三次握手建立连接(SYN标志)
客户端发送链接请求,此时处于等待确认状态;服务端收到请求,回应确认请求;最后客户端确认;建立完毕，开始传输数据！
四次握手断开连接(FIN标志)
客户端发送断开请求,此时处于等待确认状态;服务端收到请求,回应确认请求,并再次确认是否断开;客户端最后确认;断开链接！
TCP协议包首部格式
三次握手建立连接---分析
第一次握手(SYN)
Transmission Control Protocol, Src Port: 52777 (52777), Dst Port: http (80), Seq: 0, Len: 0
#TCP,源端口:52777,目标端口:80#
Source Port: 52777 (52777) #源端口#
Destination Port: http (80) #目标端口#
[Stream index: 1] #流节点号#
Sequence number: 0 (relative sequence number) #序列号#
Acknowledgment number: 0 #确认编号#
Header Length: 32 bytes #首部长度#
Flags: 0x002 (SYN) #标志#
- .... .... = Reserved: Not set
...0 .... .... = Nonce: Not set
.... 0... .... = Congestion Window Reduced (CWR): Not set
.... .0.. .... = ECN-Echo: Not set
.... ..0. .... = Urgent: Not set #紧急指针#
.... ...0 .... = Acknowledgment: Not set #确认编号#
.... .... 0... = Push: Not set #紧急位#
.... .... .0.. = Reset: Not set #重置#
.... .... ..1. = Syn: Set #SYN标志位#
[Expert Info (Chat/Sequence): Connection establish request (SYN): server port 80] #专家信息#
[Connection establish request (SYN): server port 80] #消息#
[Severity level: Chat] #安全级别#
[Group: Sequence] #组#
.... .... ...0 = Fin: Not set #FIN标志位#
Window size value: 8192 #窗口大小#
[Calculated window size: 8192] #估计的窗口大小#
Checksum: 0x0a48 [unverified] #校验和#
Urgent pointer: 0 #紧急指针#
Options: (12 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), SACK permitted #选项#
Maximum segment size: 1460 bytes #最大段大小#
No-Operation (NOP) #无操作指令#
No-Operation (NOP) #无操作指令#
No-Operation (NOP) #无操作指令#
TCP SACK Permitted Option: True #TCP SACK允许选项#第二次握手(SYN/ACK)
Transmission Control Protocol, Src Port: http (80), Dst Port: 52777 (52777), Seq: 0, Ack: 1, Len: 0
#TCP,源端口:80,目标端口:52777#
Source Port: http (80) #源端口#
Destination Port: 52777 (52777) #目标端口#
[Stream index: 1] #流节点号#
Sequence number: 0 (relative sequence number) #序列号#
Acknowledgment number: 1 (relative ack number) #确认编号#
Header Length: 32 bytes #首部长度#
Flags: 0x012 (SYN, ACK) #标志#- .... .... = Reserved: Not set
...0 .... .... = Nonce: Not set
.... 0... .... = Congestion Window Reduced (CWR): Not set
.... .0.. .... = ECN-Echo: Not set
.... ..0. .... = Urgent: Not set #紧急指针#
.... ...1 .... = Acknowledgment: Not set #确认编号#
.... .... 0... = Push: Not set #紧急位#
.... .... .0.. = Reset: Not set #重置#
.... .... ..1. = Syn: Set #SYN标志位#
[Expert Info (Chat/Sequence): Connection establish request (SYN): server port 80] #专家信息#
[Connection establish request (SYN): server port 80] #消息#
[Severity level: Chat] #安全级别#
[Group: Sequence] #组#
.... .... ...0 = Fin: Not set #FIN标志位#
Window size value: 8192 #窗口大小#
[Calculated window size: 8192] #估计的窗口大小#
Checksum: 0x0a48 [unverified] #校验和#
Urgent pointer: 0 #紧急指针#
Options: (12 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), SACK permitted #选项#
Maximum segment size: 1460 bytes #最大段大小#
No-Operation (NOP) #无操作指令#
No-Operation (NOP) #无操作指令#
No-Operation (NOP) #无操作指令#
TCP SACK Permitted Option: True #TCP SACK允许选项#
[SEQ/ACK analysis] #序列号 确认编号分析#
[This is an ACK to the segment in frame: 4]
[The RTT to ACK the segment was: 0.170392000 seconds]
[iRTT: 0.170478000 seconds]第三次握手(ACK)
Transmission Control Protocol, Src Port: 52777 (52777), Dst Port: http (80), Seq: 1, Ack: 1, Len: 0
#TCP,源端口:52777,目标端口:80#
Source Port: 52777 (52777) #源端口#
Destination Port: http (80) #目标端口#
[Stream index: 1] #流节点号#
Sequence number: 0 (relative sequence number) #序列号#
Acknowledgment number: 0 #确认编号#
Header Length: 32 bytes #首部长度#
Flags: 0x010 (ACK) #标志#- .... .... = Reserved: Not set
...0 .... .... = Nonce: Not set
.... 0... .... = Congestion Window Reduced (CWR): Not set
.... .0.. .... = ECN-Echo: Not set
.... ..0. .... = Urgent: Not set #紧急指针#
.... ...1 .... = Acknowledgment: Not set #确认编号#
.... .... 0... = Push: Not set #紧急位#
.... .... .0.. = Reset: Not set #重置#
.... .... ..0. = Syn: Set #SYN标志位#
[Expert Info (Chat/Sequence): Connection establish request (SYN): server port 80] #专家信息#
[Connection establish request (SYN): server port 80] #消息#
[Severity level: Chat] #安全级别#
[Group: Sequence] #组#
.... .... ...0 = Fin: Not set #FIN标志位#
Window size value: 8192 #窗口大小#
[Calculated window size: 8192] #估计的窗口大小#
Checksum: 0x0a48 [unverified] #校验和#
Urgent pointer: 0 #紧急指针#
Options: (12 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), SACK permitted #选项#
Maximum segment size: 1460 bytes #最大段大小#
No-Operation (NOP) #无操作指令#
No-Operation (NOP) #无操作指令#
No-Operation (NOP) #无操作指令#
TCP SACK Permitted Option: True #TCP SACK允许选项#
[SEQ/ACK analysis] #序列号 确认编号分析#
[This is an ACK to the segment in frame: 13]
[The RTT to ACK the segment was: 0.000061000 seconds]
[iRTT: 0.168388000 seconds]
四次握手断开连接---分析
基本同上，SYN变成FIN，值为1；
Flags: 0x011 (FIN, ACK)
- .... .... = Reserved: Not set
...0 .... .... = Nonce: Not set
.... 0... .... = Congestion Window Reduced (CWR): Not set
.... .0.. .... = ECN-Echo: Not set
.... ..0. .... = Urgent: Not set
.... ...1 .... = Acknowledgment: Set
.... .... 0... = Push: Not set
.... .... .0.. = Reset: Not set
.... .... ..0. = Syn: Not set
.... .... ...1 = Fin: Set
TCP重置---分析
基本同上，SYN变成RST，值为1；
Flags: 0x014 (RST, ACK)
- .... .... = Reserved: Not set
...0 .... .... = Nonce: Not set
.... 0... .... = Congestion Window Reduced (CWR): Not set
.... .0.. .... = ECN-Echo: Not set
.... ..0. .... = Urgent: Not set
.... ...1 .... = Acknowledgment: Set
.... .... 0... = Push: Not set
.... .... .1.. = Reset: Set