Actual combat: tcpdump grabs the bag and analyzes three handshakes and four waves.
This document introduces the process of three-way handshake and four waves of tcpdump bag grabbing analysis in the form of actual combat. Execute the tcpdump command tcpdump-n-I ens32 host 192.168.10.10 and 42.186.113.26 > > / tmp/tcpdump.txtping game.campus.163.com
Curl http://game.campus.163.com
After curl http://game.campus.163.com ends, stop ping game.campus.163.com and view / tmp/tcpdump.txt analyze the results of package capture.
42.186.113.26.http: Flags [S], seq 4039900133, win 29200, options [mss 1460 Japanese sackOKLING TS val 304628816 ecr 0recoverable WScale 7], length 020 Vista 23VORO 4.421269 IP 42.186.113.26.http > 192.168.10.53250: Flags [S.], seq 874076341, ack 4039900134, win 64240, options [mss 1460] Length 020 ack 23 IP 04.421355 IP 192.168.10.53250 > control bits in the message format of Flags: Flags, ack 1, win 29200, length 0TCP are composed of six flag bits. One of them is that an ACK,ACK of 1 means that the confirmation number is valid, and a value of 0 means that the message does not contain confirmation information, and the confirmation number field is ignored. Wave 20 seq 23 IP 05.560319 IP 42.186.113.26.http > 192.168.10.53250 > 42.186.113.26.http: Flags [F.], seq 84, ack 364592, win 64240, length 020 IP 05.560487 IP 42.186.113.26.http > 192.168.10.5.53250: Flags [.], ack 85, win 64239, length 020 2323 RV 05.586700 IP 42.186.113.26.http > 192.168.10.53250: Flags [FP.], seq 364592, ack 85, win 64239 Length 020 42.186.113.26.http 23 42.186.113.26.http 05.586735 IP 192.168.10.10.53250 > Flags [.], ack 364593, win 64240, length Summary
So far, this document shows in detail the actual operation of tcpdump grasping bags and analyzes the process of three handshakes and four waves. I hope it can help you.
Original address of this article: https://www.linuxprobe.com/three-handshakes-four-waves.html Editor: Chess Chess, Auditor: Yi Zengbao
