SYN gong ji de ji ben yuan li yu fang fan ji shu － hei ke ruan jian - 王朝网络 - & |
分享到：&&&&&当前位置: &&&&&&&&SYN gong ji de ji ben yuan li yu fang fan ji shu － hei ke ruan jianSYN gong ji de ji ben yuan li yu fang fan ji shu － hei ke ruan jian上一篇下一篇字体: || 本文来源: 互联网&&&本文为【】的拼音翻译版　　ju tong ji ， zai suo you hei ke gong ji shi jian zhong ，SYN gong ji shi zui chang jian you zui rong yi bei li yong de yi zhong gong ji shou fa 。 xiang xin hen duo ren huan ji de 2000 nian YAHOO wang zhan zao shou de gong ji shi li ， dang shi hei ke li yong de jiu shi jian dan er you xiao de SYN gong ji ， you xie wang luo ru chong bing du pei he SYN gong ji zao cheng geng da de po huai 。 ben wen jie shao SYN gong ji de ji ben yuan li 、 gong ju ji jian ce fang fa ， bing quan mian tan tao SYN gong ji fang fan ji shu 。　　yi 、TCP wo shou xie yi 　　zai TCP/IP xie yi zhong ，TCP xie yi ti gong ke kao de lian jie fu wu ， cai yong san ci wo shou jian li yi ge lian jie 。　　di yi ci wo shou ： jian li lian jie shi ， ke hu duan fa song syn bao (syn=j) dao fu wu qi ， bing jin ru SYN_SEND zhuang tai ， deng d　　di er ci wo shou ： fu wu qi shou dao syn bao ， bi xu que ren ke hu de SYN(ack=j+1)， tong shi zi ji ye fa song yi ge SYN bao (syn=k)， ji SYN+ACK bao ， ci shi fu wu qi jin ru SYN_RECV　　di san ci wo shou ： ke hu duan shou dao fu wu qi de SYN+ACK bao ， xiang fu wu qi fa song que ren bao ACK(ack=k+1)， ci bao fa song wan bi ， ke hu duan he fu wu qi jin ru ESTABLISHED zhuang tai ， wan cheng san ci wo shou 。　　wan cheng san ci wo shou ， ke hu duan yu fu wu qi kai shi chuan song shu ju ， zai shang shu guo cheng zhong ， huan you yi xie chong yao de gai nian ：　　wei lian jie dui lie ： zai san ci wo shou xie yi zhong ， fu wu qi wei hu yi ge wei lian jie dui lie ， gai dui lie wei mei ge ke hu duan de SYN bao (syn=j) kai she yi ge tiao mu ， gai tiao mu biao ming fu wu qi yi shou dao SYN bao ， bing xiang ke hu fa chu que ren ， zheng zai deng dai ke hu de que ren bao 。 zhe xie tiao mu suo biao shi de lian jie zai fu wu qi chu yu Syn_RECV zhuang tai ， dang fu wu qi shou dao ke hu de que ren bao shi ， shan chu gai tiao mu ， fu wu qi jin ru ESTABLISHED zhuang tai 。　　Backlog shen shu ： biao shi wei lian jie dui lie de zui da rong na shu mu 。　　SYN-ACK chong chuan ci shu
fu wu qi fa song wan SYN-ACK bao ， ru guo wei shou dao ke hu que ren bao ， fu wu qi jin xing shou ci chong chuan ， deng dai yi duan shi jian reng wei shou dao ke hu que ren bao ， jin xing di er ci chong chuan ， ru guo chong chuan ci shu chao guo xi tong gui ding de zui da chong chuan ci shu ， xi tong jiang gai lian jie xin xi cong ban lian jie dui lie zhong shan chu 。 zhu yi ， mei ci chong chuan deng dai de shi jian bu yi ding xiang tong 。　　ban lian jie cun huo shi jian ： shi zhi ban lian jie dui lie de tiao mu cun huo de zui chang shi jian ， ye ji fu wu cong shou dao SYN bao dao que ren zhe ge bao wen wu xiao de zui chang shi jian ， gai shi jian zhi shi suo you chong chuan qing qiu bao de zui chang deng dai shi jian zong he 。 you shi wo men ye cheng ban lian jie cun huo shi jian wei Timeout shi jian 、SYN_RECV cun huo shi jian 。　　er 、SYN gong ji yuan li 　　SYN gong ji shu yu DOS gong ji de yi zhong ， ta li yong TCP xie yi que xian ， tong guo fa song da liang de ban lian jie qing qiu ， hao fei CPU he nei cun zi yuan 。SYN gong ji chu le neng ying xiang zhu ji wai ， huan ke yi wei hai lu you qi 、 fang huo qiang deng wang luo xi tong ， shi shi shang SYN gong ji bing bu guan mu biao shi shen me xi tong ， zhi yao zhe xie xi tong da kai TCP fu wu jiu ke yi shi shi 。 cong shang tu ke kan dao ， fu wu qi jie shou dao lian jie qing qiu (syn=j)， jiang ci xin xi jia ru wei lian jie dui lie ， bing fa song qing qiu bao gei ke hu (syn=k,ack=j+1)， ci shi jin ru SYN_RECV zhuang tai 。 dang fu wu qi wei shou dao ke hu duan de que ren bao shi ， chong fa qing qiu bao ， yi zhi dao chao shi ， cai jiang ci tiao mu cong wei lian jie dui lie shan chu 。 pei he IP qi pian ，SYN gong ji neng da dao hen hao de xiao guo ， tong chang ， ke hu duan zai duan shi jian nei wei zao da liang bu cun zai de IP di zhi ， xiang fu wu qi bu duan di fa song syn bao ， fu wu qi hui fu que ren bao ， bing deng dai ke hu de que ren ， you yu yuan di zhi shi bu cun zai de ， fu wu qi xu yao bu duan de chong fa zhi zhi chao shi ， zhe xie wei zao de SYN bao jiang chang shi jian zhan yong wei lian jie dui lie ， zheng chang de SYN qing qiu bei diu qi ， mu biao xi tong yun xing huan man ， yan chong zhe yin qi wang luo du sai shen zhi xi tong tan huan 。　　san 、SYN gong ji gong ju 　　SYN gong ji shi xian qi lai fei chang de jian dan ， hu lian wang shang you da liang xian cheng de SYN gong ji gong ju 。　　Windows xi tong xia de SYN gong ju ：　　yi synkill.exe wei li ， yun xing gong ju ， xuan ze sui ji de yuan di zhi he yuan duan guo ， bing tian xie mu biao ji qi di zhi he TCP duan guo ， ji huo yun xing ， hen kuai jiu hui fa xian mu biao xi tong yun xing huan man 。 