[转]WireShark的抓包-TCP三次握手

原文拜读

https://www.freebuf.com/column/155600.html

https://blog.youkuaiyun.com/zeze_z/article/details/57919479

1. 三次握手

1.0 追踪流

为了快速看到TCP握手，我们可以找到任一TCP协议项目，右键->追踪流->TCP即可

例如一个比较完整的三次握手如下

具体如下

1.1 第一次握手

查看传输层 Transmission Control Protocol: 标志位为SYN，序列号为0

1. Sequence number: 0 (relative sequence number)
2. Flags: 0x002 (SYN)

Frame 15: 76 bytes on wire (608 bits), 76 bytes captured (608 bits)
Linux cooked capture
Internet Protocol Version 4, Src: 10.92.246.134, Dst: 203.208.41.87
Transmission Control Protocol, Src Port: 40860, Dst Port: 80, Seq: 0, Len: 0
    Source Port: 40860
    Destination Port: 80
    [Stream index: 0]
    [TCP Segment Len: 0]
    Sequence number: 0    (relative sequence number)// ---看这里---
    [Next sequence number: 0    (relative sequence number)]
    Acknowledgment number: 0
    1010 .... = Header Length: 40 bytes (10)
    Flags: 0x002 (SYN)// ---看这里---
    Window size value: 65535
    [Calculated window size: 65535]
    Checksum: 0xf363 [unverified]
    [Checksum Status: Unverified]
    Urgent pointer: 0
    Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale
    [Timestamps]

1.2 第二次握手

查看传输层 Transmission Control Protocol:标志位为 SYN,ACK. 将确认序号(Acknowledgement Number)设置为客户的I S N加1以.即0+1=1

1. Sequence number: 0 (relative sequence number)
2. Flags: 0x012 (SYN, ACK)
3. Acknowledgment number: 1 (relative ack number)

Frame 24: 76 bytes on wire (608 bits), 76 bytes captured (608 bits)
Linux cooked capture
Internet Protocol Version 4, Src: 203.208.41.87, Dst: 10.92.246.134
Transmission Control Protocol, Src Port: 80, Dst Port: 40860, Seq: 0, Ack: 1, Len: 0
    Source Port: 80
    Destination Port: 40860
    [Stream index: 0]
    [TCP Segment Len: 0]
    Sequence number: 0    (relative sequence number) // ---看这里---
    [Next sequence number: 0    (relative sequence number)]
    Acknowledgment number: 1    (relative ack number) // ---看这里---
    1010 .... = Header Length: 40 bytes (10)
    Flags: 0x012 (SYN, ACK) // ---看这里---
    Window size value: 65535
    [Calculated window size: 65535]
    Checksum: 0x7460 [unverified]
    [Checksum Status: Unverified]
    Urgent pointer: 0
    Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale
    [SEQ/ACK analysis]
    [Timestamps]

1.3 第三次握手

查看传输层 Transmission Control Protocol:SYN标志位为0,ACK标志位为1.并且把服务器发来ACK的序号字段+1,放在确定字段中发送给对方.并且在数据段放写ISN的+1

1. Sequence number: 1 (relative sequence number)
2. Acknowledgment number: 1 (relative ack number)
3. Flags: 0x010 (ACK)/

Frame 25: 68 bytes on wire (544 bits), 68 bytes captured (544 bits)
Linux cooked capture
Internet Protocol Version 4, Src: 10.92.246.134, Dst: 203.208.41.87
Transmission Control Protocol, Src Port: 40860, Dst Port: 80, Seq: 1, Ack: 1, Len: 0
    Source Port: 40860
    Destination Port: 80
    [Stream index: 0]
    [TCP Segment Len: 0]
    Sequence number: 1    (relative sequence number)// ---看这里---
    [Next sequence number: 1    (relative sequence number)]
    Acknowledgment number: 1    (relative ack number)// ---看这里---
    1000 .... = Header Length: 32 bytes (8)
    Flags: 0x010 (ACK)// ---看这里---
    Window size value: 343
    [Calculated window size: 87808]
    [Window size scaling factor: 256]
    Checksum: 0xa131 [unverified]
    [Checksum Status: Unverified]
    Urgent pointer: 0
    Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
    [SEQ/ACK analysis]
    [Timestamps]

2. TCP 三次握手流程图