TCP/IP protocol stack overview and packet header analysis

I. Summary

This article analyzes the network communication protocols involved in previous blog posts, outlines the TCP/IP protocol stack model, and finally analyzes the packet headers at each layer based on the instance.

 

Ii. standard TCP/IP protocol stack Model

The standard TCP/IP protocol is a group of protocols used for computer communication. It is usually called the TCP/IP protocol stack. The Internet based on it is currently the largest computer network in the world. Due to the wide application of the Internet, TCP/IP has become a de facto network standard.

1. OSI model and TCP/IP protocol model

Figure 1 compares the OSI model with the TCP/IP protocol model.

Figure 1 OSI model and TCP/IP Model

2. layer-Based TCP/IP protocol model

(1) Network Interface Layer

The TCP/IP protocol model is used to send and receive data frames. Corresponding to the physical layer and data link layer in the OSI model, it is the lowest layer of TCP/IP. However, when describing the TCP/IP model, it is usually divided into the physical layer (PHY) and the data link layer (MAC ).

(2) Network Layer

Encapsulate data packets into Internet data packets through the Interconnection protocol and run necessary routesAlgorithm. There are four interconnection protocols.

(A) Internet Protocol IP Address: Responsible for path addressing and packet routing between the host and the network.

(B) Address Resolution Protocol ARP: Obtain the host hardware address in the same physical network.

(C) Internet Control Message Protocol ICMP: sends messages and reports the transmission errors of related packets.

(D) IGMP: Used to implement local multicast router reports.

(3) Transport Layer

The Transport Protocol provides communication sessions between hosts. The selection of transmission protocols depends on the data transmission mode. There are two transmission protocols:

(A) Transport Control Protocol TCP: For applicationsProgramProvides reliable communication connections for applications that require responses.

(B) user data packet protocol UDP: Provides connectionless communication and does not confirm the reliability of the transmission package.

(4) Application Layer

Applications access the network through this layer, including common FTP, HTTP, DNS, and telnet protocols.

3. Data encapsulation by TCP/IP protocol model

Figure 2 correlation between data packets at different layers

In the layer-4 protocol of the TCP/IP protocol model, packet encapsulation at each layer is shown in 2. When sending data, package the data from the top to the bottom (with the header and part of the tail information). When receiving data, the data is split from the bottom layer to the top layer (the packet header and some tail information are removed ). These packaging and unpacking operations are implemented by the TCP/IP protocol stack. The following is a detailed analysis of the preceding headers Based on the instance.

 

Iii. Analysis of packet headers in TCP/IP protocol stack 1. Get data packets

(A) Take "diy_de2 dm9000a Nic debugging routine series (II) -- dm9000a test, self-sending and receiving, UDP implementation" as an instance

There are two ways to get data packets: capture data packets through Wireshark packet capture tool and obtain data packets sent by PC through the interruption of the niosii end. The obtained data packets are as follows:

Obtained Through Wireshark:

E0 CB 4E B7 9e D1 01 60

6e 11 02 0f 08 00 45 00

05 D8 00 00 00 80 11

B1 97 C0 A8 00 2C C0 A8

02 01 04 00 04 00 05 C4

00 00

The 42 bytes are the header of the routine data sent to the PC end. The 42 bytes are the valid data, and the last 4 bytes are the check bit. The preceding routine statement can clearly analyze the meaning of each data.

Obtain the following information by using the Nias II:

FF E0 CB

4e B7 9e D1 08 00 45 00

00 1E 3C AC 00 00 80 11

3b 7A C0 A8 02 01 FF

FF 04 00 04 00 00 0a

04 31

Same as above.

Because this routine is mainly used to Implement UDP, the TCP packet header is not clear enough. to fully analyze each packet header, the following routine will be used.

(B) Take the "diy_de2 dm9000a Nic debugging routine series (4) -- Implementation of TCP/IP Based on nichestack protocol stack" as an instance

The data packets obtained through Wireshark are as follows:

00 07 ed FF 06 00 00 0f

Ea fd 9f 96 08 00 45 00

00 29 38 13 40 00 40 06

7D 60 C0 A8 02 0a C0 A8

02 01 18 98 00 17 37 8d

49 3B 00 46 74 E0 50 18

Fe D9 EA F7 00 00 32

The following is a detailed analysis.

2. MAC header

The MAC header occupies 14 bytes, namely:

00 07 ed FF 06 00 00 0f ea fd 9f 96 08 00

It is easy to see that 00 07 ed FF 06 00 and 00 0f ea fd 9f 96 are the MAC addresses of diy_de2 and PC respectively, and the following 08 00 is unknown.