ru guo gong ji xiao guo bu ming xian ， ke neng shi mu biao ji qi bing wei kai qi suo tian xie de TCP duan guo huo zhe fang huo qiang ju jue fang wen gai duan guo ， ci shi ke xuan ze yuan xu fang wen de TCP duan guo ， tong chang ，Windows xi tong kai fang tcp139 duan guo ，UNIX xi tong kai fang tcp7、21、23 deng duan guo 。　　si 、 jian ce SYN gong ji 　　jian ce SYN gong ji fei chang de fang bian ， dang ni zai fu wu qi shang kan dao da liang de ban lian jie zhuang tai shi ， te bie shi yuan IP di zhi shi sui ji de ， ji ben shang ke yi duan ding zhe shi yi ci SYN gong ji 。 wo men shi yong xi tong zi dai de netstat gong ju lai jian ce SYN gong ji ：　　# netstat -n -p TCP tcp0 0 10.11.11.11:2.8:25882 SYN_RECV- tcp0　　0 10.11.11.11:.204:2577 SYN_RECV- tcp0 0　　10.11.11.11:.129:51748 SYN_RECV- tcp0 0　　10.11.11.11:.25:47393 SYN_RECV- tcp0 0　　10.11.11.11:4.182:60427 SYN_RECV- tcp0 0　　10.11.11.11:.38:278 SYN_RECV- tcp0 0　　10.11.11.11:.96:5122SYN_RECV- tcp0 0　　10.11.11.11:9.207:49162 SYN_RECV- ...　　shang mian shi zai LINUX xi tong zhong kan dao de ， hen duo lian jie chu yu SYN_RECV zhuang tai ( zai WINDOWS xi tong zhong shi SYN_RECEIVED zhuang tai )， yuan IP di zhi dou shi sui ji de ， biao ming zhe shi yi zhong dai you IP qi pian de SYN gong ji 。　　wo men ye ke yi tong guo xia mian de ming ling zhi jie cha kan zai LINUX huan jing xia mou ge duan guo de wei lian jie dui lie de tiao mu shu ：　　#netstat -n -p TCP
grep SYN_RECV
wc -l 324　　xian shi TCP duan guo 22 de wei lian jie shu you 324 ge ， sui ran huan yuan da bu dao xi tong ji xian ， dan ying gai yin qi guan li yuan de zhu yi 。　　wu 、SYN gong ji fang fan ji shu 　　guan yu SYN gong ji fang fan ji shu ， ren men yan jiu de bi jiao zao 。 gui na qi lai ， zhu yao you liang da lei ， yi lei shi tong guo fang huo qiang 、 lu you qi deng guo lv wang guan fang hu ， ling yi lei shi tong guo jia gu TCP/IP xie yi zhan fang fan . dan bi xu qing chu de shi ，SYN gong ji bu neng wan quan bei zu zhi ， wo men suo zuo de shi jin ke neng de jian qing SYN gong ji de wei hai ， chu fei jiang TCP xie yi chong xin she ji 。　　1、 guo lv wang guan fang hu 　　zhe li ， guo lv wang guan zhu yao zhi ming fang huo qiang ， dang ran lu you qi ye neng cheng wei guo lv wang guan 。 fang huo qiang bu shu zai bu tong wang luo zhi jian ， fang fan wai lai fei fa gong ji he fang zhi bao mi xin xi wai xie ， ta chu yu ke hu duan he fu wu qi zhi jian ， li yong ta lai fang hu SYN gong ji neng qi dao hen hao de xiao guo 。 guo lv wang guan fang hu zhu yao bao kuo chao shi she zhi ，SYN wang guan he SYN dai li san zhong 。　　· wang guan chao shi she zhi ：　　fang huo qiang she zhi SYN zhuan fa chao shi shen shu ( zhuang tai jian ce de fang huo qiang ke zai zhuang tai biao li mian she zhi )， gai shen shu yuan xiao yu fu wu qi de timeout shi jian 。 dang ke hu duan fa song wan SYN bao ， fu wu duan fa song que ren bao hou (SYN+ACK)， fang huo qiang ru guo zai ji shu qi dao qi shi huan wei shou dao ke hu duan de que ren bao (ACK)， ze wang fu wu qi fa song RST bao ， yi shi fu wu qi cong dui lie zhong shan qu gai ban lian jie 。 zhi de zhu yi de shi ， wang guan chao shi shen shu she zhi bu yi guo xiao ye bu yi guo da ， chao shi shen shu she zhi guo xiao hui ying xiang zheng chang de tong xun ， she zhi tai da ， you hui ying xiang fang fan SYN gong ji de xiao guo ， bi xu gen ju suo chu de wang luo ying yong huan jing lai she zhi ci shen shu 。　　·SYN wang guan ：　　SYN wang guan shou dao ke hu duan de SYN bao shi ， zhi jie zhSYN wang guan shou dao fu wu qi de SYN/ACK bao hou ， jiang gai bao zhuan fa gei ke hu duan ， tong shi yi ke hu duan de ming yi gei fu wu qi fa ACK que ren bao 。 ci shi fu wu qi you ban lian jie zhuang tai jin ru lian jie zhuang tai 。 dang ke hu duan que ren bao dao da shi ， ru guo you shu ju ze zhuan fa ， fou ze diu qi 。 shi shi shang ， fu wu qi chu le wei chi ban lian jie dui lie wai ， huan yao you yi ge lian jie dui lie ， ru guo fa sheng SYN gong ji shi ， jiang shi lian jie dui lie shu mu zeng jia ， dan yi ban fu wu qi suo neng cheng shou de lian jie shu liang bi ban lian jie shu liang da de duo ， suo yi zhe zhong fang fa neng you xiao di jian qing dui fu wu qi de gong ji 。　　·SYN dai li ：　　dang ke hu duan SYN bao dao da guo lv wang guan shi ，SYN dai li bing bu zhuan fa SYN bao ， er shi yi fu wu qi de ming yi zhu dong hui fu SYN/ACK bao gei ke hu ， ru guo shou dao ke hu de ACK bao ， biao ming zhe shi zheng chang de fang wen ， ci shi fang huo qiang xiang fu wu qi fa song ACK bao bing wan cheng san ci wo shou 。SYN dai li shi shi shang dai ti le fu wu qi qu chu li SYN gong ji ， ci shi yao qiu guo lv wang guan zi shen ju you hen qiang de fang fan SYN gong ji neng li 。　　2、 jia gu tcp/ip xie yi zhan 　　fang fan SYN gong ji de ling yi xiang zhu yao ji shu shi tiao zheng tcp/ip xie yi zhan ， xiu gai tcp xie yi shi xian 。 zhu yao fang fa you SynAttackProtect bao hu ji zhi 、SYN cookies ji shu 、 zeng jia zui da ban lian jie he suo duan chao shi shi jian deng 。