實(shí)驗(yàn)五-使用Wireshark分析TCP協(xié)議

實(shí)驗(yàn)五使用Wireshark分析TCP協(xié)議―、實(shí)驗(yàn)?zāi)康姆治鯰CP協(xié)議二、實(shí)驗(yàn)環(huán)境與因特網(wǎng)連接的電腦，操作系統(tǒng)為Windows,安裝有Wireshark、IE等軟件。三、實(shí)驗(yàn)步驟1、捕獲一個(gè)從你電腦到遠(yuǎn)程服務(wù)器的TCP數(shù)據(jù)打開FTP客戶端，連接，用叮CP”為過濾條件，捕獲建立連接和斷開連接的數(shù)據(jù)。￡二抒1血1-.-tlWRr.-?沁.■打L⑵-Bl[faE血也.CvtuFA^^3曲SmbCf-T曲pho此lackJiumak由導(dǎo)。典.?j盡a)t去\+lr2[Q)asi??a岑回刁孫aSditevOntinHhDnPValacDlL?nq4:^iFc5IL26367WID022^.181,111641^21LB1111.§9014^10口ICkM-珀.2陽(yáng)￡二抒1血1-.-tlWRr.-?沁.■打L⑵-Bl[faE血也.CvtuFA^^3曲SmbCf-T曲pho此lackJiumak由導(dǎo)。典.?j盡a)t去\+lr2[Q)asi??a岑回刁孫aSditevOntinHhDnPValacDlL?nq4:^iFc5IL26367WID022^.181,111641^21LB1111.§9014^10口ICkM-珀.2陽(yáng)lS2.L6a.L.L<MB11.552272000W.W.K■1ft11,網(wǎng)285的口口510192.1L6&.1.10020li.60+15900010.10.^.2502S1虹我10.1^.19.250l?2.1L6a.i.i<X)2711.G翊BTO0W.W.B8..2S02?11612r95WD1010jg.250飲.Lsa1i?j3111.珀的g503111.6151^1000ICkllCkM.?對(duì)ccofs.thelisting.洶?L&1Him辱IL而3741。"1駝.]■楣?L■54擊王'料;1011.肱？1§2.WM1.10DIO-ICl抽.若。14IL5■隊(duì)的村口?！圾r?L6乳L(zhǎng)■■■■■■I192.16S.1.100BM—|NL1L凱#打知DU19W.Iffl；?L迎。1。IQjgjjjgmZLQ風(fēng)碰3011.迎。10.10.1^.250IL面?！薄昝鳌?。1010J9.25Q116053^9000lQa10.19.259im:waiiw192.m1L1XJ■a.TanvL.￡0541M001^2.lte.?1.1^03211.61;531000l1?^.1€&-1.1<10121175^11520001^2.l€B-L.LdOILMQSaFDQ1DL0jg.25011.624433WDID.10.19.250掐11.6244皿00503911-624494410010.10.J9.250網(wǎng)的。1，L1崩1NDIL5WT4OOO1010J9.25011.$7*的的gID.ig.39.Z50WM?UL11L的iCi.iO.33.2Ki6&七2?5目：?S21L[5'用]38-<1Win?，「■N…：重，，…?『?、?|:?￥43*割喧geEkfgPT>>f*.Paci￡U.2770ts(5小佰1(54.5...Pnrfta:3411.6M4170DD192.16&.1.1001010.1^.2503511^1944MQQ192.1^.1.10010.10.3-9.2^im:wa11(XJ192.Lfia.l.LCC]1900InterfaceIdsCJEncap￡u1a.tiontype:EthemietCl)ArrivalTime:Oct2BPMH16:3&:4￡.122$&0000IUEJJJJJJJJBJJJJJ[Tine-shiftforthisoatk^tssD.IXJiMOiMiMsecond-s]?oftp>62953IXk]5e(j=3BAck=lfiiwin=5fi4(JL-en=Q

Response:33-1Pl<aas^s&ecifythepassword.功服west:任AT■69Response:2Ll-Fe-aturts:■61Reso(W5?：時(shí)OTM說(shuō)盹duert:n>eA=B4*審IHMiw:WOO無(wú)tx>ASCIIiwxi』5口日迎心L.能5211>fi2?9S4[SYN.MIC]Seq-iQAdk-1Uin-SNlDLcn-0MSS-14&0SAC〔1〕連接建立:TCP連接通過稱為三次握手的三條報(bào)文來(lái)建立的。觀察以上數(shù)據(jù)，其中分組10到12顯示的就是三次握手。第一條報(bào)文沒有數(shù)據(jù)的TCP報(bào)文段〔分組10〕，

