Wireshark packet capture analysis TCP establishment and disconnection Process Analysis

Wireshark packet capture Analysis of TCP establishment and disconnection Process

1. Establish a connection over TCP

Note: In this figure, Hosta acts as the client and hostb acts as the server.

TCP is the transport layer protocol in the Internet. It uses the three-way handshake protocol to establish a connection. When the active Party sends a SYN connection request, wait for the other party to answer SYN, Ack. This method of establishing a connection can prevent incorrect connections. The traffic control protocol used by TCP is a variable-size Sliding Window Protocol.

First handshake: When a connection is established, Hosta sends the SYN Packet (SEQ = A) to hostb and enters the syn_send status. Wait for hostb to confirm.

Second handshake: After receiving the SYN packet, hostb must confirm the Syn (ACK = a + 1) of Hosta and also send a SYN Packet (SEQ = B), that is, SYN + ACK packet, in this case, hostb enters the syn_recv state.

Third handshake: Hosta receives the SYN + ACK package of hostb and sends the ACK (ACK = B + 1) Confirmation package to hostb. After the package is sent, Hosta and hostb enter the established status and complete three handshakes.

Packet Capture Verification:

First handshake:

Second handshake:

Third handshake:

Ii. TCP disconnection

After the data transmission is complete, the TCP connection needs to be closed after four handshakes. The steps are as follows:

1. Hosta: to terminate the connection, send the segment with the serial number P, set the fin bit, and confirm the segment received previously;
2. After receiving the segment sent by Hosta, hostb sends the ACK segment and confirms that it is p + 1, and closes the connection.
3. At the same time, hostb sends a segment with the serial number Q, and sets the fin to notify the connection to be closed;
4. After Hosta receives the segment sent by hostb, it sends the ACK segment, confirms that it is q + 1, and closes the connection.

Packet Capture Verification:

First handshake:

The second and third handshakes:

The fourth handshake:

The experiment is complete !!!!!!!!!!!!!