tcp/ip xie yi zhan de tiao zheng ke neng hui yin qi mou xie gong neng de shou xian ， guan li yuan ying gai zai jin xing chong fen le jie he ce shi de qian ti xia jin xing ci xiang gong zuo 。　　·SynAttackProtect ji zhi 　　wei fang fan SYN gong ji ，Windows2000 xi tong de tcp/ip xie yi zhan nei qian le SynAttackProtect ji zhi ，Win2003 xi tong ye cai yong ci ji zhi 。SynAttackProtect ji zhi shi tong guo guan bi mou xie socket xuan xiang ， zeng jia e wai de lian jie zhi shi he jian shao chao shi shi jian ， shi xi tong neng chu li geng duo de SYN lian jie ， yi da dao fang fan SYN gong ji de mu de 。 mo ren qing kuang xia ，Windows2000 cao zuo xi tong bing bu zhi chi SynAttackProtect bao hu ji zhi ， xu yao zai zhu ce biao yi xia wei zhi zeng jia SynAttackProtect jian zhi ：　　HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters　　dang SynAttackProtect zhi ( ru wu te bie shuo ming ， ben wen ti dao de zhu ce biao jian zhi dou wei shi liu jin zhi ) wei 0 huo bu she zhi shi ， xi tong bu shou SynAttackProtect bao hu 。　　dang SynAttackProtect zhi wei 1 shi ， xi tong tong guo jian shao chong chuan ci shu he yan chi wei lian jie shi lu you huan chong xiang (route cache entry) fang fan SYN gong ji 。　　dang SynAttackProtect zhi wei 2 shi (Microsoft tui jian shi yong ci zhi )， xi tong bu jin shi yong backlog dui lie ， huan shi yong fu jia de ban lian jie zhi shi ， yi ci lai chu li geng duo de SYN lian jie ， shi yong ci jian zhi shi ，tcp/ip de TCPInitialRTT、window size he ke hua dong chuang guo jiang bei jin zhi 。　　wo men ying gai zhi dao ， ping shi ， xi tong shi bu qi yong SynAttackProtect ji zhi de ， jin zai jian ce dao SYN gong ji shi ， cai qi yong ， bing tiao zheng tcp/ip xie yi zhan 。 na me xi tong shi ru he jian ce SYN gong ji fa sheng de ne ? shi shi shang ， xi tong gen ju TcpMaxHalfOpen,TcpMaxHalfOpenRetried he TcpMaxPortsExhausted san ge shen shu pan duan shi fou zao shou SYN gong ji 。　　TcpMaxHalfOpen biao shi neng tong shi chu li de zui da ban lian jie shu ， ru guo chao guo ci zhi ， xi tong ren wei zheng chu yu SYN gong ji zhong 。Windows2000server mo ren zhi wei 100，Windows2000 Advanced server wei 500。　　TcpMaxHalfOpenRetried ding yi le bao cun zai backlog dui lie qie chong chuan guo de ban lian jie shu ， ru guo chao guo ci zhi ， xi tong zi dong qi dong SynAttackProtect ji zhi 。Windows2000 server mo ren zhi wei 80，Windows2000 Advanced server wei 400。　　TcpMaxPortsExhausted shi zhi xi tong ju jue de SYN qing qiu bao de shu liang ， mo ren shi 5。　　ru guo xiang tiao zheng yi shang shen shu de mo ren zhi ， ke yi zai zhu ce biao li xiu gai ( wei zhi yu SynAttackProtect xiang tong )　　· SYN cookies ji shu 　　wo men zhi dao ，TCP xie yi kai pi le yi ge bi jiao da de nei cun kong jian backlog dui lie lai cun chu ban lian jie tiao mu ， dang SYN qing qiu bu duan zeng jia ， bing zhe ge kong jian ， zhi shi xi tong diu qi SYN lian jie 。 wei shi ban lian jie dui lie bei sai man de qing kuang xia ， fu wu qi reng neng chu li xin dao de SYN qing qiu ，SYN cookies ji shu bei she ji chu lai 。　　SYN cookies ying yong yu linux、FreeBSD deng cao zuo xi tong ， dang ban lian jie dui lie man shi ，SYNcookies bing bu diu qi SYN qing qiu ， er shi tong guo jia mi ji shu lai biao shi ban lian jie zhuang tai 。　　zai TCP shi xian zhong ， dang shou dao ke hu duan de SYN qing qiu shi ， fu wu qi xu yao hui fu SYN+ACK bao gei ke hu duan ， ke hu duan ye yao fa song que ren bao gei fu wu qi 。 tong chang ， fu wu qi de chu shi xu lie hao you fu wu qi an zhao yi ding de gui lv ji suan de dao huo cai yong sui ji shu ， dan zai SYN cookies zhong ， fu wu qi de chu shi xu lie hao shi tong guo dui ke hu duan IP di zhi 、 ke hu duan duan guo 、 fu wu qi IP di zhi he fu wu qi duan guo yi ji qi ta yi xie an quan shu zhi deng yao su jin xing hash yun suan ， jia mi de dao de ， cheng zhi wei cookie。 dang fu wu qi zao shou SYN gong ji shi de backlog dui lie man shi ， fu wu qi bing bu ju jue xin de SYN qing qiu ， er shi hui fu cookie( hui fu bao de SYN xu lie hao ) gei ke hu duan ， ru guo shou dao ke hu duan de ACK bao ， fu wu qi jiang ke hu duan de ACK xu lie hao jian qu 1 de dao cookie bi jiao zhi ， bing jiang shang shu yao su jin xing yi ci hash yun suan ， kan kan shi fou deng yu ci cookie。 ru guo xiang deng ， zhi jie wan cheng san ci wo shou ( zhu yi ： ci shi bing bu yong cha kan ci lian jie shi fou shu yu backlog dui lie )。　　zai RedHat linux zhong ， qi yong SYN cookies shi tong guo zai qi dong huan jing zhong she zhi yi xia ming ling lai wan cheng ：　　# echo 1 ?? /proc/sys/net/ipv4/tcp_syncookies　　· zeng jia zui da ban lian jie shu 　　da liang de SYN qing qiu dao zhi wei lian jie dui lie bei sai man ， shi zheng chang de TCP lian jie wu fa shun li wan cheng san ci wo shou ， tong guo zeng da wei lian jie dui lie kong jian ke yi huan jie zhe zhong ya li 。 dang ran backlog dui lie xu yao zhan yong da liang de nei cun zi yuan ， bu neng bei wu xian de kuo da 。　　