TCP three-way handshake

TCP establishes a three-way handshake for a link. TCP is a link-oriented protocol that serves the application layer, such as FTP and HTTP.
TCP uses three handshakes to establish a link.

The Header Format of the TCP packet segment is as follows: www.2cto.com

The following is an analysis of the process of using tcpdump to capture and use TCP to establish a link. Linux @ linux :~ $ Sudo tcpdump-X tcp port 21 tcpdump: verbose output suppressed, use-v or-vv for full protocol decodelistening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes21: 06: 16.599278 IP 192.168.1.104.64601> linux. ftp: Flags [S], seq 1586176627, win 8192, options [mss 1460, nop, nop, sackOK], length 0
0x0000: 4500 0030 38a2 4000 4006 7e08 c0a8 0168 E. 08 .@.@.~.... H 0x0010: c0a8 0165 fc59 0015 5e8b 2273 0000 0000... e. Y .. ^. after the preceding command is executed, an FTP connection is sent to the FTP server on another host. The three-way handshake for TCP connection establishment will appear. The above is the packet segment (the first handshake) of the TCP request sent by the host 192.168.1.104 to the FTP server ).
Parse the text as follows: 4500 0030 38a2 4000 4006 0168 7e08 c0a8 0165 c0a8 IP datagram header 20 bytes. Fc59 0015 5e8b 2273 0000 0000 7002 2000 6194 0000 the first 20 bytes of the TCP packet end. Source Port: fc59 www.2cto.com destination port: 21seq: 5e8b 2273ack: 0000 0000SYN = 1ACK = 0 the parsing process should be one-to-one comparison against the TCP Header Format. --------------------------------------------------------------------------------
The FTP server responds: (the second handshake) 21:06:16. 599311 IP linux. ftp> 192.168.1.104.64601: Flags [S.], seq 2037040717, ack 1586176628, win 14600, options [mss 1460, nop, nop, sackOK], length 0 0x0000: 4500 0030 0000 4000 b6aa c0a8 4006 E .. 0 .. @. @...... e 0x0010: c0a8 0168 0015 fc59 796a c64d 5e8b 2274... h... yyj. M ^. the TCP packet segment is parsed as follows: www.2cto.com 4500 0030 0000 4000 b6aa c0a8 4006 c0a8 0165 IP datagram header 20 bytes. 0015 fc59 796a c64d 5e8b 2274 7012 3908 8440 TCP packet end header 20 bytes. 0204 05b4 0101 0402 data sent by FTP. Source Port: 21 destination port: fc59seq: 796a c64dack: 5e8b 2274 confirmation number = previous serial number 1SYN = 1ACK = 1 Listen third handshake: 21:06:16. 601230 IP 192.168.1.104.64601> linux. ftp: Flags [.], ack 1, win 8192, length 0 www.2cto.com 0x0000: 4500 0028 38a3 4000 4006 7e0f c0a8 0168 E .. (8. @. @. ~.... H0x0010: c0a8 0165 fc59 0015 5e8b 2274 796a c64e... e. Y .. ^. "tyj. n0x0020: 5010 2000 4e8f 0000 0000 0000 P... N ......... 4500 0028 38a3 4000 4006 7e0f c0a8 0168 c0a8 0165 IP datagram header 20 bytes.
Fc59 0015 5e8b 2274 796a c64e 5010 2000 4e8f 0000 the first 20 bytes of TCP packets. Source Port: fc59 destination port: 21seq: 5e8b 2274ack: 796a c64e validation number = previous serial number 1SYN = 0ACK = 1 success ---------------------------------------------------------------------------------------------