3. IP Header

The IP header occupies 20 bytes, namely:

45 00 00 29 38 13 40 00 40 06 7d 60 C0 A8 02 0a C0 A8 02 01

(1) "45", where "4" is the version of the IP protocol, which indicates ip4. "5" is the IHL bit, indicating the length of the IP header. It is a 4-bit field, and the maximum value is 1111. The value is 12, and the maximum length of the IP header is 60 bytes. The value "5" indicates 20 bytes. This is the standard IP header length, and no optional data is sent in the header message.

(2) "00", service type (type of service ). This 8-bit field is composed of 3bit priority subfields (which are ignored now), 4-bit TOS subfields, and 1-bit unused fields (which are currently 0. the 4-bit TOS sub-fields include: Minimum latency, maximum throughput, maximum reliability, and minimum cost. Up to one of the four 1bit bits can be 1, in this example, 0, indicates a General Service.

(3) "00 29", total IP address data packet length, including the header and data, which indicates 41 bytes. These 41 bytes consist of a 20-byte IP header and a 21-byte TCP Header (the last byte is data ). Therefore, the maximum IP packet length is 65535 bytes.

(4) "38 13", two-byte flag, which allows the target host to determine which group the new segment belongs.

(5) For "40", the binary format is "0100 0000". The first one is that the IP protocol is not used currently, and the value is 0. Then there are two signs: DF and MF. If DF is 1, do not perform segmentation. If mf is 1, further segmentation is performed (0 in this example ). Then, "0 0000" is the Fragment offset ).

(6) "00", to be determined.

(7) The Byte "40" is TTL (time to live), which indicates the lifecycle of an IP data stream. You can use the ping results to obtain TTL values.ArticleThe host type is determined by the TTL bit. Generally, the host has a default TTL value. The default value varies with different systems. For example, Windows is 128. However, Ping is generally not the default value, because each time the IP packet passes through a router, the TTL is reduced by one. When the packet is reduced to 0, the packet will die. This is also the principle of tracert. In this example, it is "40", and the conversion to decimal is 64. I use WINXP.

(8) "06", which indicates the protocol type (Protocol) of the transport layer ). Defined in rfc790, 6 indicates that the transport layer is TCP.

(9) The 16bit "7d 60" is the header checksum ).

(10) "C0 A8 02 0a". This is the source address, that is, the IP address of the PC. The IP address converted to decimal is 192.168.2.10.

(11) "C0 A8 02 01". This is the destination address, that is, the address of diy_de2. The IP address converted to decimal format is 192.168.2.1.

4. TCP Header

The TCP Header occupies 20 bytes, namely:

18 98 00 17 37 8d 49 3B 00 46 74 E0 50 18 Fe D9 EA F7 00 00

(1) "18 98" indicates the local port number, which is 3368 in decimal format.

(2) "00 15" indicates the target port number, which is converted to decimal value 23. Because I am connecting to the Telnet site, this is 23.

(3) "37 8d 49 3B" is a sequence number, abbreviated as seq.

(4) "00 46 74 E0" is the acknowledgment number, abbreviated as acknum.

(5) "50 18", converted to binary, "0101 0000 0001 ". These two bytes, a total of 16 bits, have many things. The first 4bit "0101" is the TCP Header length, which is 5 in decimal format, indicating 20 bytes. The next 6 bits are not used in TCP now, and all are 0. The last 6bit "01 1000" is an important symbol of the six. This is a sign of data exchange between two computers. The receiving and sending disconnections determine the types of information flows based on these flags. The following are some introductions:

URG :( Urgent Pointer field significant) Emergency pointer. The value 1 is used to avoid TCP Data Flow interruption.

Ack :( acknowledgment fieldsignificant) if it is set to 1, it indicates that acknowledgmentnumber is valid. If it is set to 0, it indicates that the data segment does not contain confirmation information, and the confirmation number is ignored.

Psh: (push function), the data of the push flag. When set to 1, the requested data segment can be directly sent to the application after the receiver receives the data segment, instead of waiting until the buffer is full.

RST :( reset the connection) is used to reset the wrong connection caused by some reason, and to reject illegal data and requests. If an rst bit is received, some errors usually occur.

SYN :( synchronize sequence numbers) is used to establish a connection. In a connection request, SYN = 1, ACK = 0, and SYN = 1, ACK = 1 when the connection is responding. That is, SYN and ACK are used to differentiate connection request and connection accepted.

Fin :( no more data from sender) is used to release the connection, indicating that the sender has no data to send.

The six signs are seated. In this example, SYN = 0, ACK = 1, which indicates the connection request. When analyzing the TCP Header, pay attention to the transformation of the two.

(6) "Fe D9", window value, used to control traffic.

(7) "EA F7", inspection and TCP inspection are mandatory.

(8) "00 00", Urgent Pointer.