Windows2000： chu le shang mian jie shao de TcpMaxHalfOpen, TcpMaxHalfOpenRetried shen shu wai ，Windows2000 cao zuo xi tong ke yi tong guo she zhi dong tai backlog(dynamic backlog) lai zeng da xi tong suo neng rong na de zui da ban lian jie shu ， pei zhi dong tai backlog you AFD.SYS qu dong wan cheng ，AFD.SYS shi yi zhong nei gai ji de qu dong ， yong yu zhi chi ji yu window socket de ying yong cheng xu ， bi ru ftp、telnet deng 。AFD.SYS zai zhu ce biao de wei zhi ：　　HKLM\System\CurrentControlSet\Services\AFD\Parameters\EnableDynamicBacklog zhi wei 1 shi ， biao shi qi yong dong tai backlog， ke yi xiu gai zui da ban lian jie shu 。　　MinimumDynamicBacklog biao shi ban lian jie dui lie wei dan ge TCP duan guo fen pei de zui xiao kong xian lian jie shu ， dang gai TCP duan guo zai backlog dui lie de kong xian lian jie xiao yu ci lin jie zhi shi ， xi tong wei ci duan guo zi dong qi yong kuo zhan de kong xian lian jie (DynamicBacklogGrowthDelta)，Microsoft tui jian gai zhi wei 20。　　MaximumDynamicBacklog shi dang qian huo dong de ban lian jie he kong xian lian jie de he ， dang ci he chao guo mou ge lin jie zhi shi ， xi tong ju jue SYN bao ，Microsoft tui jian MaximumDynamicBacklog zhi bu de chao guo 2000。　　DynamicBacklogGrowthDelta zhi shi zhi kuo zhan de kong xian lian jie shu ， ci lian jie shu bing bu ji suan zai MaximumDynamicBacklog nei ， dang ban lian jie dui lie wei mou ge TCP duan guo fen pei de kong xian lian jie xiao yu MinimumDynamicBacklog shi ， xi tong zi dong fen pei DynamicBacklogGrowthDelta suo ding yi de kong xian lian jie kong jian ， yi shi gai TCP duan guo neng chu li geng duo de ban lian jie 。Microsoft tui jian gai zhi wei 10。　　LINUX：Linux yong bian liang tcp_max_syn_backlog ding yi backlog dui lie rong na de zui da ban lian jie shu 。 zai Redhat 7.3 zhong ， gai bian liang de zhi mo ren wei 256， zhe ge zhi shi yuan yuan bu gou de ， yi ci qiang du bu da de SYN gong ji jiu neng shi ban lian jie dui lie zhan man 。 wo men ke yi tong guo yi xia ming ling xiu gai ci bian liang de zhi ：　　# sysctl -w net.ipv4.tcp_max_syn_backlog=`2048`　　Sun Solaris Sun Solaris yong bian liang tcp_conn_req_max_q0 lai ding yi zui da ban lian jie shu ， zai Sun Solaris 8 zhong ， gai zhi mo ren wei 1024， ke yi tong guo add ming ling gai bian zhe ge zhi ：　　# ndd -set /dev/tcp tcp_conn_req_max_q0 2048　　HP-UX：HP-UX yong bian liang tcp_syn_rcvd_max lai ding yi zui da ban lian jie shu ， zai HP-UX11.00 zhong ， gai zhi mo ren wei 500， ke yi tong guo ndd ming ling gai bian mo ren zhi ：　　#ndd -set /dev/tcp tcp_syn_rcvd_max 2048　　· suo duan chao shi shi jian 　　shang wen ti dao ， tong guo zeng da backlog dui lie neng fang fan SYN ling wai jian shao chao shi shi jian ye shi xi tong neng chu li geng duo de SYN qing qiu 。 wo men zhi dao ，timeout chao shi shi jian ， ye ji ban lian jie cun huo shi jian ， shi xi tong suo you chong chuan ci shu deng dai de chao shi shi jian zong he ， zhe ge zhi yue da ， ban lian jie shu zhan yong backlog dui lie de shi jian jiu yue chang ， xi tong neng chu li de SYN qing qiu jiu yue shao 。 wei suo duan chao shi shi jian ， ke yi tong guo suo duan chong chuan chao shi shi jian ( yi ban shi di yi ci chong chuan chao shi shi jian ) he jian shao chong chuan ci shu lai shi xian 。　　Windows2000 di yi ci chong chuan zhi qian deng dai shi jian mo ren wei 3 miao ， wei gai bian ci mo ren zhi ， ke yi tong guo xiu gai wang luo jie guo zai zhu ce biao li de TcpInitialRtt zhu ce zhi lai wan cheng 。 chong chuan ci shu you TcpMaxConnectResponseRetransmissions lai ding yi ， zhu ce biao de wei zhi shi ：　　HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters registry key　　dang ran wo men ye ke yi ba chong chuan ci shu she zhi wei 0 ci ， zhe yang fu wu qi ru guo zai 3 miao nei huan wei shou dao ack que ren bao jiu zi dong cong backlog dui lie zhong shan chu gai lian jie tiao mu 。　　LINUX：Redhat shi yong bian liang tcp_synack_retries ding yi chong chuan ci shu ， qi mo ren zhi shi 5 ci ， zong chao shi shi jian xu yao 3 fen zhong 。　　Sun Solaris Solaris mo ren de chong chuan ci shu shi 3 ci ， zong chao shi shi jian wei 3 fen zhong ， ke yi tong guo ndd ming ling xiu gai zhe xie mo ren zhi 。【】【】&今日推荐&&幽默笑话百态军事探索娱乐女性健康旅游互联网&&　　 ju tong ji ， zai suo you hei ke gong ji shi jian zhong ，SYN gong ji shi zui chang jian you zui rong yi bei li yong de yi zhong gong ji shou fa 。 xiang xin hen duo ren huan ji de 2000 nian YAHOO wang zhan zao shou de gong ji shi li ， dang shi hei ke li yong de jiu shi jian dan er you xiao de SYN gong ji ， you xie wang luo ru chong bing du pei he SYN gong ji zao cheng geng da de po huai 。 ben wen jie shao SYN gong ji de ji ben yuan li 、 gong ju ji jian ce fang fa ， bing quan mian tan tao SYN gong ji fang fan ji shu 。
　　 yi 、TCP wo shou xie yi
　　 zai TCP/IP xie yi zhong ，TCP xie yi ti gong ke kao de lian jie fu wu ， cai yong san ci wo shou jian li yi ge lian jie 。
　　 di yi ci wo shou ： jian li lian jie shi ， ke hu duan fa song syn bao (syn=j) dao fu wu qi ， bing jin ru SYN_SEND zhuang tai ， deng d
