The tcpdump analysis tool is used to verify the tcp connection establishment and closure process.

The tcpdump analysis tool is used to verify the tcp connection establishment and closure process.

This article requires that you have some knowledge about TCP's three-way handshake to establish and close the connection. This article does not detail the three-way handshake, only one instance is used to verify the three-way handshake.

You must be familiar with the establishment and closure of tcp connections! Establish a connection through three handshakes and close the connection through three or four (semi-closed) handshakes! Here, I want to analyze this process through a specific instance program!

First, let's talk about the tools used, the tcpdump command in linux, and a server and a client program written in C language. The program code is as follows:

Header file:

1 # include <stdio. h> 2 # include <stdlib. h> 3 # include <sys/types. h> 4 # include <sys/socket. h> 5 # include <netinet/in. h> 6 # include <netdb. h> 7 # include <errno. h> 8 # include <signal. h> 9 # include <unistd. h> 10 # include <string. h> 11 # include <sys/wait. h> 12 # include <arpa/inet. h>Header

Server:

1 # include "header. h "2 int main (int argc, char * argv []) 3 {4 int socket_n; // socket descriptor 5 int listen_s; // listen to socket descriptor 6 socklen_t cli_addr_len; // client address length 7 struct sockaddr_in server_addr; // server address 8 struct sockaddr_in client_addr; // client address 9 10 int n = 0; // The received data length is 11 char buffer [256]; // data buffer 12 int maxLen = sizeof (buffer); 13 memset (buffer, 0, maxLen ); 14 char cli_addr [20]; 15 16 // create a listening socket 17 listen_s = socket (AF_INE T, SOCK_STREAM, 0); 18 19 // create a local server socket 20 memset (& server_addr, 0, sizeof (server_addr); 21 server_addr.sin_family = AF_INET; 22 rows = htonl (INADDR_ANY); 23 server_addr.sin_port = htons (9877); 24 25 // bind the socket to the local socket address 26 if (bind (listen_s, (struct sockaddr *) & server_addr, sizeof (server_addr) <0) 27 {28 perror ("Error: binding failed! "); 29 exit (0); 30} 31 // listener link request 32 if (listen (listen_s, maxLen) <0) 33 {34 perror (" Error: listening failed! "); 35 exit (1); 36} 37 38 while (1) 39 {40 if (socket_n = accept (listen_s, (struct sockaddr *) & client_addr, & cli_addr_len) <0) 41 {42 perror ("Error: accepting failed! "); 43 exit (1); 44} 45 read (socket_n, buffer, maxLen); 46 inet_ntop (AF_INET, & client_addr.sin_addr, cli_addr, sizeof (cli_addr )); 47 printf ("% s sent % s", cli_addr, buffer); 48 write (socket_n, buffer, strlen (buffer )); 49 printf ("the established connection is about to close \ n"); 50 close (socket_n); 51} 52 return 0; 53}Server

Client:

1 # include "header. h "2 int main (int argc, char * argv []) 3 {4 int sockfd; 5 char buffer_s [256]; 6 char buffer_r [256]; 7 struct sockaddr_in servaddr; 8 9 memset (buffer_r, 0, sizeof (buffer_r); 10 memset (buffer_s, 0, sizeof (buffer_s); 11 12 if (argc! = 2) 13 {14 printf ("usage: client <IP address>! "); 15 exit (0); 16} 17 18 sockfd = socket (AF_INET, SOCK_STREAM, 0); 19 20 memset (& servaddr, 0, sizeof (servaddr )); 21. servaddr. sin_family = AF_INET; 22 servaddr. sin_port = htons (9877); 23 inet_ton (AF_INET, argv [1], & servaddr. sin_addr); 24 25 connect (sockfd, (struct sockaddr *) & servaddr, sizeof (servaddr); 26 27 while (fgets (buffer_s, 256, stdin )! = NULL) 28 {29 write (sockfd, buffer_s, strlen (buffer_s); 30 if (read (sockfd, buffer_r, 256) = 0) 31 {32 printf ("client: server terminated prematurely"); 33} 34 fputs (buffer_r, stdout); 35} 36 37 return 0; 38}Client

The Command Used For tcpdump is:

tcpdump -i lo tcp port 9877 and host 127.0.0.1

This command indicates that I capture the package with the ip address 127.0.0.1 and port number 9877 (this 9877 is the interface bound to the server in my program) on the lo NIC (loopback interface!

The running result is as follows:

The client sends a "a \ n" to the server and receives a "a \ n ";

　　

There are a lot of screenshots to be captured, and the part related to this article is the bottom one. at the beginning of the/server, the server receives a "a \ n" and immediately closes the connection after it is returned to the client, prompting "the connection just established is about to close "!

　　

This is a picture captured by the packet capture software, so we have to analyze it carefully!

The first thing to note is that the analysis is from 15:32:38. starting from 348872, 38264 indicates the client port number, and 9877 indicates the server port number. For some packets, the mark ACK should be included in the symbol bit (flags in the figure, however, it is not shown in detail. I think it may be that tcpdump is omitted, and the SYN symbol (expressed in one S) in some packets may also be omitted. In addition, it should be noted that the serial numbers of the server and client should be random numbers, but after the connection is established, it will automatically start from 1. I think this is tcpdump, which is automatically calculated!

The first message indicates that the client sends a packet to the server. The sequence number is seq 598232472 and the flag bit is SYN, which is the first handshake to establish a connection. The client sends its own serial number.

The second message indicates that the server sends a packet to the client. The sequence number is seq 3283581888, the validation number is 5982324272, and the flag bit is SYC (in theory there should be ACK, which may not be shown here ), this is the second handshake to establish a connection. The server sends the serial number of this side and confirms the serial number of the client.

The third message indicates that the client sends a packet to the server without the serial number. The confirmation number is 1 (I think tcpdump is the packet capture software for processing), indicating that the client wants to accept the first byte from the server, by now, the three handshakes have been completed and the client-to-server connection has been established.

The fourth message indicates that the client sends two bytes of information to the server. The sequence number is 1 and the validation number is 1. The flag is PSH (indicating that it is not cached in the window and directly handed over to the application ).

The fifth message indicates that the server sends a confirmation message to the client. The confirmation number is 3 and there is no serial number.

The sixth message indicates the two bytes sent by the server to the client. The serial number is 1 and the confirmation number is 3. the symbol bit is PSH.

Article 7 The server sends a final FIN message to the client. If the serial number is 3 and the serial number is 3, the three-way handshake process of the connection is closed. (The server is automatically disabled, so the three-way handshake is changed to a two-way handshake ~~).

The eighth message indicates a confirmation message sent by the client to the server. The confirmation number is 3, indicating the confirmation of the two bytes sent by the server.

The ninth message indicates that the client sends a confirmation message to the server. The confirmation number is 4, indicating that the FIN termination message sent by the server is confirmed. At this point, the TCP connection is closed.

 

OK. This is an example of a three-way handshake. We hope this will help you better understand the three-way handshake process.