TCP/IP packet structure

TCP/IP packet structure

In general, we only need to call encapsulated functions or components to complete most of network programming. However, in some special cases, we need to have a deep understanding of the structure of network data packets, and protocol analysis. Such as network monitoring and troubleshooting ......

The IP package is insecure, but it is the foundation of the Internet and widely used in various aspects. There are more than 10 protocol families derived from the IP protocol (as I know), and many other IP-based protocols will emerge in the future...

Let's start with the actual situation!

When talking about the Internet speed, we use bandwidth to describe it professionally. In fact, no matter the network speed or bandwidth is inaccurate. For example, 1 MB, 512 K ...... Some students in the school may have questions about why the download speed cannot exceed kb even though my business is 1 MB? Why is the K cap over 50 K ?...

1 m Refers to 1 Mbps = 1 Million Bits Per Second, that is, 1 m Bits Per Second, that is, 1048576 binary Bits are transmitted in one Second. We know that a byte is eight binary digits.

Okay, you have another problem. Even so, 1 M = 1048756 then 8 = 131072 then 1024 = 128 K. There should also be 120 K. Why is the download speed still very low to K, and K is thankful. After reading this article, your account is correct ......

IP packet structure:

, A scale represents 1 binary bit (BIT)

1-1. the four-digit version number indicates the version number. Currently, the most widely used version is 4 = B1000, which is also known as IPv4. I believe IPv6 will be widely used in the future, it can assign an IP address to every button in the world.

1-2. The header length is 4 bits and the length of the packet header. It indicates how many 32-bit long integer data is contained in the packet header, that is, how many 4 bytes of data are contained. If there is no option, the value is 5 (in red ).

1-3. The service type contains eight binary bits. The meaning of each bit is as follows:

* Process field: 3 bits, set the importance of the data packet. The greater the value, the more important the data is. The value range is: 0 (normal )~ 7 (Network Control)

* Latency field: 1 bit; Value: 0 (normal); 1 (low latency)

* Traffic field: 1 bit; Value: 0 (normal); 1 (extremely high traffic)

* Reliability field: 1 bit; Value: 0 (normal); 1 (extremely high reliability)

* Cost field: 1 bit; Value: 0 (normal); 1 (special minimum cost)

* Reserved field: 1 bit, not used

1-4. The total length of the package is 16 bits. The total length of the current data packet, in bytes. Of course, the maximum value is 65535, and 64 KB.

2-1. The 16-bit re-identification is sent to the identity assigned by the host for the receiver to perform sharding.

2-2. mark 3. Their respective meanings are as follows:

* Reserved field bits (2): 1, not used

* Do not divide the field (1): 1 bit, value: 0 (agree to the datagram segment), 1 (the datagram cannot be segmented)

* Many other fields (0): 1, value: 0 (there is no package after the packet, this package is the final package), 1 (there are many other packages after the packet)

2-3. The segment offset is 13 BITs. It is combined with many other segments to help the receiver combine segmented packets in bytes.

3-1. The survival Time is 8 bits. The TTL (Time To Live) that is often seen by the ping command is this. Each Time a vro passes through, the value is reduced by one To zero and discarded.

3-2. The 8-bit protocol code indicates the upper-layer protocol that uses the package, such as TCP = 6, ICMP = 1, UDP = 17, etc.

3-3. header check and 16-bit check are the IPv4 packet header checksum.

4-1. Source start address, 32-bit 4-byte. We often see that IP addresses are separated by DOTS.

5-1. Destination Address, 32-bit, same as above.

6-1. Optional options, mainly for some special circumstances, often Security Routing will be used as an attack to filter out, universal (TP_LINK) TL-ER5110 routing can do so.

7-1. user data.

TCP packet structure:

1-1. The source starts with port16 bits. Of course, the range is 0-65535.

1-2. Destination port, same as above.

2-1. The data serial number is 32 bits. TCP creates a number for each byte sent. The serial number of the first byte of the current data packet is stored here.

3-1. Check that the serial number is 32 bits. For the sake of security, TCP tells the recipient that he wants to receive the first byte serial number of the next packet.

4-1. The offset is 4 bits, similar to the IP address, indicating the number of 32 bits from the header.

4-2. Retain 6 bits. if not used, set it to zero.

4-3. URG-When URG = 1, the emergency pointer field is valid. It tells the system that there is urgent data in this packet segment and should be transmitted as soon as possible (equivalent to high-priority data ).

4-3. confirm that the bit ACK is valid only when ACK = 1. When ACK = 0, the confirmation number is invalid.

4-4. reset bit RST (Reset)-When RST = 1, it indicates that a serious error occurred in the TCP connection (for example, due to host crash or other reasons), the connection must be released, then establish a transportation connection again.

4-5. synchronous bit SYN-if the synchronous bit SYN is set to 1, this indicates a connection request or connection to receive packets.

4-6. Terminate bit FIN (FINal)-used to release a connection. When FIN = 1, it indicates that the data of the sender of the message segment has been sent and the transport connection needs to be released.

4-7. The form field is 16 bits. The form field is used to control the data volume sent by the recipient, in bytes. One end of the TCP connection determines the size of the receiving form based on the size of the cache space, and then notifies the other end to determine the upper limit of the sending form of the other end.

5-1. The package checksum is 16 bits, including the header and data. During the calculation test, a 12-byte pseudo header must be added before the TCP packet segment.

5-2. The emergency pointer is 16 bits, indicating the serial number of the last byte of the emergency data in this section.

6-1. Optional 24-bit, similar to IP, is optional.

6-2. Fill in 8 bits so that the options are 32 bits.

7-1. User data ......

It can be seen that each IP packet requires at least 20 bytes of header length, which is irrelevant to the downloaded content. In addition, most of the current transmission, including http protocol (IE direct download), is based on TCP protocol, therefore, the IP package also deducts 20 bytes of TCP packet header from user data, which is already 40 bytes, plus connections from other programs, status confirmation, and so on, therefore, it is smaller than the theoretical value.

In addition, the network environment (including stability factors and transfer nodes) is also an important factor affecting the download speed ......