　　 di er ci wo shou ： fu wu qi shou dao syn bao ， bi xu que ren ke hu de SYN(ack=j+1)， tong shi zi ji ye fa song yi ge SYN bao (syn=k)， ji SYN+ACK bao ， ci shi fu wu qi jin ru SYN_RECV
　　 di san ci wo shou ： ke hu duan shou dao fu wu qi de SYN+ACK bao ， xiang fu wu qi fa song que ren bao ACK(ack=k+1)， ci bao fa song wan bi ， ke hu duan he fu wu qi jin ru ESTABLISHED zhuang tai ， wan cheng san ci wo shou 。
　　 wan cheng san ci wo shou ， ke hu duan yu fu wu qi kai shi chuan song shu ju ， zai shang shu guo cheng zhong ， huan you yi xie chong yao de gai nian ：
　　 wei lian jie dui lie ： zai san ci wo shou xie yi zhong ， fu wu qi wei hu yi ge wei lian jie dui lie ， gai dui lie wei mei ge ke hu duan de SYN bao (syn=j) kai she yi ge tiao mu ， gai tiao mu biao ming fu wu qi yi shou dao SYN bao ， bing xiang ke hu fa chu que ren ， zheng zai deng dai ke hu de que ren bao 。 zhe xie tiao mu suo biao shi de lian jie zai fu wu qi chu yu Syn_RECV zhuang tai ， dang fu wu qi shou dao ke hu de que ren bao shi ， shan chu gai tiao mu ， fu wu qi jin ru ESTABLISHED zhuang tai 。
　　Backlog shen shu ： biao shi wei lian jie dui lie de zui da rong na shu mu 。
　　SYN-ACK chong chuan ci shu 　 fu wu qi fa song wan SYN-ACK bao ， ru guo wei shou dao ke hu que ren bao ， fu wu qi jin xing shou ci chong chuan ， deng dai yi duan shi jian reng wei shou dao ke hu que ren bao ， jin xing di er ci chong chuan ， ru guo chong chuan ci shu chao guo xi tong gui ding de zui da chong chuan ci shu ， xi tong jiang gai lian jie xin xi cong ban lian jie dui lie zhong shan chu 。 zhu yi ， mei ci chong chuan deng dai de shi jian bu yi ding xiang tong 。
　　 ban lian jie cun huo shi jian ： shi zhi ban lian jie dui lie de tiao mu cun huo de zui chang shi jian ， ye ji fu wu cong shou dao SYN bao dao que ren zhe ge bao wen wu xiao de zui chang shi jian ， gai shi jian zhi shi suo you chong chuan qing qiu bao de zui chang deng dai shi jian zong he 。 you shi wo men ye cheng ban lian jie cun huo shi jian wei Timeout shi jian 、SYN_RECV cun huo shi jian 。
　　 er 、SYN gong ji yuan li
　　SYN gong ji shu yu DOS gong ji de yi zhong ， ta li yong TCP xie yi que xian ， tong guo fa song da liang de ban lian jie qing qiu ， hao fei CPU he nei cun zi yuan 。SYN gong ji chu le neng ying xiang zhu ji wai ， huan ke yi wei hai lu you qi 、 fang huo qiang deng wang luo xi tong ， shi shi shang SYN gong ji bing bu guan mu biao shi shen me xi tong ， zhi yao zhe xie xi tong da kai TCP fu wu jiu ke yi shi shi 。 cong shang tu ke kan dao ， fu wu qi jie shou dao lian jie qing qiu (syn=j)， jiang ci xin xi jia ru wei lian jie dui lie ， bing fa song qing qiu bao gei ke hu (syn=k,ack=j+1)， ci shi jin ru SYN_RECV zhuang tai 。 dang fu wu qi wei shou dao ke hu duan de que ren bao shi ， chong fa qing qiu bao ， yi zhi dao chao shi ， cai jiang ci tiao mu cong wei lian jie dui lie shan chu 。 pei he IP qi pian ，SYN gong ji neng da dao hen hao de xiao guo ， tong chang ， ke hu duan zai duan shi jian nei wei zao da liang bu cun zai de IP di zhi ， xiang fu wu qi bu duan di fa song syn bao ， fu wu qi hui fu que ren bao ， bing deng dai ke hu de que ren ， you yu yuan di zhi shi bu cun zai de ， fu wu qi xu yao bu duan de chong fa zhi zhi chao shi ， zhe xie wei zao de SYN bao jiang chang shi jian zhan yong wei lian jie dui lie ， zheng chang de SYN qing qiu bei diu qi ， mu biao xi tong yun xing huan man ， yan chong zhe yin qi wang luo du sai shen zhi xi tong tan huan 。
　　 san 、SYN gong ji gong ju
　　SYN gong ji shi xian qi lai fei chang de jian dan ， hu lian wang shang you da liang xian cheng de SYN gong ji gong ju 。
　　Windows xi tong xia de SYN gong ju ：
　　 yi synkill.exe wei li ， yun xing gong ju ， xuan ze sui ji de yuan di zhi he yuan duan guo ， bing tian xie mu biao ji qi di zhi he TCP duan guo ， ji huo yun xing ， hen kuai jiu hui fa xian mu biao xi tong yun xing huan man 。 ru guo gong ji xiao guo bu ming xian ， ke neng shi mu biao ji qi bing wei kai qi suo tian xie de TCP duan guo huo zhe fang huo qiang ju jue fang wen gai duan guo ， ci shi ke xuan ze yuan xu fang wen de TCP duan guo ， tong chang ，Windows xi tong kai fang tcp139 duan guo ，UNIX xi tong kai fang tcp7、21、23 deng duan guo 。
　　 si 、 jian ce SYN gong ji
　　 jian ce SYN gong ji fei chang de fang bian ， dang ni zai fu wu qi shang kan dao da liang de ban lian jie zhuang tai shi ， te bie shi yuan IP di zhi shi sui ji de ， ji ben shang ke yi duan ding zhe shi yi ci SYN gong ji 。 wo men shi yong xi tong zi dai de netstat gong ju lai jian ce SYN gong ji ：
　　# netstat -n -p TCP tcp　0　 0 10.11.11.11:2.8:25882　 SYN_RECV　- tcp　0
　　0 10.11.11.11:.204:2577　 SYN_RECV　- tcp　0　 0
　　10.11.11.11:.129:51748　 SYN_RECV　- tcp　0　 0
　　10.11.11.11:.25:47393　 SYN_RECV　- tcp　0　 0
　　10.11.11.11:4.182:60427 SYN_RECV　- tcp　0　 0
　　10.11.11.11:.38:278 SYN_RECV　- tcp　0　 0
　　10.11.11.11:.96:5122SYN_RECV　- tcp　0　 0
　　10.11.11.11:9.207:49162 SYN_RECV　- ...
