03 Wireshark TCP

1 Capture batch data from computer to remote server TCP transmission

1.1 experiment

• Start your web browser . Get into http://gaia.cs.umass.edu/wiresharklabs/ Alice.txt, obtain 《 Alice in wonderland 》 Of ASCII Code copy . Store this file somewhere on your computer .
• Next please visit http://gaia.cs.umass.edu/wireshark-labs/TCP-wireshark-file1.html. Use... In this form Browse Button to enter the file name ( Full path name ) Include in 《 Alice in wonderland 》 On the computer ( Or manual operation ). Don't press “ Upload alice.txt file ” Button .
• Now start Wireshark And start grabbing (capture -> start), Then press on Wireshark Packet Capture Options The screen shows OK( We don't need to choose any) Options ).
• Back to the browser , Press “ Upload alice.txt file ” Button to upload the file to gaia.cs.umass.edu The server . After uploading the file , A short congratulatory message will be displayed in your browser window .
• Stop grabbing .Wireshark The window should look like the window shown below .
  

2 The first time I saw the trace of capture

2.1 experiment

• stay Wireshark Enter... In the display filter rule window at the top of the window tcp( A lowercase letter , Without quotes , Don't forget to enter after typing !), Yes Wireshark Filter the message displayed in the window .
• Observe the computer and gaia.c.umass.edu A series of TCP and HTTP news .

2.2 QA

• Transfer files to gaia.c.umass.edu Client computers ( Source ) The use of IP Address and TCP What is the port number ? Answer that question , The easiest way is probably to choose one HTTP news , Then, use the details of the selected packet header window to study how to carry the HTTP News TCP Packet details .
  
• gaia.cs.umass.edu Of IP What's the address ? On which port number does it send and receive this connection TCP paragraph ?
  
• Your client computer ( Source ) Used to transfer files to gaia.c.umass.edu Of IP Address and TCP What is the port number ?
  The same problem .

3 TCP Basic knowledge of

3.1 experiment

Same as experiment 1 .

3.2 QA

• Used on client computers and gaia.c.umass.edu Between TCP Connected SYN What's the sequence number of the paragraph ? What is in this segment that identifies this segment as SYN paragraph ？
  
  Serial number is 0; In the flag bit syn Mark is 1.
• gaia.cs.umass.edu Send a response to the client computer SYN Of SYNACK What is the serial number of the segment ?SYNACK What is the value of the confirmation field in the section ?gaia.c.s.umass.edu How to determine this value ? What is in this segment that identifies this segment as SYNACK paragraph ？
  
  Serial number for 0; The confirmation field is 1, The confirmation field is in the request sent by the client Seq And the size of bytes sent ; The following flag bit fields identify SYNACK：
  
• contain HTTP POST Ordered TCP What is the serial number of the segment ? Please note that , In order to find POST command , You need to go deep Wireshark The package content field at the bottom of the window , In its DATA Field with POST Section of .
  
  Obviously, this is the first packet sent after three handshakes , Serial number for 1, But I didn't find POST...
• Will include HTTP POST Of TCP Segment as TCP The first segment in the connection .TCP Before connection 6 paragraph ( Include HTTP POST Section of ) What's the serial number of ? At what time each fragment is sent ? When did you receive each paragraph ACK ? Given each TCP The difference between the sending time and the sending time of the segment is confirmed , These six RTT How many segments are the values ?EstimatedRTT What is the value ( See also 3.5.3 section ,242 Page text ) After receiving each ACK? Value EstimatedRTT Equal to the measured value of the first segment RTT, And then use 242 On the page EstimatedRTT The formula calculates all subsequent data segments .
  
  Time measurement See this .
• TCP front 6 What are the lengths of the segments ?
  
• For the entire trace , What is the minimum amount of free buffer space received ? Whether the insufficient buffer space at the receiving end will strangle the sending end ？
  
  The lack of space will kill the sender .
• Track whether there are retransmitted segments in the file ? To answer this question , you ( In tracking ) What was checked ？
  
  Duplicate serial number .
• The recipient is usually at ACK How much data is confirmed in ? Can you tell if the consignee is packing every other received segment ？
  ACK Usually confirm 1 To 2 Segment data , Cumulative confirmation .
• TCP Throughput of connections ( Number of bytes transmitted per unit time ) How much is the ? Explain how you calculate this value .
  Specifically See this .

4 Running TCP Congestion control

4.1 experiment

• Check the amount of data sent from the client to the server per unit time . We will use Wireshark Of TCP One of the graphic tools —Time-Sequence-Graph(Stevens)— To plot data , Not from Wireshark Raw data in the window ( Blandly !) To calculate the data .
• stay Wireshark Select the corresponding... From the packet capturing list of TCP Message segment . Then choose the menu ：Statistics->TCP Stream Graph-> Sequence diagram
  

4.2 QA

• Are you sure TCP Start and end of the slow start phase , And where congestion avoidance is dominant ? Comment on how to measure ？
  It feels like a slow start , Jump straight up ...