讲的会有点啰嗦
一次抓包 发现的问题
tcpdump -vvv -X -n -i any -s0 host “xx.xx.xx.xx” and port 22 -w xxx.pcap
然后从数据中发现了一问题,总所周知,ssh 通过加密的方式传递数据 多以 也会把 ssh 当作隧道 通信
然后在抓的数据中发现了一些 tcp协议的数据包,然后分析这些包,全都是建立通信的包,然后再google
OpenSSH provides TCP port forwarding, also known as tunnelling, which allows other TCP applications to forward their network data over a secure SSH connection. In other words, existing TCP applications that do not encrypt their data before sending it across the network can send their network traffic through an SSH channel, thereby securing it.
Without TCP forwarding, an application’s client connections directly to its server across the network, as shown in Figure 1. To use port forwarding, an existing SSH session must exist.
简单粗俗的理解,我们使用ssh 对linux 操作 就是这个原理,进程间的通信本地 client port2001 tcp server port 27 在传输数据的使用采用ssh 隧道 port 22
所以当重点在ssh 隧道时, 数据转发 也就是tcp forword
好像理解这个也没有多大的作用