wireshark tcp协议

时间 2019-11-07

原文原文链接

工具：wireshark

显示过滤器VS捕获过滤器

顾名思义，显示过滤器是针对结果的显示过滤，捕获过滤器是针对捕获过程当中的过滤。tcp

tcp stream理解

根据 IP_1:Port_1 - IP_2:Port_2的惟一标识，可能dns或者udp或者其协议也用。
可是能够理解到的重点应该是，从一个链接的握手到keep alive 到fin，这个tcp stream index是不变的。好比下面的三次握手和四次挥手 tcp stream 都为10 （用 tcp stream index eq 10便可），这个与右击某个包数据-追踪流，效果一致。工具

设置为绝对序列号

tcp是字节流，每一个字节一个编号。注意此序列号为当前数据包数据第一个字节的序号。序列号32位，因此2的32次方个字节最大（考虑回流问题？），另外实际抓包是各自端的数据数据第一个字节对应的序列号，这样就能够对发送的每个字节数据进行编号了。另外若是有tcp分片，seq格式就是当前seq:下一个seqthis

三次握手

先放出tcp报文

注意wireshark的包内容中带[]的应该为该软件自定义补充内容，其余为tcp报文中对应内容。好比 [Stream index: 10]这个东东就是她本身calucate出来的spa

第一次握手

客户端发送syn，客户端说个人初始序列号是79994848，我要和你好。.net

Transmission Control Protocol, Src Port: 55148, Dst Port: 443, Seq: 79994848, Len: 0
    Source Port: 55148
    Destination Port: 443
    [Stream index: 10]
    [TCP Segment Len: 0]
    Sequence number: 79994848
    [Next sequence number: 79994848]
    Acknowledgment number: 0
    1000 .... = Header Length: 32 bytes (8)
    Flags: 0x002 (SYN)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...0 .... = Acknowledgment: Not set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..1. = Syn: Set
        .... .... ...0 = Fin: Not set
        [TCP Flags: ··········S·]
    Window size value: 64240
    [Calculated window size: 64240]
    Checksum: 0xe207 [unverified]
    [Checksum Status: Unverified]
    Urgent pointer: 0
    Options: (12 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), SACK permitted
    [Timestamps]
        [Time since first frame in this TCP stream: 0.000000000 seconds]
        [Time since previous frame in this TCP stream: 0.000000000 seconds]

第二次握手

服务端发送 syn 和ack：服务端说我也想和你好，个人初始序列号是907180931，下次我但愿你发出的的是 79994849 。注意这个79994849 是确认号，表明接收方指望收到发送方下个报文段的第一个字节数据的字节编号（下同）code

Transmission Control Protocol, Src Port: 443, Dst Port: 55148, Seq: 907180931, Ack: 79994849, Len: 0
    Source Port: 443
    Destination Port: 55148
    [Stream index: 10]
    [TCP Segment Len: 0]
    Sequence number: 907180931
    [Next sequence number: 907180931]
    Acknowledgment number: 79994849
    1000 .... = Header Length: 32 bytes (8)
    Flags: 0x012 (SYN, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgment: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..1. = Syn: Set
        .... .... ...0 = Fin: Not set
        [TCP Flags: ·······A··S·]
    Window size value: 14600
    [Calculated window size: 14600]
    Checksum: 0xf24a [unverified]
    [Checksum Status: Unverified]
    Urgent pointer: 0
    Options: (12 bytes), Maximum segment size, No-Operation (NOP), No-Operation (NOP), SACK permitted, No-Operation (NOP), Window scale
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 440]
        [The RTT to ACK the segment was: 0.003146000 seconds]
        [iRTT: 0.003200000 seconds]
    [Timestamps]
        [Time since first frame in this TCP stream: 0.003146000 seconds]
        [Time since previous frame in this TCP stream: 0.003146000 seconds]

第三次握手

客户端ack说好的，我给你发79994849，咱俩好了，我但愿你给我发的是907180932。blog

Transmission Control Protocol, Src Port: 55148, Dst Port: 443, Seq: 79994849, Ack: 907180932, Len: 0
    Source Port: 55148
    Destination Port: 443
    [Stream index: 10]
    [TCP Segment Len: 0]
    Sequence number: 79994849
    [Next sequence number: 79994849]
    Acknowledgment number: 907180932
    0101 .... = Header Length: 20 bytes (5)
    Flags: 0x010 (ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgment: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
        [TCP Flags: ·······A····]
    Window size value: 256
    [Calculated window size: 65536]
    [Window size scaling factor: 256]
    Checksum: 0x6b25 [unverified]
    [Checksum Status: Unverified]
    Urgent pointer: 0
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 442]
        [The RTT to ACK the segment was: 0.000054000 seconds]
        [iRTT: 0.003200000 seconds]
    [Timestamps]
        [Time since first frame in this TCP stream: 0.003200000 seconds]
        [Time since previous frame in this TCP stream: 0.000054000 seconds]