TCP (Transmission Control Protocol) Transmission Control Protocol
1. In the TCP/IP protocol, the TCP protocol provides a reliable connection service, and a three-way handshake is used to establish a connection
(1) The first handshake: When establishing a connection, client A sends a SYN packet (SYN=j) to server B, and enters the SYN_SEND state, waiting for server B to confirm.
(2) The second handshake: When server B receives the SYN packet, it must confirm the SYN of client A (ACK=j+1), and at the same time send a SYN packet (SYN=k), that is, SYN+ACK packet. Server B enters the SYN_RECV state.
(3) The third handshake: Client A receives the SYN+ACK packet from server B, and sends an acknowledgement packet ACK (ACK=k+1) to server B. After this packet is sent, client A and server B enter the ESTABLISHED state, complete Three handshake.
After the three-way handshake is completed, the client and server begin to transmit data.
The following shows how to use wireshark to analyze the TCP three-way handshake to establish a connection.
Step1: Start wireshark to capture packets, open the browser and enter www.huawei.com
Step2: Use ping www.huawei.com to obtain the IP
Step3: Enter the filter conditions to get the list of data packets to be analyzed ip.addr == 111.1.59.189
As you can see in the figure, wireshark intercepted the three data packets of the three-way handshake. The fourth packet is HTTP, which shows that HTTP does use TCP to establish a connection.
Let's take a closer look at the three-way handshake:
the first handshake packet, the
client sends a TCP connection request
Source port: 54824
Destination port: 88
Serial number: 0
Confirmation number: Initially 0
Flag bit: SYN
second handshake Data packet The
server sends back a confirmation packet
Source port: 88
Destination port: 54824
Serial number: 0
Confirmation number: 1
Flag bit: SYN+ACK The
third handshake data packet The
client sends the confirmation packet
Source port: 54824
Destination port: 88
sequence Number: 1
Confirmation number: 1
Flag bit: ACK
passed the TCP three-way handshake in this way, and the connection was established.
Two or four disconnects
(1) Client A sends a FIN to close the data transmission from Client A to Server B.
(2) Server B receives this FIN, it sends back an ACK, confirming that the serial number is the serial number received plus 1. Like SYN, a FIN will occupy a serial number.
(3) Server B closes the connection with client A and sends a FIN to client A.
(4) Client A sends back an ACK message confirmation, and sets the confirmation sequence number to the received sequence number plus 1.
The four disconnects captured by wineshak are shown in the figure. The
detailed process time reason is written here first.