Long Luo's Life Notes

每一天都是奇迹

By Long Luo

安全界大牛 袁哥 在微博上发布了一道 数学挑战题

计算 \((3+ \sqrt{5})^n\) 的整数末三位数,给出能口算或者可以用计算器计算的算法的第一个人,免费给一个价值 1000 元的 A9 投资分享群入群名额。

我的解答

刷微博时看到这道题目时,我觉得很简单啊,于是马上给出了下面的解答:

\(y = (3 + \sqrt{5})^n\) ,两边同取对数, \(\log_{10}{y} = n \log_{10}{(3 + \sqrt{5})}\)\(y = 10^{n \log_{10}{5.23607}}\)\(\log_{10}{5} \approx 0.7\) ,所以 \(y \approx 10^{0.7n}\)

但问题没有这么简单,因为上述解答只在 \(n = 1\) 是正确的,\(n = 2\)\(y = 10^{1.4} \approx 25\) 就不对了,因为精度不够!

之后根据微博评论中其他人给的构造共轭数思路,分析出 \(3\) 位数是周期性的,于是又提交了下面的答案:

图1. 证明周期性

但问题仍然没有这么简单,因为即使循环周期 \(p = 100\) ,而 双精度浮点数 的有效位数也只有 \(15\) 位,而 \(\sqrt{5}\) 是无理数,同时由于舍入误差, \(\log_{10}{(3 + \sqrt{5})}\) 很快就出现精度不够的问题,得到错误的结果。

之后袁哥发布了 解答 ,图片太大,大家可以点开 图片链接 查看详细解答。

袁哥的题解省略了很多东西,对数学不熟悉的人可能看不太明白,我当时也没有完全看明白。根据袁哥解答我重新写了份题解,整理了思路及缺失的步骤,外加证明,有中学数学水平即可看懂,题解第一部分如下:

阅读全文 »

By Long Luo

从古到今,人类一直希望机器能够像人一样,代替人们从事各种工作。

机器学习(Machine Learning)是一门引人入胜的领域,通过模拟人脑神经网络,使计算机能够从数据中学习和改进,以完成各种任务。

深度学习(Deep Learning)

神经网络(Neutral Network)

3Blue1Brown深度学习之神经网络的结构 Part 1

在当今数字化的时代,机器学习和神经网络成为了引领人工智能发展的核心技术。其中,手写数字识别作为机器学习领域的一个经典问题,为我们深入探索神经网络的原理提供了绝佳的案例。

这篇文章将首先介绍什么是神经网络,神经网络的实现原理,之后以经典的手写数字识别为例来加强对机器学习的理解。

什么是神经网络?

神经系统的工作方式与身体的其他器官完全不同。在身体的许多器官中,同类型的细胞执行同样的功能,单个细胞的工作就代表整个器官的功能,器官的功能也就是其中每个细胞功能的总和。例如肝脏中的每个肝细胞都执行同样的化学合成和解毒功能,小肠上皮细胞都执行同样的吸收营养的功能,每条肌肉中的肌肉细胞都执行同样的收缩功能等。它们的功能状态受整体器官的控制,细胞之间的信息交换比较少。

与此相反,神经系统以网络的方式进行工作,神经细胞之间有频繁和复杂的信息传递,每个神经细胞的状态都根据其在网络中的位置不同而与其它神经细胞不同,单个神经细胞功能也不能代表整个神经系统的功能

人脑神经网络是由大量的神经元组成,通过突触连接形成复杂的网络。机器学习通过人脑神经网络的启发,构建人工神经网络模型。人工神经网络由节点(神经元)和连接它们的权重组成。权重表示神经元之间的连接强度,信息通过这些连接在网络中传递和处理。

神经网络是如何工作的?

首先,让我们了解一下神经网络的基本结构。神经网络由输入层、隐藏层和输出层组成。输入层接收手写数字的像素值作为输入,隐藏层则负责提取输入特征,输出层给出最终的识别结果。每个神经元都与上一层的所有神经元连接,并带有权重,这些权重决定了每个神经元对信息的贡献程度。

为了训练神经网络,我们需要大量的手写数字样本作为训练数据。训练过程中,神经网络会根据输入数据的真实标签与预测标签之间的误差,通过反向传播算法来更新神经元之间的权重,从而逐渐提高准确性。反向传播算法通过计算每个神经元的梯度,根据梯度的大小来调整权重,使得预测结果与真实标签更加接近。

