Several TCP states play a role in our analysis: SYN, FIN, ack, Psh,

Several TCP states play a role in our analysis.

On the TCP layer, there is a flags field, which has the following identifiers: SYN, FIN, ack, Psh, RST, and URG.

Where

What is useful for our daily analysis is the first five fields.

Their meaning is: SYN indicates a connection is established, Fin indicates a closed connection, Ack indicates a response, and PSH indicates data transmission.

Input. rst indicates that the connection is reset.

 

Among them, Ack may be used together with SYN and fin. For example, SYN and ACK may both be 1, which indicates the response after the connection is established,

If it is only a single SYN, all it means is to establish a connection.

 

The several handshakes of TCP are represented by such ack.

However, SYN and fin are not 1 at the same time, because the former indicates

Establish a connection, while the latter indicates that the connection is closed. RST is usually 1 after Fin, indicating that the connection is reset. Generally, when a fin or RST package appears

It is considered that the client is disconnected from the server. When the SYN and SYN + ACK packets appear, we think the client is connected to the server. When PSH is 1, only

In a packet whose data content is not 0, that is to say, PSH is 1, indicating that the real TCP packet content is transmitted. TCP connection establishment and connection closure are both in request-response mode.

Completed.