Three-time handshake for TCP/IP protocol

Ethernet data is transmitted in frames, and each frame (MAC packet) data is divided into two parts: header and data. The data section is a maximum of 1500byte, of course, this size can be set (to comply with standards, the consequences may be very serious).

The data portion of the MAC packet is wrapped with the IP packet, the IP packet is also composed of header and data, IP packet and the data part of the wrapper TCP packet, TCP is also composed of header and data, The TCP packet Data section also wraps the application layer protocol packets such as HTTP,

The accepted data is also parsed by the corresponding layer layer. IP packet Maximum 65535byte, if the IP packet is larger than the maximum Mac packet, then cut into multiple MAC packets for transmission.

TCP packet Format

Source Port (Source)

Destination Port: (Destination port)

Sequence number (envelope ordinal):

Because TCP packets must be brought into the IP packet, if the TCP data is too large (greater than the IP packet tolerance), it is necessary to fragment. This Sequence number is the sequential sequence of each packet, allowing the receiving side to re-assemble the TCP data.

Acknowledge Number:

In order to confirm that the host side does receive the packet data sent by our client, our client certainly wants to receive the response from the host, which is the purpose of this acknowledge number. When the client side receives this confirmation code, it is able to determine that the previously delivered packet has been properly received.

Code (Control flag, code)

When we are online, we have to explain the status of this online so that the receiver knows the main action of the packet. It's a very important handle. This field has a total of 6 bits, representing 6 handles, or 1 for startup. The following are explained separately:

URG (Urgent): If 1 means the packet is an emergency packet, the receiver should be urgent, and the Urgent Pointer field in Figure 2.4-1 is also enabled.

ACK (Acknowledge): If 1 represents the packet as a response packet, it is related to the acknowledge number mentioned above.

PSH (push function): If it is 1 o'clock, the representative asks the other party to send the other corresponding packets in the buffer immediately, without waiting for the buffer to be full.

RST (Reset): If the RST is 1, the joint opportunity is immediately terminated without waiting for the termination confirmation. This means that this is a forced end of the online and the sending side is disconnected.

SYN (Synchronous): If 1, indicates that the sending side wants both sides to establish synchronous processing, that is, the requirement to set up online. A packet with a SYN flag usually means "active" to connect to the other person.

FIN (Finish): If 1, indicating the end of the transmission, so notify the other side of the data to pass, whether to agree to disconnect, but the sender is still waiting for the other side of the response.

Three-time handshake process

HTTP is an application-layer protocol built on TCP, and I analyze it with access to http://www.centoscn.com/CentosServer/www/2015/0422/5245.html

Open Wireshark, filter the rules, enter HTTP, find the get/centosserver/www/2015/0422/5245.html http/1.1 record, right-click "Follow TCP Stream"

I saw that before HTTP data transfer, my native and 120.76.14.151 sent 3 TCP packets to each other, which is the 3-time handshake package.

First handshake packet, TCP controlflags syn for 1,sequence num 963326680

The second handshake of the packet, by a three-time handshake diagram We can conclude that the second handshake packet controlflgas The SYN bit for the 1,ack bit to 1,acknowledge number=963326680+1=963326681

The third handshake data is drawn from the figure Controlflgas ACK is 1, acknowledge number=475266512+1=475266513

And analyze the next four waves in the back.

Three-time handshake for TCP/IP protocol