当前位置:网站首页>Technology sharing | packet capturing analysis TCP protocol
Technology sharing | packet capturing analysis TCP protocol
2022-07-06 21:18:00 【Hogwarts_ test】
This article is excerpted from the internal textbook of Hogwarts testing and development society
TCP The protocol is in the transport layer , A connection oriented 、 reliable 、 Transport layer communication protocol based on byte stream .
Environmental preparation
Classify interface testing tools , It can be classified as follows :
- Network sniffer tool :tcpdump,wireshark
- Agent tools :fiddler,charles,anyproxyburpsuite,mitmproxy
- Analysis tools :curl,postman,chrome Devtool
Caught analysis TCP agreement
tcpdump
tcpdump Is a The of packets transmitted over a network “ head ” Completely intercepted to provide analysis Tools for . It supports for network layer 、 agreement 、 host 、 Network or port filtering , And provide and、or、not And other logical statements to remove useless information .
Give Way tcpdump Always monitor 443 port , If there is any difference, enter it into log In file
sudo tcpdump port 443 -v -w /tmp/tcp.log
Use this command , Will put the report in the directory /tmp/tcp.log
in .
Common parameters | meaning |
---|---|
port 443 | monitor 443 port |
-v | Output more detailed information |
-w | Write data to log in |
wireshark
wireshark It is also a network sniffing tool , In addition to having tcpdump function , There are more extensions , For example, analysis tools , But in interface testing , The process of capturing packets is often carried out on the server , Servers generally do not provide UI Interface , therefore wireshark Unable to work on server , Can only use tcpdump Grab bag generation log, And then log Import wireshark Use , There is UI Analysis on the client of the interface .
Caught analysis TCP agreement
Grab one http Of get request :
- Search on Baidu mp3
http://www.baidu.com/s?wd=mp3
- use tcpdump Intercept this get request , And generate log
- use wireshark open tcpdump Generated log
Use wireshark see log:
log The first few messages are three handshakes . Because the channel is unreliable , Before sending the data , It is necessary to ensure channel stability , And three handshakes are like the following operations :
- The first handshake : When establishing a connection , The client sends syn package (syn=j) To the server , And enter SYN_SENT state , Wait for server to confirm .
- The second handshake : Server received syn package , Must confirm customer's SYN(ack=j+1), At the same time, I also send a SYN package (seq=k), namely SYN+ACK package , At this time, the server enters SYN_RECV state ;
- The third handshake : Client receives server's SYN+ACK package , Send confirmation package to server ACK(ack=k+1), This package has been sent , Client and server access ESTABLISHED(TCP Successful connection ) state , Complete three handshakes .
After three handshakes , Can further communicate , It looks like this :
At the end of the communication , Four waves are also required :
- First wave : The client sends a... To the server FIN, Request to turn off data transfer .
- Second wave : The server received... From the client FIN, Send a ACK, among ack The value is equal to the FIN+SEQ.
- Third wave : The server sends a... To the client FIN, Tell client application to close .
- Fourth wave : The client receives... From the server FIN, Reply to one ACK To the server . among ack The value is equal to the FIN+SEQ.
Be careful : A request may be divided into multiple packets , So is a data , So in wireshark You'll see a lot of bags .
边栏推荐
- Nodejs tutorial expressjs article quick start
- What is the problem with the SQL group by statement
- js通过数组内容来获取数组下标
- JS get array subscript through array content
- Pat 1085 perfect sequence (25 points) perfect sequence
- 【深度学习】PyTorch 1.12发布,正式支持苹果M1芯片GPU加速,修复众多Bug
- Reinforcement learning - learning notes 5 | alphago
- Absolute primes (C language)
- Ravendb starts -- document metadata
- Data Lake (VIII): Iceberg data storage format
猜你喜欢
基于深度学习的参考帧生成
Reinforcement learning - learning notes 5 | alphago
Aiko ai Frontier promotion (7.6)
Performance test process and plan
This year, Jianzhi Tencent
PHP saves session data to MySQL database
SAP Fiori应用索引大全工具和 SAP Fiori Tools 的使用介绍
20220211 failure - maximum amount of data supported by mongodb
Swagger UI tutorial API document artifact
[MySQL] trigger
随机推荐
@PathVariable
Word bag model and TF-IDF
[sliding window] group B of the 9th Landbridge cup provincial tournament: log statistics
It's almost the new year, and my heart is lazy
SAP UI5 框架的 manifest.json
Nodejs tutorial expressjs article quick start
HMS Core 机器学习服务打造同传翻译新“声”态,AI让国际交流更顺畅
After working for 5 years, this experience is left when you reach P7. You have helped your friends get 10 offers
WEB功能测试说明
Why does MySQL index fail? When do I use indexes?
c#使用oracle存储过程获取结果集实例
2017 8th Blue Bridge Cup group a provincial tournament
No Yum source to install SPuG monitoring
基于深度学习的参考帧生成
【mysql】触发器
Select data Column subset in table R [duplicate] - select subset of columns in data table R [duplicate]
Tips for web development: skillfully use ThreadLocal to avoid layer by layer value transmission
JS according to the Chinese Alphabet (province) or according to the English alphabet - Za sort &az sort
Divide candy
Fastjson parses JSON strings (deserialized to list, map)