　　 shang mian shi zai LINUX xi tong zhong kan dao de ， hen duo lian jie chu yu SYN_RECV zhuang tai ( zai WINDOWS xi tong zhong shi SYN_RECEIVED zhuang tai )， yuan IP di zhi dou shi sui ji de ， biao ming zhe shi yi zhong dai you IP qi pian de SYN gong ji 。
　　 wo men ye ke yi tong guo xia mian de ming ling zhi jie cha kan zai LINUX huan jing xia mou ge duan guo de wei lian jie dui lie de tiao mu shu ：
　　#netstat -n -p TCP 　 grep SYN_RECV 　 grep :22 　 wc -l 324
　　 xian shi TCP duan guo 22 de wei lian jie shu you 324 ge ， sui ran huan yuan da bu dao xi tong ji xian ， dan ying gai yin qi guan li yuan de zhu yi 。
　　 wu 、SYN gong ji fang fan ji shu
　　 guan yu SYN gong ji fang fan ji shu ， ren men yan jiu de bi jiao zao 。 gui na qi lai ， zhu yao you liang da lei ， yi lei shi tong guo fang huo qiang 、 lu you qi deng guo lv wang guan fang hu ， ling yi lei shi tong guo jia gu TCP/IP xie yi zhan fang fan . dan bi xu qing chu de shi ，SYN gong ji bu neng wan quan bei zu zhi ， wo men suo zuo de shi jin ke neng de jian qing SYN gong ji de wei hai ， chu fei jiang TCP xie yi chong xin she ji 。
　　1、 guo lv wang guan fang hu
　　 zhe li ， guo lv wang guan zhu yao zhi ming fang huo qiang ， dang ran lu you qi ye neng cheng wei guo lv wang guan 。 fang huo qiang bu shu zai bu tong wang luo zhi jian ， fang fan wai lai fei fa gong ji he fang zhi bao mi xin xi wai xie ， ta chu yu ke hu duan he fu wu qi zhi jian ， li yong ta lai fang hu SYN gong ji neng qi dao hen hao de xiao guo 。 guo lv wang guan fang hu zhu yao bao kuo chao shi she zhi ，SYN wang guan he SYN dai li san zhong 。
　　· wang guan chao shi she zhi ：
　　 fang huo qiang she zhi SYN zhuan fa chao shi shen shu ( zhuang tai jian ce de fang huo qiang ke zai zhuang tai biao li mian she zhi )， gai shen shu yuan xiao yu fu wu qi de timeout shi jian 。 dang ke hu duan fa song wan SYN bao ， fu wu duan fa song que ren bao hou (SYN+ACK)， fang huo qiang ru guo zai ji shu qi dao qi shi huan wei shou dao ke hu duan de que ren bao (ACK)， ze wang fu wu qi fa song RST bao ， yi shi fu wu qi cong dui lie zhong shan qu gai ban lian jie 。 zhi de zhu yi de shi ， wang guan chao shi shen shu she zhi bu yi guo xiao ye bu yi guo da ， chao shi shen shu she zhi guo xiao hui ying xiang zheng chang de tong xun ， she zhi tai da ， you hui ying xiang fang fan SYN gong ji de xiao guo ， bi xu gen ju suo chu de wang luo ying yong huan jing lai she zhi ci shen shu 。
　　·SYN wang guan ：
　　SYN wang guan shou dao ke hu duan de SYN bao shi ， zhi jie zhSYN wang guan shou dao fu wu qi de SYN/ACK bao hou ， jiang gai bao zhuan fa gei ke hu duan ， tong shi yi ke hu duan de ming yi gei fu wu qi fa ACK que ren bao 。 ci shi fu wu qi you ban lian jie zhuang tai jin ru lian jie zhuang tai 。 dang ke hu duan que ren bao dao da shi ， ru guo you shu ju ze zhuan fa ， fou ze diu qi 。 shi shi shang ， fu wu qi chu le wei chi ban lian jie dui lie wai ， huan yao you yi ge lian jie dui lie ， ru guo fa sheng SYN gong ji shi ， jiang shi lian jie dui lie shu mu zeng jia ， dan yi ban fu wu qi suo neng cheng shou de lian jie shu liang bi ban lian jie shu liang da de duo ， suo yi zhe zhong fang fa neng you xiao di jian qing dui fu wu qi de gong ji 。
　　·SYN dai li ：
　　 dang ke hu duan SYN bao dao da guo lv wang guan shi ，SYN dai li bing bu zhuan fa SYN bao ， er shi yi fu wu qi de ming yi zhu dong hui fu SYN/ACK bao gei ke hu ， ru guo shou dao ke hu de ACK bao ， biao ming zhe shi zheng chang de fang wen ， ci shi fang huo qiang xiang fu wu qi fa song ACK bao bing wan cheng san ci wo shou 。SYN dai li shi shi shang dai ti le fu wu qi qu chu li SYN gong ji ， ci shi yao qiu guo lv wang guan zi shen ju you hen qiang de fang fan SYN gong ji neng li 。
　　2、 jia gu tcp/ip xie yi zhan
　　 fang fan SYN gong ji de ling yi xiang zhu yao ji shu shi tiao zheng tcp/ip xie yi zhan ， xiu gai tcp xie yi shi xian 。 zhu yao fang fa you SynAttackProtect bao hu ji zhi 、SYN cookies ji shu 、 zeng jia zui da ban lian jie he suo duan chao shi shi jian deng 。tcp/ip xie yi zhan de tiao zheng ke neng hui yin qi mou xie gong neng de shou xian ， guan li yuan ying gai zai jin xing chong fen le jie he ce shi de qian ti xia jin xing ci xiang gong zuo 。
　　·SynAttackProtect ji zhi
　　 wei fang fan SYN gong ji ，Windows2000 xi tong de tcp/ip xie yi zhan nei qian le SynAttackProtect ji zhi ，Win2003 xi tong ye cai yong ci ji zhi 。SynAttackProtect ji zhi shi tong guo guan bi mou xie socket xuan xiang ， zeng jia e wai de lian jie zhi shi he jian shao chao shi shi jian ， shi xi tong neng chu li geng duo de SYN lian jie ， yi da dao fang fan SYN gong ji de mu de 。 mo ren qing kuang xia ，Windows2000 cao zuo xi tong bing bu zhi chi SynAttackProtect bao hu ji zhi ， xu yao zai zhu ce biao yi xia wei zhi zeng jia SynAttackProtect jian zhi ：
