU處理的從網(wǎng)卡放入CPU的Backlog的報(bào)文數(shù)量inspector_pod_softnettimesqueeze單個(gè)Pod內(nèi)所有CPU處理的單次收包沒有全部獲取或者出現(xiàn)超時(shí)的次數(shù)五、典型問題華山論劍1.某客戶nginxingress偶發(fā)性出現(xiàn)4xxor5xx增長，結(jié)合sock分配數(shù)的變化，此時(shí)應(yīng)該有ing。服務(wù)端第收到第三次握手的合法報(bào)文時(shí)，會查找icsk_accept_queue中的request_sock的隊(duì)列，request_sock是一個(gè)輕量級的用于記錄一個(gè)連接回話信息的inet_connection_sock來說，會專門分配一個(gè)成員隊(duì)列來存放所有處于連接狀態(tài)的{}{}{}盡管在不同內(nèi)核版本中有實(shí)現(xiàn)上的差異，但是對于request_sock隊(duì)列，內(nèi)核采用inet_csk_reqsk_queue_is_full進(jìn)行判斷，判斷的方式就是獲取reques{}}<}}