TCP connection: syn ack rst utg PSH fin

8 floor, http://bbs.csdn.net/topics/370058169

TCP connection: syn ack rst utg PSH fin

Three-way handshake: the sender sends a packet with the SYN = 1, ACK = 0 sign to the receiver for connection. This is the first handshake. If the receiver receives the request and allows the connection, A packet with SYN = 1, ACK = 1 is sent to the sender, telling the sender that it can communicate and asking the sender to send a confirmation packet. This is the second handshake. Finally, the sender sends a packet with SYN = 0 and ACK = 1 to the receiver, telling the receiver that the connection has been confirmed. This is the third handshake. Then, a TCP connection is established to Start Communication.

* SYN: synchronization flag
The synchronize sequence numbers column is valid. This flag is valid only when three handshakes are used to establish a TCP connection. It indicates the serial number of the server check sequence of the TCP connection. The serial number is the serial number of the initial client of the TCP connection. Here, we can regard the TCP sequence number as a 32-bit counter ranging from 0 to 4,294,967,295. Each byte in the data exchange over TCP connections is serial number. The serial number column in the TCP header contains the serial number of the first byte in the TCP segment.


* Ack: confirm the flag
The acknowledgement number column is valid. In most cases, this flag is set. The validation number (W + 1, figure-1) contained in the validation number column in the TCP header is the next expected sequence number, prompting that the remote system has successfully received all data.

* Rst: reset flag
The reset flag is valid. Used to reset the corresponding TCP connection.

* URG: emergency sign
The URGent pointer sign is valid. Emergency flag placement,

* PSH: Push flag
When this flag is set, the receiving end does not process the data in the queue, but forwards the data to the application as soon as possible. This flag is always set to a bit when you connect to telnet, rlogin, or other interactive modes.

* Fin: End flag
The packet with this flag is used to end a TCP session, but the corresponding port is still open, ready to receive subsequent data.

Several States of. TCP play a role in our analysis. On the TCP layer, there is a flags field, which has the following identifiers: SYN, FIN, ack, Psh, RST, and URG. the preceding five fields are useful for our daily analysis. They mean: SYN indicates a connection, Fin indicates a closed connection, Ack indicates a response, PSH indicates data transmission, and RST indicates a Connection reset. Among them, Ack may be used together with SYN, FIN, etc. For example, SYN and ACK may both be 1, which indicates the response after the connection is established. If it is only a single SYN, it only indicates establishing a connection. The several handshakes of TCP are represented by such ack. However, SYN and fin are not 1 at the same time, because the former indicates a connection, while the latter indicates a disconnection. RST is usually 1 after Fin, indicating that the connection is reset. Generally, when a fin or RST packet occurs, we think that the client is disconnected from the server. When a SYN and SYN + ACK packet appears, we think the client has established a connection with the server. When PSH is 1, it usually only appears in packets whose data content is not 0. That is to say, PSH is 1, indicating that the real TCP packet content is transmitted. Both TCP connection establishment and connection closure are completed in request-response mode.

TCP connection: syn ack rst utg PSH fin