基于wireshark的TCP和UDP报文分析

《基于wireshark的TCP和UDP报文分析》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、《计算机网络基础》课程报告基于Wireshark的TCP和UDP报文分析院系：班级：学号：姓名：教师：2012年11月4日9目录一TCP连接时的三次握手··································3二TCP连接释放时的四次握手······························5三UDP报文分析··········································73.1UDP报文结构······································73.2UDP检验和的计算·····

2、····························7四结束语···············································99一、TCP连接时的三次握手TCP协议为终端设备提供了面向连接的、可靠的网络服务。TCP在交换数据报文段之前要在发送方和接收方之间建立连接。客户是连接的发起者，服务器是被动打开和客户进行联系。具体的过程如下所述。第一次握手：客户发送SYN=1，seq=0的TCP报文给服务器Ps：客户的TCP向服务器发出连接请求报文段，其首部中的同步位SYN=1。序号seq=0，表明报文中未携带数据

3、。报文如下：源端口号:56644(56644)目的端口号:http(80)[Streamindex:0]Sequencenumber:0(relativesequencenumber)Headerlength:32bytesFlags:0x02(SYN)000.........=Reserved:Notset9...0........=Nonce:Notset....0.......=CongestionWindowReduced(CWR):Notset.....0......=ECN-Echo:Notset......0.....=Urg

4、ent:Notset.......0....=Acknowledgement:Notset........0...=Push:Notset.........0..=Reset:Notset..........1.=Syn:Set...........0=Fin:NotsetWindowsize:8192Checksum:0x1030[validationdisabled]Options:(12bytes)第二次握手：服务器发送SYN=1，ACK=1，seq=0的TCP报文给客户Ps：服务器的TCP收到客户发来的连接请求报文段后，如同意，则发

5、回确认。服务器在确认报文段中应使SYN=1，使ACK=1。序号seq=0，表明报文中未携带数据。报文如下：源端口号:http(80)目的端口号:56644(56644)[Streamindex:0]Sequencenumber:0(relativesequencenumber)Acknowledgementnumber:1(relativeacknumber)Headerlength:32bytesFlags:0x12(SYN,ACK)000.........=Reserved:Notset...0........=Nonce:Notset

6、....0.......=CongestionWindowReduced(CWR):Notset.....0......=ECN-Echo:Notset......0.....=Urgent:Notset.......1....=Acknowledgement:Set........0...=Push:Notset.........0..=Reset:Notset..........1.=Syn:Set...........0=Fin:NotsetWindowsize:5840Checksum:0x54f6[validationdisabl

7、ed]Options:(12bytes)第三次握手：客户发送ACK=1的TCP报文给服务器Ps：客户收到报文段后向服务器给出确认，其ACK=1。客户的TCP通知上层应用进程，连接已经建立。服务器的TCP收到主机客户的确认后，也通知其上层应用进程，TCP连接已经建立。9报文如下：源端口号:56644(56644)目的端口号:http(80)[Streamindex:0]Sequencenumber:1(relativesequencenumber)Acknowledgementnumber:1(relativeacknumber)Header

8、length:20bytesFlags:0x10(ACK)000.........=Reserved:Notset...0........=Nonce:Notset....0..