对于手写数字识别问题,隐藏层的神经元可以学习到不同笔画、曲线等特征,输出层的神经元则对应0到9的数字标签。通过大量的样本和迭代训练,神经网络可以逐渐学习到正确的特征提取和数字分类规则,从而实现准确的手写数字识别。

除了神经网络的结构和训练方法外,还有一些优化技术可以提高手写数字识别的性能。例如,卷积神经网络(Convolutional Neural Networks,CNN)能够有效地利用图像的空间结构特征,提高了识别的准确性和效率。另外,激活函数的选择、正则化技术的应用以及适当的优化算法等都对神经网络的性能起到重要作用。

神经网络是一种受到人脑神经元启发的算法模型,通过多个层次的神经元组成,可以进行复杂的数据处理和模式识别。在手写数字识别中,我们希望机器能够通过训练学习,准确地识别手写的数字。接下来,我们将揭开神经网络的奥秘。

\[ S(x) = {\frac {1}{1 + e^{-x}}} = {\frac {e^{x}}{e^{x} + 1}} = 1 - S(-x) \]

阅读全文 »

By Frank Luo

This is my answers of the MRI Tutorial Videos How MRI Works - Part 2: The Spin Echo and How MRI Works - Part 3:Fourier Transform and K-Space .

Part 2: The Spin Echo

Questions

Part 2 Questions 1
Part 2 Question 2

Answers

Question 1:

  1. The Boltzmann Magetization \(M_0 = \frac{N {\gamma}^2 \hbar^2 B_0}{4 k T}\), then after elimination the units is \(J/T\).
  2. The Polarization is \(P = \frac{\gamma \hbar B_0}{2kT}\), then after elimination we can get that \(P\) is a special number depends on the material, no SI units.

Question 2:

  1. The polarization is \(P = \frac{51-49}{100} = 0.02\) .
  2. The magnet field strength should be \(B_0 = \frac{0.02}{0.0000034} \approx 5882T\) .
  3. The temperature should be \(T = \frac{300 \times 0.0000034}{0.02} = 0.051K\).

Question 3:

  1. Since the Boltzmann Magetization Equation is \(M = M_0(1- e^{-\frac{t}{T_1}}) e^{-\frac{t}{T_2}}\) , so we can calculate the signal.

The signal of Tissue \(A\) : \(M_A = M_0(1- e^{-\frac{150}{300}}) e^{-\frac{12.5}{20}} = 0.21\) . The signal of Tissue \(B\) : \(M_B = M_0(1- e^{-\frac{150}{200}}) e^{-\frac{12.5}{40}} = 0.38\) .

Surely Tissue \(B\) will deliver more signal.

  1. We have calculated that Tissue \(B\) will deliver more signal if both Tissue \(A\) and \(B\) has the same Boltzmann Magetization.

If Tissue \(A\) is \(85\%\) of Tissue \(B\), then the Tissue \(A\) signal will become lesser, so Tissue \(B\) deliver more signal.

  1. Let function \(f(t) = M_{0A}(1- e^{-\frac{TR}{T_{1A}}})e^{-\frac{t}{T_{2A}}} - M_{0B}(1- e^{-\frac{TR}{T_{1B}}})e^{-\frac{t}{T_{2B}}}\) reprent the signal of time \(t\).

Consider the function: \(f(t) = (1 - e^{-\frac{150}{200}}) e^{-\frac{t}{40}} - (1- e^{-\frac{150}{300}}) e^{-\frac{t}{20}}\) reaches its PEAK at about \(t = 16\), so the \(TE\) should be \(TE = 32ms\).

阅读全文 »

By Long Luo

Startup

1
2
3
4
5
% gdb -help         	print startup help, show switches
*% gdb object normal debug
*% gdb object core core debug (must specify core file)
%% gdb object pid attach to running process
% gdb use file command to load object

Help

1
2
3
4
5
6
7
*(gdb) help        	list command classes
(gdb) help running list commands in one command class
(gdb) help run bottom-level help for a command "run"
(gdb) help info list info commands (running program state)
(gdb) help info line help for a particular info command
(gdb) help show list show commands (gdb state)
(gdb) help show commands specific help for a show comma

