TCP三次握手抓包理解

  TCP建立連接需要三次握手,分手需要四次握手,平時在網上看到很多次,但是還沒有很理解。爲什麼分手要多一次?可能是剛開始追求女生的時候比較容易,到分手的時候就比較麻煩了吧。。。

       瞭解某個東西要從它的基礎開始,我們先看看TCP的報文是怎麼回事。

       先看下tcp的報文結構,以下內容摘自官方文檔,我簡單的解釋下,由於本人的英語水平主要是靠有道詞典,如果解釋錯了,麻煩指出。。。

     

 

  

Source Port. 16 bits.

源端口,佔16位

Destination Port. 16 bits.

目的端口,佔16位

Sequence Number. 32 bits.

序列號,佔32位
The sequence number of the first data byte in this segment. If the SYN bit is set, the sequence number is the initial sequence number and the first data byte is initial sequence number + 1.

序列號:隨機生成一個序列號,如果SYN即同步序號狀態設爲1,此爲當前連接的初始序列號,數據的第一個字節序號爲此序列號+1。

Acknowledgment Number. 32 bits.
If the ACK bit is set, this field contains the value of the next sequence number the sender of the segment is expecting to receive. Once a connection is established this is always sent.

確認號:確認序列號,如果ACK即確認序列號狀態爲1,則確認序列號=序列號+1,一旦連接建立,每次都會發送。

Data Offset. 4 bits.
The number of 32-bit words in the TCP header. This indicates where the data begins. The length of the TCP header is always a multiple of 32 bits.

實際數據偏移量,指出數據的開始位置。

reserved. 3 bits.
Must be cleared to zero.

3個位的保留位

ECN, Explicit Congestion Notification. 3 bits.  
Added in RFC 3168.

000102
N C E

N, NS, Nonce Sum. 1 bit.
Added in RFC 3540. This is an optional field added to ECN intended to protect against accidental or malicious concealment of marked packets from the TCP sender.

C, CWR. 1 bit.

E, ECE, ECN-Echo. 1 bit.

Control Bits. 6 bits.

000102030405
U A P R S F

U, URG. 1 bit.
Urgent pointer valid flag.

緊急標誌位

A, ACK. 1 bit.
Acknowledgment number valid flag.

確認標誌位

P, PSH. 1 bit.
Push flag.

推送標誌位

R, RST. 1 bit.
Reset connection flag.

重置連接標誌位

S, SYN. 1 bit.
Synchronize sequence numbers flag.

同步序列號標誌位

F, FIN. 1 bit.
End of data flag.

結束標誌位

Window. 16 bits, unsigned.
The number of data bytes beginning with the one indicated in the acknowledgment field which the sender of this segment is willing to accept.

滑動窗口,進行流量控制

Checksum. 16 bits.
This is computed as the 16-bit one's complement of the one's complement sum of a pseudo header of information from the IP header, the TCP header, and the data, padded as needed with zero bytes at the end to make a multiple of two bytes. The pseudo header contains the following fields:

 

校驗和(沒有細研究)

Urgent Pointer. 16 bits, unsigned.
If the URG bit is set, this field points to the sequence number of the last byte in a sequence of urgent data.

緊急指針(沒有細研究)

Options. 0 to 40 bytes.
Options occupy space at the end of the TCP header. All options are included in the checksum. An option may begin on any byte boundary. The TCP header must be padded with zeros to make the header length a multiple of 32 bits.

可選項(沒有細研究)
 Data. Variable length.

 

 下面我們來了解下傳說中的三次握手和四次分:

 

 

 

我們再用wireshark抓包驗證下,這裏是連Mysql前的三次握手

 

1:客戶端發起連接,設置SYN標誌位爲1,隨機生成一個seq序列號x:

像Wireshark這種工具,通常顯示的都是相對序列號/確認號,而不是實際序列號/確認號

如果想要關閉相對序列號/確認號,可以選擇Wireshark菜單欄中的 Edit -> Preferences ->protocols->TCP,去掉Relative sequence number後面勾選框中的√即可

參考:https://blog.csdn.net/a19881029/article/details/38091243

 

 2:服務器端收到信息後,設置SYN標誌位爲1,設置ACK標誌位爲1,隨機生成一個seq序列號y,並生成確認號ack=seq(x)+1

 

 

 3:客戶端返回信息,設置ACK標誌位爲1,生成確認號ack=seq(y)+1

 確認號都是在對方的序列號seq的基礎上+1

 至此,三次握手完成了啦。

發表評論
所有評論
還沒有人評論,想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.
相關文章