　　HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
　　 dang SynAttackProtect zhi ( ru wu te bie shuo ming ， ben wen ti dao de zhu ce biao jian zhi dou wei shi liu jin zhi ) wei 0 huo bu she zhi shi ， xi tong bu shou SynAttackProtect bao hu 。
　　 dang SynAttackProtect zhi wei 1 shi ， xi tong tong guo jian shao chong chuan ci shu he yan chi wei lian jie shi lu you huan chong xiang (route cache entry) fang fan SYN gong ji 。
　　 dang SynAttackProtect zhi wei 2 shi (Microsoft tui jian shi yong ci zhi )， xi tong bu jin shi yong backlog dui lie ， huan shi yong fu jia de ban lian jie zhi shi ， yi ci lai chu li geng duo de SYN lian jie ， shi yong ci jian zhi shi ，tcp/ip de TCPInitialRTT、window size he ke hua dong chuang guo jiang bei jin zhi 。
　　 wo men ying gai zhi dao ， ping shi ， xi tong shi bu qi yong SynAttackProtect ji zhi de ， jin zai jian ce dao SYN gong ji shi ， cai qi yong ， bing tiao zheng tcp/ip xie yi zhan 。 na me xi tong shi ru he jian ce SYN gong ji fa sheng de ne ? shi shi shang ， xi tong gen ju TcpMaxHalfOpen,TcpMaxHalfOpenRetried he TcpMaxPortsExhausted san ge shen shu pan duan shi fou zao shou SYN gong ji 。
　　TcpMaxHalfOpen biao shi neng tong shi chu li de zui da ban lian jie shu ， ru guo chao guo ci zhi ， xi tong ren wei zheng chu yu SYN gong ji zhong 。Windows2000　server mo ren zhi wei 100，Windows2000 Advanced server wei 500。
　　TcpMaxHalfOpenRetried ding yi le bao cun zai backlog dui lie qie chong chuan guo de ban lian jie shu ， ru guo chao guo ci zhi ， xi tong zi dong qi dong SynAttackProtect ji zhi 。Windows2000 server mo ren zhi wei 80，Windows2000 Advanced server wei 400。
　　TcpMaxPortsExhausted　 shi zhi xi tong ju jue de SYN qing qiu bao de shu liang ， mo ren shi 5。
　　 ru guo xiang tiao zheng yi shang shen shu de mo ren zhi ， ke yi zai zhu ce biao li xiu gai ( wei zhi yu SynAttackProtect xiang tong )
　　· SYN cookies ji shu
　　 wo men zhi dao ，TCP xie yi kai pi le yi ge bi jiao da de nei cun kong jian backlog dui lie lai cun chu ban lian jie tiao mu ， dang SYN qing qiu bu duan zeng jia ， bing zhe ge kong jian ， zhi shi xi tong diu qi SYN lian jie 。 wei shi ban lian jie dui lie bei sai man de qing kuang xia ， fu wu qi reng neng chu li xin dao de SYN qing qiu ，SYN cookies ji shu bei she ji chu lai 。
　　SYN cookies ying yong yu linux、FreeBSD deng cao zuo xi tong ， dang ban lian jie dui lie man shi ，SYNcookies bing bu diu qi SYN qing qiu ， er shi tong guo jia mi ji shu lai biao shi ban lian jie zhuang tai 。
　　 zai TCP shi xian zhong ， dang shou dao ke hu duan de SYN qing qiu shi ， fu wu qi xu yao hui fu SYN+ACK bao gei ke hu duan ， ke hu duan ye yao fa song que ren bao gei fu wu qi 。 tong chang ， fu wu qi de chu shi xu lie hao you fu wu qi an zhao yi ding de gui lv ji suan de dao huo cai yong sui ji shu ， dan zai SYN cookies zhong ， fu wu qi de chu shi xu lie hao shi tong guo dui ke hu duan IP di zhi 、 ke hu duan duan guo 、 fu wu qi IP di zhi he fu wu qi duan guo yi ji qi ta yi xie an quan shu zhi deng yao su jin xing hash yun suan ， jia mi de dao de ， cheng zhi wei cookie。 dang fu wu qi zao shou SYN gong ji shi de backlog dui lie man shi ， fu wu qi bing bu ju jue xin de SYN qing qiu ， er shi hui fu cookie( hui fu bao de SYN xu lie hao ) gei ke hu duan ， ru guo shou dao ke hu duan de ACK bao ， fu wu qi jiang ke hu duan de ACK xu lie hao jian qu 1 de dao cookie bi jiao zhi ， bing jiang shang shu yao su jin xing yi ci hash yun suan ， kan kan shi fou deng yu ci cookie。 ru guo xiang deng ， zhi jie wan cheng san ci wo shou ( zhu yi ： ci shi bing bu yong cha kan ci lian jie shi fou shu yu backlog dui lie )。
　　 zai RedHat linux zhong ， qi yong SYN cookies shi tong guo zai qi dong huan jing zhong she zhi yi xia ming ling lai wan cheng ：
　　# echo 1 ?? /proc/sys/net/ipv4/tcp_syncookies
　　· zeng jia zui da ban lian jie shu
　　 da liang de SYN qing qiu dao zhi wei lian jie dui lie bei sai man ， shi zheng chang de TCP lian jie wu fa shun li wan cheng san ci wo shou ， tong guo zeng da wei lian jie dui lie kong jian ke yi huan jie zhe zhong ya li 。 dang ran backlog dui lie xu yao zhan yong da liang de nei cun zi yuan ， bu neng bei wu xian de kuo da 。