Breakpoints

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
*(gdb) break main       set a breakpoint on a function
*(gdb) break 101 set a breakpoint on a line number
*(gdb) break basic.c:101 set breakpoint at file and line (or function)
*(gdb) info breakpoints show breakpoints
*(gdb) delete 1 delete a breakpoint by number
(gdb) delete delete all breakpoints (prompted)
(gdb) clear delete breakpoints at current line
(gdb) clear function delete breakpoints at function
(gdb) clear line delete breakpoints at line
(gdb) disable 2 turn a breakpoint off, but don't remove it
(gdb) enable 2 turn disabled breakpoint back on
(gdb) tbreak function|line set a temporary breakpoint
(gdb) commands break-no ... end set gdb commands with breakpoint
(gdb) ignore break-no count ignore bpt N-1 times before activation
(gdb) condition break-no expression break only if condition is true
(gdb) condition 2 i == 20 example: break on breakpoint 2 if i equals 20
(gdb) watch expression set software watchpoint on variable
(gdb) info watchpoints show current watchpoints
阅读全文 »

By Long Luo

网络抓包常用命令

详细解析和Demo版本:就是要你懂抓包–WireShark之命令行版tshark

用tcpdump抓取并保存包:

1
sudo tcpdump -i eth0 port 3306 -w plantegg.cap

抓到的包存储在plantegg.cap中,可以用作wireshark、tshark详细分析 如果明确知道目的ip、端口等可以通过指定条件来明确只抓取某个连接的包

抓取详细SQL语句:

1
2
3
4
sudo tshark -i eth0 -Y "mysql.command==3" -T fields -e mysql.query
sudo tshark -i eth0 -R mysql.query -T fields -e mysql.query

sudo tshark -i any -f 'port 8527' -s 0 -l -w - |strings

parse 8507/4444 as mysql protocol, default only parse 3306 as mysql.

1
2
3
4
5
sudo tshark -i eth0 -d tcp.port==8507,mysql -T fields -e mysql.query 'port 8507'
sudo tshark -i any -c 50 -d tcp.port==4444,mysql -Y " ((tcp.port eq 4444 ) )" -o tcp.calculate_timestamps:true -T fields -e frame.number -e frame.time_epoch -e frame.time_delta_displayed -e ip.src -e tcp.srcport -e tcp.dstport -e ip.dst -e tcp.time_delta -e tcp.stream -e tcp.len -e mysql.query

sudo tshark -i eth0 -R "ip.addr==11.163.182.137" -d tcp.port==3306,mysql -T fields -e mysql.query 'port 3306'
sudo tshark -i eth0 -R "tcp.srcport==62877" -d tcp.port==3001,mysql -T fields -e tcp.srcport -e mysql.query 'port 3001'

如果MySQL开启了SSL,那么抓包后的内容tshark/wireshark分析不到MySQL的具体内容,可以强制关闭:connectionProperties里加上useSSL=false

查看SQL具体内容

1
sudo tshark -r gege_plantegg.cap -Y "mysql.query or (  tcp.stream==1)" -o tcp.calculate_timestamps:true -T fields -e frame.number -e frame.time_epoch  -e frame.time_delta_displayed  -e ip.src -e tcp.srcport -e tcp.dstport -e ip.dst -e tcp.time_delta -e frame.time_delta_displayed  -e tcp.stream -e tcp.len -e mysql.query

按 mysql 查询分析响应时间

对于rt分析,要注意一个query多个response情况(response结果多,分包了),分析这种rt的时候只看query之后的第一个response,其它连续response需要忽略掉。

以上抓包结果文件可以用tshark进行详细分析

分析MySQL rt,倒数第四列基本就是rt

1
tshark -r gege_plantegg.pcap -Y " ((tcp.srcport eq 3306 ) and tcp.len>0 )" -o tcp.calculate_timestamps:true -T fields -e frame.number -e frame.time_epoch  -e frame.time_delta_displayed  -e ip.src -e tcp.srcport -e tcp.dstport -e ip.dst -e tcp.time_delta -e tcp.stream -e tcp.len -e tcp.analysis.ack_rtt   

或者排序一下

1
tshark -r 213_php.cap -Y "mysql.query or (  tcp.srcport==3306)" -o tcp.calculate_timestamps:true -T fields -e frame.number -e frame.time_epoch  -e frame.time_delta_displayed  -e ip.src -e tcp.srcport -e tcp.dstport -e ip.dst -e tcp.time_delta -e tcp.stream -e tcp.len -e mysql.query |sort -nk9 -nk1

MySQL响应时间直方图【第八列的含义– Time since previous frame in this TCP stream: seconds】:

