原文拜读
https://www.freebuf.com/column/155600.html
https://blog.csdn.net/zeze_z/article/details/57919479
1. 三次握手
1.0 追踪流
为了快速看到TCP握手,我们可以找到任一TCP协议项目,右键->追踪流->TCP即可
例如一个比较完整的三次握手如下
具体如下
1.1 第一次握手
查看传输层 Transmission Control Protocol: 标志位为SYN,序列号为0
- Sequence number: 0 (relative sequence number)
- Flags: 0x002 (SYN)
Frame 15: 76 bytes on wire (608 bits), 76 bytes captured (608 bits)
Linux cooked capture
Internet Protocol Version 4, Src: 10.92.246.134, Dst: 203.208.41.87
Transmission Control Protocol, Src Port: 40860, Dst Port: 80, Seq: 0, Len: 0
Source Port: 40860
Destination Port: 80
[Stream index: 0]
[TCP Segment Len: 0]
Sequence number: 0 (relative sequence number)// ---看这里---
[Next sequence number: 0 (relative sequence number)]
Acknowledgment number: 0
1010 .... = Header Length: 40 bytes (10)
Flags: 0x002 (SYN)// ---看这里---
Window size value: 65535
[Calculated window size: 65535]
Checksum: 0xf363 [unverified]
[Checksum Status: Unverified]
Urgent pointer: 0
Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale
[Timestamps]
1.2 第二次握手
查看传输层 Transmission Control Protocol:标志位为 SYN,ACK. 将确认序号(Acknowledgement Number)设置为客户的I S N加1以.即0+1=1
- Sequence number: 0 (relative sequence number)
- Flags: 0x012 (SYN, ACK)
- Acknowledgment number: 1 (relative ack number)
Frame 24: 76 bytes on wire (608 bits), 76 bytes captured (608 bits)
Linux cooked capture
Internet Protocol Version 4, Src: 203.208.41.87, Dst: 10.92.246.134
Transmission Control Protocol, Src Port: 80, Dst Port: 40860, Seq: 0, Ack: 1, Len: 0
Source Port: 80
Destination Port: 40860
[Stream index: 0]
[TCP Segment Len: 0]
Sequence number: 0 (relative sequence number) // ---看这里---
[Next sequence number: 0 (relative sequence number)]
Acknowledgment number: 1 (relative ack number) // ---看这里---
1010 .... = Header Length: 40 bytes (10)
Flags: 0x012 (SYN, ACK) // ---看这里---
Window size value: 65535
[Calculated window size: 65535]
Checksum: 0x7460 [unverified]
[Checksum Status: Unverified]
Urgent pointer: 0
Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale
[SEQ/ACK analysis]
[Timestamps]
1.3 第三次握手
查看传输层 Transmission Control Protocol:SYN标志位为0,ACK标志位为1.并且把服务器发来ACK的序号字段+1,放在确定字段中发送给对方.并且在数据段放写ISN的+1
- Sequence number: 1 (relative sequence number)
- Acknowledgment number: 1 (relative ack number)
- Flags: 0x010 (ACK)/
Frame 25: 68 bytes on wire (544 bits), 68 bytes captured (544 bits)
Linux cooked capture
Internet Protocol Version 4, Src: 10.92.246.134, Dst: 203.208.41.87
Transmission Control Protocol, Src Port: 40860, Dst Port: 80, Seq: 1, Ack: 1, Len: 0
Source Port: 40860
Destination Port: 80
[Stream index: 0]
[TCP Segment Len: 0]
Sequence number: 1 (relative sequence number)// ---看这里---
[Next sequence number: 1 (relative sequence number)]
Acknowledgment number: 1 (relative ack number)// ---看这里---
1000 .... = Header Length: 32 bytes (8)
Flags: 0x010 (ACK)// ---看这里---
Window size value: 343
[Calculated window size: 87808]
[Window size scaling factor: 256]
Checksum: 0xa131 [unverified]
[Checksum Status: Unverified]
Urgent pointer: 0
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]
[Timestamps]