Experiment 4 TCP/UDP protocol analysis
1. Purpose of the experiment
- Understand and master the communication mechanism of TCP protocol and UDP protocol
- Familiar with the process and operation of using the packet capture software wireshark
- Learn to analyze the TCP three-way handshake process when connecting
- Learn to analyze how the receiver responds
2. Experimental environment
computer, wireshark, Server.exe, Client.exe, textbook.txt
3. Relevant principles and knowledge points
- TCP three-way handshake protocol
In the TCP/IP protocol, the TCP protocol provides reliable connection services and uses three-way handshake to establish a connection.
The first handshake: When the connection is established, the client sends a syn packet (syn=j) to the server, and enters the SYN_SEND state, waiting for the server to confirm; SYN: Synchronize Sequence Numbers (Synchronize Sequence Numbers) The second handshake: The server receives the
syn package, must confirm the customer's SYN (ACK=j+1), and at the same time send a SYN package (syn=k), that is, SYN+ACK package, at this time the server enters the SYN_RECV state; the third handshake: the client
receives The SYN+ACK packet of the server sends an acknowledgment packet ACK (ack=k+1) to the server. After the packet is sent, the client and server enter the ESTABLISHED state and complete the three-way handshake
- TCP four-way handshake
1. Client A sends a FIN to close the data transmission from client A to server B
2. Server B receives the FIN, it sends back an ACK, and the confirmation sequence number is the received sequence number plus 1. Like SYN, a FIN will occupy a sequence number
3. Server B closes the connection with client A and sends a FIN to client A
4. Client A sends back an ACK message to confirm, and sets the confirmation sequence number as the received sequence number plus 1
4. Experimental content
Experimental task 1: TCP protocol analysis
Design ideas:
1. First, there must be two computers, one as the client and the other as the server.
2. Assume that there are computer 1 and computer 2. Run the existing Server.exe on computer 1, and set the port number; run the existing Client.exe on computer 2, enter the IP address of computer 1 and the set port number, and upload the prepared textbook.txt file.
3. At this time, wireshark captures the sent packets and displays, observes and analyzes the captured data.
Key details: first, when opening Server.exe and Client.exe, be sure to open Server.exe first, otherwise an error will occur; second, when using Client.exe to send data, be sure to open wireshark first, otherwise will not catch
5. Experimental steps
Experimental task one
- Select two computers, use the ipconfig command to view the network IP addresses of the two computers, one opens Server.exe, the command is Server.exe 8888 (8888 is the port number, the port number can take other values, such as 8080, 2021, etc.);
- Open wireshark, set the capture condition as host IP address 1 and host IP address 2, and start capturing.
- Open Client.exe on another computer, use the command Client+IP address of Server.exe + port set by Server.exe (such as Client 10.0.0.1 8888), open and enter the prepared file textbook.txt, and then enter block size is 1, when "Start xxx connect to Server; File transfer is over!" appears, it indicates that the transfer has been successful.
- Switch back to wireshark from the background and stop capturing packets. Then enter "tcp" in the upper filter to filter other useless information, observe the data and analyze the three-way handshake and four-way handshake of TCP.
- Then re-execute the above four operations, keep the set port number unchanged, and input the block size as 1460 and 3000 respectively, and then go to wireshark to obtain new data, observe and analyze.
Key details:
- Note that the port set on the Server side should be consistent with the port number entered in the Client;
- First open wireshark to open capture, then open Server.exe, and finally open Client.exe;
- The textbook.txt file should be larger, if it is too small, it may affect the experimental data
6. Experimental results and analysis
Experimental Task 1 Results
When the port at the server is set to 8888, the block size is 1, and the capture condition is under the campus network, host 10.33.114.39 and host 10.33.87.94, the result is as follows Three-way handshake: Four-way handshake:
(
The
picture is omitted when the block size is other values )
Result analysis:
- The process of TCP three-way handshake in the experiment:
The first handshake: When two computers establish a connection, the client sends a SYN packet to the server, and enters the SYN_SENT state, waiting for the server to confirm; SYN is the synchronization sequence number, which represents the client requesting a connection. An example is shown in the figure.
The second handshake:
the server receives the SYN packet and must confirm the client’s SYN. At the same time, it also sends a SYN packet, that is, the SYN+ACK packet. At this time, the server enters the SYN_RECV state. The third handshake: the client
receives The SYN+ACK packet of the server sends a confirmation packet ACK to the server. After the packet is sent, the client and the server enter the ESTABLISHED (TCP connection is successful) state and complete the three-way handshake.
- The function of the sequence number of the sent packet, and the law of generation and change
During the communication between the server and the client, after the three-way handshake is completed, the connection is established, and the client starts to transmit the data sent to the server. The confirmation sequence number of the packet is the first data byte sequence number expected to be received from the other party's next message segment. It is generated from the beginning of data transmission, and the sequence number is the previous confirmation sequence number plus the length of the previous packet.
- Analyze data for three transfers of the same file
As can be seen from the figure below, the total length of the file remains unchanged at 16936 bytes, and the division scales of the three transmissions are 1, 1460 and 3000 respectively. The corresponding number of split blocks is also gradually decreasing, and the number of data blocks transmitted by the network first increases and then decreases. But the overall efficiency is still the same
| serial number | file segmentation scale | file length | Number of file division blocks | Number of data blocks transferred over the network | File Transfer Network Bandwidth Efficiency |
|---|---|---|---|---|---|
| 1 | 1 | 16936 | 16936 | 16 | 16936/x*100%=98.5% |
| 2 | 1460 | 16936 | 12 | 22 | 16936/x*100%=98.5% |
| 3 | 3000 | 16936 | 6 | 17 | 16936/x*100%=98.5% |
7. Experimental summary
- This experiment environment needs two computers to simulate the data transmission between the client and the receiving end, and requires the Server.exe and Client.exe provided by the teacher and the transmission file textbook.txt. The steps are also simple and easy to understand. You need to set the capture conditions in wireshark and open it first, and then query the network IP addresses of the two computers. Be careful to operate under the same network segment. First open Server.exe on one computer and set the port number, then open Client.exe with the command line on another computer and add the IP address and port number of the server, and after uploading the file, wireshark can capture the corresponding the bag.
- This experiment focuses on the analysis of the TCP protocol, check the TCP three-way handshake and the TCP four-way handshake in wireshark, and understand the process. In the TCP three-way handshake connection, both parties need to confirm that the connection has been established before the connection is considered successful.
When a connection is required, the client sends a request to the server. After receiving the request, the server will indicate to the client that it has received the request. After receiving the confirmation message, the client will also send a confirmation to the server to indicate the end; during the TCP four-way handshake disconnection, First, the client thinks that the request is sent and sends a disconnection request to the server. After receiving it, the server releases the response to the client. After sending all the data, the server sends a release request to the client, and finally the client sends a request to the client. The server sends a confirmation response, and if there is no resend request, it closes; after the server confirms the response, it also closes. - Summary: Through this experiment, I basically understand the process of TCP's three-way handshake and four-way handshake, and can analyze the data of TCP's connection disconnection capture packet. In the experiment, non-TCP packets also appeared. At this time, we need to write "tcp" in the upper filter to filter non-TCP packets.