1
tshark -r gege_plantegg.pcap -Y "mysql.query or (tcp.srcport3306 and tcp.len>60)" -o tcp.calculate_timestamps:true -T fields -e frame.number -e frame.time_epoch  -e frame.time_delta_displayed  -e ip.src -e tcp.srcport -e tcp.dstport -e ip.dst -e tcp.time_delta -e tcp.stream -e tcp.len | awk 'BEGIN {sum0=0;sum3=0;sum10=0;sum30=0;sum50=0;sum100=0;sum300=0;sum500=0;sum1000=0;sumo=0;count=0;sum=0} {rt=$8; if(rt>=0.000) sum=sum+rt; count=count+1; if(rt<=0.000) sum0=sum0+1; else if(rt<0.003) sum3=sum3+1 ; else if(rt<0.01) sum10=sum10+1; else if(rt<0.03) sum30=sum30+1; else if(rt<0.05) sum50=sum50+1; else if(rt < 0.1) sum100=sum100+1; else if(rt < 0.3) sum300=sum300+1; else if(rt < 0.5) sum500=sum500+1; else if(rt < 1) sum1000=sum1000+1; else sum=sum+1 ;} END{printf "-------------\n3ms:\t%s \n10ms:\t%s \n30ms:\t%s \n50ms:\t%s \n100ms:\t%s \n300ms:\t%s \n500ms:\t%s \n1000ms:\t%s \n>1s:\t %s\n-------------\navg: %.6f \n" , sum3,sum10,sum30,sum50,sum100,sum300,sum500,sum1000,sumo,sum/count;}'

按http response分析响应时间

1
tshark -nr 213_php.cap -o tcp.calculate_timestamps:true  -Y "http.request or http.response" -T fields -e frame.number -e frame.time_epoch  -e frame.time_delta_displayed  -e ip.src -e ip.dst -e tcp.stream  -e http.request.full_uri -e http.response.code -e http.response.phrase | sort -nk6 -nk1

分析rtt、丢包、deplicate等等,可以得到整体网络状态

1
$ tshark -r retrans.cap -q -z io,stat,1,"AVG(tcp.analysis.ack_rtt)tcp.analysis.ack_rtt","COUNT(tcp.analysis.retransmission)  tcp.analysis.retransmission","COUNT(tcp.analysis.fast_retransmission) tcp.analysis.fast_retransmission","COUNT(tcp.analysis.duplicate_ack) tcp.analysis.duplicate_ack","COUNT(tcp.analysis.lost_segment) tcp.analysis.lost_segment","MIN(tcp.window_size)tcp.window_size"

