Ethereal network protocol analysis

Network address planning table:

Configuration: Open Computer adapters, double-click the network adapter you access the Internet, view the details, look under which subnets, open (TCP / IPV4) property, to pull modify their ip, subnet mask, default gateway and dns server.

 

Connectivity Test

Ping Baidu www.baidu.com can ping, Internet

 

Use wireshark to www.baidu.com website http protocol packet capture analysis

           

 

HTTP request from the request line, the first request, and the request content blank line 4 parts.

 

http request line

 

 

Field request method: GET

URL field: /

Protocol version: HTTP / 1.1

http request header

 

Accept: the client can identify the list of content types in response; asterisk * range used by the packet type. * / * Represents a pharmaceutically all types, type / * Indicates that all subtypes of type type.

Accept-Language: Client acceptable natural language

User-Agent: generating a browser-type request

Accept-Encoding: Client pharmaceutically compression format encoding: gzip

Host: host name of the request: www.baidu.com

connection: Connection: Keep-Alive

 

OK HTTP response message from the state, in response to the first, blank lines, and in response to contents of the four parts. 

http status line

 

HTTP status line protocol version: HTTP / 1.1

Status code: 302

Status code Description: Found

 

http response header

 

Connection: Connection: Keep-Alive

Location: the server back to the client, used to redirect to www.baidu.com

Server: server software used to process information requests: Bws and version information: 1.1

 

Open eye teeth live, Ethereal to analyze the application layer

 

 

 

TCP three-way handshake protocol

 

 

The first handshake

 

 

SYN=1

seq=x=0

 

Zi secondary handshake

 

 

SYN = 1, ACK = 1

ack=0+1=1

seq=y=0

 

Third handshake

 

ACK=1

seq=1

acc = y + 1 = 1

 

TCP protocol fourth wave

 

 

Zi once waved

 

FIN = 1, SYN = 1

seq=u=1

 

The second wave

 

ACK=1

seq=v=1

ack = u + 1 = 2

 

 

Third Wave

FINE = 1, ACK = 1

seq=w

ack=1

 

Fourth Wave

 

 

ACK=1

seq=1

ack=w+1=2

 

 UDP protocol packet capture analysis

 

 

 

Source port number: 53529

Destination port number: 8000

UDP length: 47

UDP checksum: 0x038c

 

IP protocol packet analysis

 

 

Version number: 4 header length: 20 bytes service type: 0x00 General Service Total Length: 49

Identification: 0xa6fa flag: fragment offset 0x4000: 0

Survival time: 128 protocols: TCP header checksum: 0xef18

Source IP address: 192.168.43.149

Destination IP Address: 211.228.75.160

 

       ARP protocol packet analysis:

 

 

 

Destination MAC address: 28: c6: 3f: fa: f8: 02

Source MAC address: fa: c3: 9e: 4e: 05: ed

Protocol Type: ARP

Hardware Type: ethernet

Protocol Type: IPv4 Hardware address length: 6 protocol address length: 4

Operation Type: request, indicating that the message type is an ARP request

Sender hardware address: fa: c3: 9e: 4e: 05: ed

The sender IP address: 192.168.43.1

Target Hardware Address: 00:00: 00:00: 00, represents a broadcast address

The purpose protocol address: 192.168.43.159

 

ICMP protocol packet analysis

 

 

 

 

 

Type: 8 Code: 0 Checksum: 0x4491

MAC frame format:

 

The first row represents the number 1043, line 336 bytes, 336 bytes actually captured.

Frame Number: 1043 indicates the frame number

Packet Length: 42 bytes represents the frame length

Capture Length: 42 bytes indicates the length of the capture

Frame is marked: False indicates whether the frame is made Tags: No

Protocols in frame: eth: ethertype: arp indicates the protocol hierarchy frame package

 

 

MAC address analysis

 

The destination MAC address: fa: c3: 9e: 4e: 05: ed

Source MAC Address: 28: c6: 3f: fa: f8: 02

Type: ARP

Guess you like

Origin www.cnblogs.com/linhaozuishuai/p/11794243.html