　　Windows2000： chu le shang mian jie shao de TcpMaxHalfOpen, TcpMaxHalfOpenRetried shen shu wai ，Windows2000 cao zuo xi tong ke yi tong guo she zhi dong tai backlog(dynamic backlog) lai zeng da xi tong suo neng rong na de zui da ban lian jie shu ， pei zhi dong tai backlog you AFD.SYS qu dong wan cheng ，AFD.SYS shi yi zhong nei gai ji de qu dong ， yong yu zhi chi ji yu window socket de ying yong cheng xu ， bi ru ftp、telnet deng 。AFD.SYS zai zhu ce biao de wei zhi ：
　　HKLM\System\CurrentControlSet\Services\AFD\Parameters\EnableDynamicBacklog zhi wei 1 shi ， biao shi qi yong dong tai backlog， ke yi xiu gai zui da ban lian jie shu 。
　　MinimumDynamicBacklog biao shi ban lian jie dui lie wei dan ge TCP duan guo fen pei de zui xiao kong xian lian jie shu ， dang gai TCP duan guo zai backlog dui lie de kong xian lian jie xiao yu ci lin jie zhi shi ， xi tong wei ci duan guo zi dong qi yong kuo zhan de kong xian lian jie (DynamicBacklogGrowthDelta)，Microsoft tui jian gai zhi wei 20。
　　MaximumDynamicBacklog shi dang qian huo dong de ban lian jie he kong xian lian jie de he ， dang ci he chao guo mou ge lin jie zhi shi ， xi tong ju jue SYN bao ，Microsoft tui jian MaximumDynamicBacklog zhi bu de chao guo 2000。
　　DynamicBacklogGrowthDelta zhi shi zhi kuo zhan de kong xian lian jie shu ， ci lian jie shu bing bu ji suan zai MaximumDynamicBacklog nei ， dang ban lian jie dui lie wei mou ge TCP duan guo fen pei de kong xian lian jie xiao yu MinimumDynamicBacklog shi ， xi tong zi dong fen pei DynamicBacklogGrowthDelta suo ding yi de kong xian lian jie kong jian ， yi shi gai TCP duan guo neng chu li geng duo de ban lian jie 。Microsoft tui jian gai zhi wei 10。
　　LINUX：Linux yong bian liang tcp_max_syn_backlog ding yi backlog dui lie rong na de zui da ban lian jie shu 。 zai Redhat 7.3 zhong ， gai bian liang de zhi mo ren wei 256， zhe ge zhi shi yuan yuan bu gou de ， yi ci qiang du bu da de SYN gong ji jiu neng shi ban lian jie dui lie zhan man 。 wo men ke yi tong guo yi xia ming ling xiu gai ci bian liang de zhi ：
　　# sysctl -w net.ipv4.tcp_max_syn_backlog=`2048`
　　Sun Solaris Sun Solaris yong bian liang tcp_conn_req_max_q0 lai ding yi zui da ban lian jie shu ， zai Sun Solaris 8 zhong ， gai zhi mo ren wei 1024， ke yi tong guo add ming ling gai bian zhe ge zhi ：
　　# ndd -set /dev/tcp tcp_conn_req_max_q0 2048
　　HP-UX：HP-UX yong bian liang tcp_syn_rcvd_max lai ding yi zui da ban lian jie shu ， zai HP-UX　11.00 zhong ， gai zhi mo ren wei 500， ke yi tong guo ndd ming ling gai bian mo ren zhi ：
　　#ndd -set /dev/tcp tcp_syn_rcvd_max 2048
　　· suo duan chao shi shi jian
　　 shang wen ti dao ， tong guo zeng da backlog dui lie neng fang fan SYN ling wai jian shao chao shi shi jian ye shi xi tong neng chu li geng duo de SYN qing qiu 。 wo men zhi dao ，timeout chao shi shi jian ， ye ji ban lian jie cun huo shi jian ， shi xi tong suo you chong chuan ci shu deng dai de chao shi shi jian zong he ， zhe ge zhi yue da ， ban lian jie shu zhan yong backlog dui lie de shi jian jiu yue chang ， xi tong neng chu li de SYN qing qiu jiu yue shao 。 wei suo duan chao shi shi jian ， ke yi tong guo suo duan chong chuan chao shi shi jian ( yi ban shi di yi ci chong chuan chao shi shi jian ) he jian shao chong chuan ci shu lai shi xian 。
　　Windows2000 di yi ci chong chuan zhi qian deng dai shi jian mo ren wei 3 miao ， wei gai bian ci mo ren zhi ， ke yi tong guo xiu gai wang luo jie guo zai zhu ce biao li de TcpInitialRtt zhu ce zhi lai wan cheng 。 chong chuan ci shu you TcpMaxConnectResponseRetransmissions lai ding yi ， zhu ce biao de wei zhi shi ：
　　HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters registry key
　　 dang ran wo men ye ke yi ba chong chuan ci shu she zhi wei 0 ci ， zhe yang fu wu qi ru guo zai 3 miao nei huan wei shou dao ack que ren bao jiu zi dong cong backlog dui lie zhong shan chu gai lian jie tiao mu 。
　　LINUX：Redhat shi yong bian liang tcp_synack_retries ding yi chong chuan ci shu ， qi mo ren zhi shi 5 ci ， zong chao shi shi jian xu yao 3 fen zhong 。
　　Sun Solaris Solaris　 mo ren de chong chuan ci shu shi 3 ci ， zong chao shi shi jian wei 3 fen zhong ， ke yi tong guo ndd ming ling xiu gai zhe xie mo ren zhi 。&　　免责声明：本文仅代表作者个人观点，与王朝网络无关。王朝网络登载此文出于传递更多信息之目的，并不意味着赞同其观点或证实其描述，其原创性以及文中陈述文字和内容未经本站证实，对本文以及其中全部或者部分内容、文字的真实性、完整性、及时性本站不作任何保证或承诺，请读者仅作参考，并请自行核实相关内容。&王朝美图& 19:01:34&&&&&&&转载本文&UBB代码&HTML代码复制到剪贴板...&更多内容··········&&&&频道精选
&&&网友关注··········&&热点推荐&01&&02&&03&&04&&05&&06&&07&&08&&09&&10&&&&王朝女性&&|&&|&&|&&|&&|&&|&&|&&|&&|&&|&&|&&|&王朝分栏&&|&&|&&|&&|&&|&&|&&|&&|&&|&&|&王朝编程&&|&&|&&|&&|&&|&&|&&|&&|&&|&&|&王朝导购&&|&&|&&|&&|&&|&&|&&|&&|&&|&&|&王朝其他&&|&&|&&|&&|&&|&&|&&&&2005-&&版权所有&}