TCP_DEFER_ACCEPT

            该选项的意思是：当接收到第一个数据之后，才会创建连接，这是为防止空连接的攻击，直接看代码吧。

[mapan@localhost sockOption]$ lsclient.cpp  makefile  server.cpp[mapan@localhost sockOption]$ cat server.cpp #include <unistd.h>#include <sys/types.h>#include <sys/socket.h>#include <netdb.h>#include <stdio.h>#include <stdlib.h>#include <string.h>#include <ctype.h>#include <errno.h>#include <malloc.h>#include <netinet/in.h>#include <arpa/inet.h>#include <sys/ioctl.h>#include <stdarg.h>#include <fcntl.h>#include <sys/types.h>#include <sys/wait.h>#include <netinet/in.h>#include <arpa/inet.h>#include <signal.h>#include <netinet/tcp.h> #define MAXLINE 4096int main(){   int listenfd,acceptfd;   int val=10;   struct sockaddr_in servaddr;   listenfd=socket(AF_INET,SOCK_STREAM,0);    int ret= setsockopt(listenfd,SOL_TCP,TCP_DEFER_ACCEPT,&val,sizeof(val));   printf("ret=%d\n",ret);   memset(&servaddr,0,sizeof(servaddr));   servaddr.sin_family=AF_INET;   servaddr.sin_port=htons(6666);   servaddr.sin_addr.s_addr=htonl(INADDR_ANY);   bind(listenfd,(struct sockaddr *)&servaddr,sizeof(servaddr));   listen(listenfd,10);   acceptfd=accept(listenfd,(struct sockaddr *)NULL,NULL);          getchar();   close(acceptfd);   close(listenfd);    return 0;}[mapan@localhost sockOption]$ cat client.cpp #include <unistd.h>#include <sys/types.h>#include <sys/socket.h>#include <netdb.h>#include <stdio.h>#include <stdlib.h>#include <string.h>#include <ctype.h>#include <errno.h>#include <malloc.h>#include <netinet/in.h>#include <arpa/inet.h>#include <sys/ioctl.h>#include <stdarg.h>#include <fcntl.h>#include <sys/types.h>#include <sys/wait.h>#include <netinet/in.h>#include <arpa/inet.h>#include <signal.h>#define MAXLINE 4096int main(int argc,char **argv){   int connfd,ret;   char sendbuf[400000]={0};   struct sockaddr_in servaddr;   if(argc != 2)   {      printf("error\n");   }   connfd=socket(AF_INET,SOCK_STREAM,0);   memset(&servaddr,0,sizeof(servaddr));   servaddr.sin_family=AF_INET;   servaddr.sin_port=htons(6666);   inet_pton(AF_INET,argv[1],&servaddr.sin_addr);   connect(connfd,(struct sockaddr *)&servaddr,sizeof(servaddr));   getchar();     write(connfd,sendbuf,sizeof(sendbuf));    getchar();    close(connfd);   return 0;}[mapan@localhost sockOption]$ cat makefile all:server clientserver.o:server.cppg++ -c server.cppclient.o:client.cppg++ -c client.cppserver:server.og++ -o server server.oclient:client.og++ -o client client.oclean:rm -f server client *.o[mapan@localhost sockOption]$ 

编译并运行：

[mapan@localhost sockOption]$ makeg++ -c server.cppg++ -o server server.og++ -c client.cppg++ -o client client.o[mapan@localhost sockOption]$ ./server ret=0

[mapan@localhost sockOption]$ ./client 127.0.0.1

看看此时的网络状态：

[mapan@localhost net_04S]$ netstat -na | grep 6666tcp        0      0 0.0.0.0:6666                0.0.0.0:*                   LISTEN      tcp        0      0 127.0.0.1:6666              127.0.0.1:59226             SYN_RECV    tcp        0      0 127.0.0.1:59226             127.0.0.1:6666              ESTABLISHED [mapan@localhost net_04S]$ 

服务端并没有建立连接，其实服务端没有调用accept。服务端忽略了客户端最后发送过来了一个ACK，仅仅把这个socket标记位acked，然后丢弃它。然后就是服务端启动超时重传机制，重传SYN/ACK，达到一定次数之后，然后开始计时到val秒。我这边linux内核是2.6.32的，超时时间过之后，客户端还没有数据发送过来，服务端就会变成ESTABLISHED状态，2.6.18内核会删除SYN_RECV这个状态的连接。

如果重传SYN/ACK时，客户端及时响应ACK但是没有数据到来，那么服务端会定时重传SYN/ACK，保持连接状态SYN/ACK不变。

参考地址：http://blog.sina.com.cn/s/blog_3fde82520101fmxw.html