TCP/IP packet structure

[Keywords] TCP/IP packet structure explanation network protocol

In general, we only need to call some encapsulated functions or components for network programming to complete most of the work. However, in some special cases, we need to have a deep understanding.

Network Packet structure and protocol analysis. Such as network monitoring and troubleshooting ......

 

The IP package is insecure, but it is the foundation of the Internet and widely used in various aspects. More than 10 protocol families (as far as I know) derived from the IP protocol will appear in the future

Many other IP-based protocols...

 

Let's start with the actual situation!

When talking about the Internet speed, we use bandwidth to describe it professionally. In fact, no matter the network speed or bandwidth is inaccurate. For example, 1 MB, 512 K ......

Some students in the school may have questions about why the download speed cannot exceed kb even though my business is 1 MB? Why is the K cap over 50 K ?...

 

1 m Refers to 1 Mbps = 1 million bits per second, that is, 1 m bits per second, that is, 1048576 binary bits are transmitted in one second. We know a byte

It is 8 binary bits.

Okay, you have another problem. Even so, 1 m = 1048756 then 8 = 131072 then 1024 = 128 K. The download speed should also be 120 kb. Why is the download speed still very low to kb,

Thank God for all the help. After reading this article, your account is correct ......

 

IP packet structure:

, A scale represents 1 binary bit (BIT ).

1-1. The version number is four digits, indicating the version number. Currently, the most widely used version is 4 = B1000, which is also known as IPv4. I believe IPv6 will be widely used in the future and it can be assigned to every button in the world.

An IP address.

1-2. The header length is 4 bits and the length of the packet header. It indicates how many 32-bit long integer data is contained in the packet header, that is, how many 4 bytes of data are contained. If there is no option, the value is 5 (in red ).

1-3. The service type contains eight binary bits. The meaning of each bit is as follows:

Process Field: 3 bits, set the importance of the data packet. The greater the value, the more important the data is. value range: 0 (normal )~ 7 (Network Control)

Latency field: 1 bit; Value: 0 (normal); 1 (low latency)

Traffic field: 1 bit; Value: 0 (normal); 1 (high traffic)

Reliability field: 1 bit; Value: 0 (normal); 1 (extremely high reliability)

Cost field: 1 bit; Value: 0 (normal); 1 (special minimum cost)

Reserved field: 1 bit, not used

1-4. The total length of the package is 16 bits. The total length of the current data packet, in bytes. Of course, the maximum value is 65535, and 64 KB.

2-1. The 16-bit re-identification is sent to the identity assigned by the host for the receiver to perform sharding.

2-2. mark 3. Their respective meanings are as follows:

Reserved field (2): 1 bit, not used

No field (1): 1, value: 0 (agree to the datagram segment), 1 (the datagram cannot be segmented)

Many other fields (0): 1, value: 0 (there is no package after the packet, this package is the final package), 1 (there are many other packages after the packet)

2-3. The segment offset is 13 BITs. It is combined with many other segments to help the receiver combine segmented packets in bytes.

3-1. The survival time is 8 bits. The TTL (time to live) that is often seen by the ping command is this. Each time a vro passes through, the value is reduced by one to zero and discarded.

3-2. The 8-bit protocol code indicates the upper-layer protocol that uses the package, such as TCP = 6, ICMP = 1, UDP = 17, etc.

3-3. header check and 16-bit check are the IPv4 packet header checksum.

4-1. Source start address, 32-bit 4-byte. We often see that IP addresses are separated by DOTS.

5-1. Destination Address, 32-bit, same as above.

6-1. Optional options, mainly for some special circumstances, often Security Routing will be used as an attack to filter out, universal (tp_link) TL-ER5110 routing can do so.

7-1. user data.

TCP packet structure:

1-1. The source starts with port16 bits. Of course, the range is 0-65535.

1-2. Destination Port, same as above.

2-1. The data serial number is 32 bits. TCP creates a number for each byte sent. The serial number of the first byte of the current data packet is stored here.

3-1. Check that the serial number is 32 bits. For the sake of security, TCP tells the recipient that he wants to receive the first byte serial number of the next packet.

4-1. The offset is 4 bits, similar to the IP address, indicating the number of 32 bits from the header.

4-2. Retain 6 bits. if not used, set it to zero.

4-3. URG-When URG = 1, the emergency pointer field is valid. It tells the system that there is urgent data in this packet segment and should be transmitted as soon as possible (equivalent to high-priority data ).

4-3. confirm that the bit Ack is valid only when ACK = 1. When ACK = 0, the confirmation number is invalid.Test TCP three-way handshake

4-4. Reset bit RST (reset)-When RST is set to 1, it indicates that a serious error occurs in the TCP connection (for example, due to host crash or other reasons). You must release the connection and try again.

Establish a transportation connection.Test TCP three-way handshake

4-5. synchronous bit syn-if the synchronous bit SYN is set to 1, this indicates a connection request or connection to receive packets.Test TCP three-way handshake

4-6. Terminate bit fin (final)-used to release a connection. When fin = 1, it indicates that the data of the sender of the message segment has been sent and the transport connection needs to be released.

4-7. The form field is 16 bits. The form field is used to control the data volume sent by the recipient, in bytes. The end of the TCP connection determines its receiving form based on the size of the cache space.

And then notify the recipient to determine the upper limit of the recipient's sending form.

5-1. Packet checksum and 16 bits, includingHeaderAndDataThese two parts. During the calculation test, a 12-byte pseudo header must be added before the TCP packet segment.

5-2. The emergency pointer is 16 bits, indicating the serial number of the last byte of the emergency data in this section.

6-1. Optional 24-bit, similar to IP, is optional.

6-2. Fill in 8 bits so that the options are 32 bits.

7-1. User data ......

 

It can be seen that each IP packet requires at least 20 bytes of header length, which is irrelevant to the downloaded content. In addition, most of the current transmission, including HTTP protocol (ie direct download), is based on

Therefore, the IP package deducts 20 bytes of the TCP packet header from the user data. Here it is 40 bytes, plus the connection of other programs, status confirmation, and so on.

The calculation result is smaller than the theoretical value.

In addition, the network environment (including stability factors and transfer nodes) is also an important factor affecting the download speed ......

 

Well, that's all!

TCP/IP packet structure