=================================================================================== | IO Statistics | | | | Duration: 89.892365 secs | | Interval: 2 secs | | | | Col 1: AVG(tcp.analysis.ack_rtt)tcp.analysis.ack_rtt | | 2: COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission | | 3: COUNT(tcp.analysis.fast_retransmission) tcp.analysis.fast_retransmission | | 4: COUNT(tcp.analysis.duplicate_ack) tcp.analysis.duplicate_ack | | 5: COUNT(tcp.analysis.lost_segment) tcp.analysis.lost_segment | | 6: AVG(tcp.window_size)tcp.window_size | |———————————————————————————| | |1 |2 |3 |4 |5 |6 | | | Interval | AVG | COUNT | COUNT | COUNT | COUNT | AVG | | |————————————————————-| | | 0 <> 2 | 0.001152 | 0 | 0 | 0 | 0 | 4206 | | | 2 <> 4 | 0.002088 | 0 | 0 | 0 | 1 | 6931 | | | 4 <> 6 | 0.001512 | 0 | 0 | 0 | 0 | 7099 | | | 6 <> 8 | 0.002859 | 0 | 0 | 0 | 0 | 7171 | | | 8 <> 10 | 0.001716 | 0 | 0 | 0 | 0 | 6472 | | | 10 <> 12 | 0.000319 | 0 | 0 | 0 | 2 | 5575 | | | 12 <> 14 | 0.002030 | 0 | 0 | 0 | 0 | 6922 | | | 14 <> 16 | 0.003371 | 0 | 0 | 0 | 2 | 5884 | | | 16 <> 18 | 0.000138 | 0 | 0 | 0 | 1 | 3480 | | | 18 <> 20 | 0.000999 | 0 | 0 | 0 | 4 | 6665 | | | 20 <> 22 | 0.000682 | 0 | 0 | 41 | 2 | 5484 | | | 22 <> 24 | 0.002302 | 2 | 0 | 19 | 0 | 7127 | | | 24 <> 26 | 0.000156 | 1 | 0 | 22 | 0 | 3042 | | | 26 <> 28 | 0.000000 | 1 | 0 | 19 | 1 | 152 | | | 28 <> 30 | 0.001498 | 1 | 0 | 24 | 0 | 5615 | | | 30 <> 32 | 0.000235 | 0 | 0 | 44 | 0 | 1880 | | 1 =================================================================================== 2 | IO Statistics | 3 | | 4 | Duration: 89.892365 secs | 5 | Interval: 2 secs | 6 | | 7 | Col 1: AVG(tcp.analysis.ack_rtt)tcp.analysis.ack_rtt | 8 | 2: COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission | 9 | 3: COUNT(tcp.analysis.fast_retransmission) tcp.analysis.fast_retransmission | 10 | 4: COUNT(tcp.analysis.duplicate_ack) tcp.analysis.duplicate_ack | 11 | 5: COUNT(tcp.analysis.lost_segment) tcp.analysis.lost_segment | 12 | 6: AVG(tcp.window_size)tcp.window_size | 13 |———————————————————————————| 14 | |1 |2 |3 |4 |5 |6 | | 15 | Interval | AVG | COUNT | COUNT | COUNT | COUNT | AVG | | 16 |————————————————————-| | 17 | 0 <> 2 | 0.001152 | 0 | 0 | 0 | 0 | 4206 | | 18 | 2 <> 4 | 0.002088 | 0 | 0 | 0 | 1 | 6931 | | 19 | 4 <> 6 | 0.001512 | 0 | 0 | 0 | 0 | 7099 | | 20 | 6 <> 8 | 0.002859 | 0 | 0 | 0 | 0 | 7171 | | 21 | 8 <> 10 | 0.001716 | 0 | 0 | 0 | 0 | 6472 | | 22 | 10 <> 12 | 0.000319 | 0 | 0 | 0 | 2 | 5575 | | 23 | 12 <> 14 | 0.002030 | 0 | 0 | 0 | 0 | 6922 | | 24 | 14 <> 16 | 0.003371 | 0 | 0 | 0 | 2 | 5884 | | 25 | 16 <> 18 | 0.000138 | 0 | 0 | 0 | 1 | 3480 | | 26 | 18 <> 20 | 0.000999 | 0 | 0 | 0 | 4 | 6665 | | 27 | 20 <> 22 | 0.000682 | 0 | 0 | 41 | 2 | 5484 | | 28 | 22 <> 24 | 0.002302 | 2 | 0 | 19 | 0 | 7127 | | 29 | 24 <> 26 | 0.000156 | 1 | 0 | 22 | 0 | 3042 | | 30 | 26 <> 28 | 0.000000 | 1 | 0 | 19 | 1 | 152 | | 31 | 28 <> 30 | 0.001498 | 1 | 0 | 24 | 0 | 5615 | | 32 | 30 <> 32 | 0.000235 | 0 | 0 | 44 | 0 | 1880 | |

tshark

1
tshark -r ./mysql-compress.cap -o tcp.calculate_timestamps:true -T fields -e mysql.caps.cp -e frame.number -e frame.time_epoch  -e frame.time_delta_displayed  -e ip.src -e tcp.srcport -e tcp.dstport -e ip.dst -e tcp.time_delta -e frame.time_delta_displayed  -e tcp.stream -e tcp.len -e mysql.query 

用tcpdump抓取并保存包:

1
sudo tcpdump -i eth0 port 3306 -w plantegg.cap

每隔3秒钟生成一个新文件,总共生成5个文件后(15秒后)终止抓包,然后包名也按时间规范好了

1
sudo tcpdump -t -s 0 tcp port 3306  -w 'dump_%Y-%m-%d_%H:%M:%S.pcap'   -G 3 -W 5 -Z root

每隔30分钟生成一个包并压缩

1
nohup sudo tcpdump -i eth0 -t -s 0 tcp and port 3306 -w 'dump_%Y-%m-%d_%H:%M:%S.pcap' -G 1800 -W 48 -Z root -z gzip &

file size 1000M

1
nohup sudo tcpdump -i eth0 -t -s 0 tcp and port 3306 -w 'dump_' -C 1000 -W 300 -Z root -z gzip &

port range

1
sudo tcpdump -i enp44s0f0 -t -s 0 portrange 3000-3100  -w 'dump_%Y-%m-%d_%H:%M:%S.pcap'   -G 60 -W 100 -Z root

subnet

1
sudo tcpdump -i enp44s0f0 -t -s 0 net 192.168.0.1/28 -w 'dump_%Y-%m-%d_%H:%M:%S.pcap'   -G 60 -W 100 -Z root

抓取详细SQL语句, 快速确认client发过来的具体SQL内容:

