Instance description TCP connection establishment and Termination

[Introduction]
TCP connection is a reliable connection. It establishes reliable connections for reliable data transmission and is widely used in applications. Since the FTP command uses a TCP connection, the following describes how to use the Sniffer tool to Capture FTP command packets and analyze the detailed process of TCP connection establishment and termination, this gives you a better understanding of the three-way handshake established by a TCP connection and the four-way handshake.

1. FTP command packet capture

1. Build a network environment. Create an FTP server and set the IP address to 76.88.16.16. Create an FTP client, set the IP address to 76.88.16.104, and install the Sniffer software on it. Connect the two devices through the hub.

2. Define a filter. Run the Sniffer software on the FTP client, go to the system, click "Monitor"-"Matrixa", select the local machine, click the right button, and select "Define Filter ...", In "Define Filter ..." Window, click "Advanced", select IP-> TCP-> FTP, and click "OK" to define the filter, as shown in 1.

Figure 1

3. Capture FTP command data packets. First, select "Monitor"-"Matrix" in Sniffer and click "Capture" to start packet Capture. Then, enter the DOS prompt on the FTP client, enter the "FTP 76.88.16.16" command, enter the FTP user name and password, log on to the FTP server, and download the file, finally, enter the "bye" command to exit the FTP program and complete the FTP command operation process. Finally, click "Stop capture" in Sniffer and select "Decode" to complete packet capture during FTP command operation and display it on the screen.

Ii. Explanation of TCP connection establishment process

Figure 2

Figure 2 establishes a TCP connection between the FTP client and the FTP server captured by Sniffer. We can see that Sniffer first captured three rows of records: 1, 2, and 3. Where:

Line 1st indicates that the FTP client 76.88.16.104 initiates a connection request with the SYN flag from Port 1038 to port 21 of the FTP server 76.88.16.16, with the initial serial number SEQ = 1791872318.

Line 2nd indicates that the FTP server 76.88.16.16 returns a response packet with both the SYN and ACK signs from port 21 to port 1038 of the FTP client 76.88.16.104. The ACK response serial number SEQ = 1791872318 + 1, SYN request serial number SEQ = 3880988084.

Line 3rd indicates that the FTP client 76.88.16.104 returns a response packet containing the ACK mark to the FTP server 76.88.16.16, and the response serial number SEQ = 3880988084 + 1.

So far, a secure and reliable TCP connection is established between the FTP client and the FTP server. The three-way handshake process established by the TCP connection is shown in 3.

Figure 3

Iii. TCP connection termination process

Figure 4

Figure 4 shows the process of ending a TCP connection between an FTP client captured by Sniffer and an FTP server. We can see that at the end of the TCP connection, a total of 17, 18, 19, and 20 rows of records were captured by Sniffer. Where:

Line 17th indicates that the FTP server 76.88.16.16 first sends a connection request with the FIN end flag to port 1028 of the FTP client 76.88.16.104 from port 21, with the initial serial number SEQ = 1803774978.

Line 18th indicates that the FTP client 76.88.16.104 returns a response packet containing the ACK mark from Port 1028 to port 21 of the FTP server 76.88.16.16, and the response serial number SEQ = 1803774978 + 1.

Line 2: At the same time, the FTP client 76.88.16.104 sends a packet with both the FIN flag and the ACK flag from Port 19th to port 21 of the FTP server 76.88.16.16. The FIN serial number SEQ = 1028, ack seq = 1803774978 + 1.

Line 20th indicates that the FTP server 76.88.16.16 returns a response packet containing the ACK flag to port 1028 of the FTP client 76.88.16.104 from port 21, and the response serial number SEQ = 846902939 + 1.

So far, a TCP connection between the FTP client and the FTP server has ended. The process of TCP connection termination is shown in step 5.

Figure 5

Iv. Summary

Sniffer is a powerful underlying packet capture tool. As a network manager, you should learn to use this tool to analyze network data and process abnormal data in a timely manner, continuously improve the network data analysis and processing capabilities.