1
2
3
4
sudo tshark -i any -f 'port 8527' -s 0 -l -w - |strings
sudo tshark -i eth0 -d tcp.port==3306,mysql -T fields -e mysql.query 'port 3306'
sudo tshark -i eth0 -R "ip.addr==11.163.182.137" -d tcp.port==3306,mysql -T fields -e mysql.query 'port 3306'
sudo tshark -i eth0 -R "tcp.srcport==62877" -d tcp.port==3001,mysql -T fields -e tcp.srcport -e mysql.query 'port 3001'

query time

1
sudo tshark -i eth0 -Y " ((tcp.port eq 3306 ) and tcp.len>0 )" -o tcp.calculate_timestamps:true -T fields -e frame.number -e frame.time_epoch  -e frame.time_delta_displayed  -e ip.src -e tcp.srcport -e tcp.dstport -e ip.dst -e tcp.time_delta -e tcp.stream -e tcp.len -e mysql.query

如果MySQL开启了SSL,那么抓包后的内容tshark/wireshark分析不到MySQL的具体内容,可以强制关闭:connectionProperties里加上useSSL=false

1
tshark -r ./manager.cap -o tcp.calculate_timestamps:true -Y " tcp.analysis.retransmission "  -T fields -e tcp.stream -e frame.number -e frame.time -e ip.src -e tcp.srcport -e tcp.dstport -e ip.dst | sort

MySQL响应时间直方图【第八列的含义– Time since previous frame in this TCP stream: seconds】:

1
tshark -r gege_plantegg.pcap -Y "mysql.query or (tcp.srcport3306 and tcp.len>60)" -o tcp.calculate_timestamps:true -T fields -e frame.number -e frame.time_epoch  -e frame.time_delta_displayed  -e ip.src -e tcp.srcport -e tcp.dstport -e ip.dst -e tcp.time_delta -e tcp.stream -e tcp.len | awk 'BEGIN {sum0=0;sum3=0;sum10=0;sum30=0;sum50=0;sum100=0;sum300=0;sum500=0;sum1000=0;sumo=0;count=0;sum=0} {rt=$8; if(rt>=0.000) sum=sum+rt; count=count+1; if(rt<=0.000) sum0=sum0+1; else if(rt<0.003) sum3=sum3+1 ; else if(rt<0.01) sum10=sum10+1; else if(rt<0.03) sum30=sum30+1; else if(rt<0.05) sum50=sum50+1; else if(rt < 0.1) sum100=sum100+1; else if(rt < 0.3) sum300=sum300+1; else if(rt < 0.5) sum500=sum500+1; else if(rt < 1) sum1000=sum1000+1; else sum=sum+1 ;} END{printf "-------------\n3ms:\t%s \n10ms:\t%s \n30ms:\t%s \n50ms:\t%s \n100ms:\t%s \n300ms:\t%s \n500ms:\t%s \n1000ms:\t%s \n>1s:\t %s\n-------------\navg: %.6f \n" , sum3,sum10,sum30,sum50,sum100,sum300,sum500,sum1000,sumo,sum/count;}'

分析MySQL rt,倒数第四列基本就是rt

1
tshark -r gege_plantegg.pcap -Y " ((tcp.srcport eq 3306 ) and tcp.len>0 )" -o tcp.calculate_timestamps:true -T fields -e frame.number -e frame.time_epoch  -e frame.time_delta_displayed  -e ip.src -e tcp.srcport -e tcp.dstport -e ip.dst -e tcp.time_delta -e tcp.stream -e tcp.len -e tcp.analysis.ack_rtt

或者排序一下

1
tshark -r 213_php.cap -Y "mysql.query or (  tcp.srcport==3306)" -o tcp.calculate_timestamps:true -T fields -e frame.number -e frame.time_epoch  -e frame.time_delta_displayed  -e ip.src -e tcp.srcport -e tcp.dstport -e ip.dst -e tcp.time_delta -e tcp.stream -e tcp.len -e mysql.query |sort -nk9 -nk1

将 tls key和抓包文件合并

1
editcap --inject-secrets tls,key.log in.pcap out.pcap

把包长截掉,只保留前面54,可以脱敏包内容

1
editcap -s 54 old.pcap new.pcap

参考文献

  1. The Most Useful Linux Commands For Network And Systems Administrators
  2. 7 Linux networking commands that every sysadmin should know
  3. Mastering Linux Networking Commands: A Comprehensive Guide
  4. Linux Networking Commands with Examples
0%