并將首部SYN位設(shè)置為1。因此，第一條報(bào)文常被稱為SYN分組。這個(gè)報(bào)文段里的序號(hào)可以設(shè)置成任何值，表示后續(xù)報(bào)文設(shè)定的起始編號(hào)。連接不能自動(dòng)從1開始計(jì)數(shù)，選擇一個(gè)隨機(jī)數(shù)開始計(jì)數(shù)可防止將以前連接的分組錯(cuò)誤地解釋為當(dāng)前連接的分組。觀察分組10，Wireshark顯示的序號(hào)是0。選擇分組首部的序號(hào)字段，原始框中顯示“為8edlf5”。Wireshark顯示的是邏輯序號(hào)，真正的初始序號(hào)不是0。如圖所示:Dn^in^iEn3-IL2636TODD220.1B1L1164192.1^1LL(KI1111.5W14&C1DDID-IQ.jg.250UU.592272AMHIIflLAOfl■I■192_16a.1.LOO13ILfiDZaS&CiPD10L0192.L61L1(X5C17iljgjgjgggi泥，i鍋」LDn^in^iEn3-IL2636TODD220.1B1L1164192.1^1LL(KI1111.5W14&C1DDID-IQ.jg.250UU.592272AMHIIflLAOfl■I■192_16a.1.LOO13ILfiDZaS&CiPD10L0192.L61L1(X5C17iljgjgjgggi泥，i鍋」Ljggm,m.：w?W54a說(shuō).碩了偵0l^Z.Ma-L.LCTU.59447400010.|0?38.250IL5孫卸的g1010.39.250JtEP^riihark1.1GJ：^VNRjnEMMfram/trjnl-S.iOj]1211.5^]1-32^001如.1配詢1O.OOMMMD1^?,166-1.1001IHIILIIIL-dLIUII；sFlags:0x02(Don'tFuflw財(cái)Hagnerrtoffset:0NaTm?EjIk:CapnjraSqkgcs*T出滴q進(jìn)Jackjnumat-申Ipc<?X■□強(qiáng)揮念ttp[R51,ACK_5cq-lAck-1Win-DLen-fl?E—I?AllM■■■TTl飛虹皿in192.L6B.1.100224.U1.L11.64TCP541011.5a?l^M0Q192.1^8.1.1001010.W.2M)TCP礪fi295：iafit[5YN]5M=1Ack=2L-en=Q60ftp>&2553LACK]Scq=3flAck=l^Win=5fl4<lLcn=O我：331口膈命更：&唯匚十村山色password.77Resows^:230LMinsuccessfulDSource:L-92.1&S.1.1UOItB.L.IdU)oestiriaticrij10.10.3^.250[10.103-9-250](SourceGeoIP：Unksoiw]jpest,臉tdm聞[p好町頃]s|TraDsw1ss1c?icontrolprotocol,Sourceport:6295JC&295JJ□e±tiin3.tianiport:ftp[21}[SCre-aninde-^:2]Siequencemurrhitr:0(re-1aliveiequencenunfasr)Headerlenoch:32BFlagsJ(JkOOZ[5VN)QQQ....0...CL.a.o.=fteserv^d:Kit5?t.=Monee:hetset.■CongestiotiWindhwReducied(Cui?):Matset.■ECN-Echo:Matset.■Urgient:Watset,.Acknawledgnenit:NotsetWindw&ij：evalue:F-T-hIMj-irirtkiwSYN分組通常是從客戶端發(fā)送到服務(wù)器。這個(gè)報(bào)文段請(qǐng)求建立連接。一旦成功建立了連接，服務(wù)器進(jìn)程必須已經(jīng)在監(jiān)聽SYN分組所指示的IP地址和端口號(hào)。如果沒有建立連接，SYN分組將不會(huì)應(yīng)答。如果第一個(gè)分組喪失，客戶端通常會(huì)發(fā)送假設(shè)干SYN分組，否則客戶端將會(huì)停止并報(bào)告一個(gè)錯(cuò)誤給應(yīng)用程序。如果服務(wù)器進(jìn)程正在監(jiān)聽并接收到來(lái)的連接請(qǐng)求，它將以一個(gè)報(bào)文段進(jìn)行相應(yīng)，這個(gè)報(bào)文段的SYN位和ACK位都置為1。通常稱這個(gè)報(bào)文段為SYNACK分組。SYNACK分組在確認(rèn)收到SYN分組的同時(shí)發(fā)出一個(gè)初始的數(shù)據(jù)流序號(hào)給客戶端。

att-i-dy^i:nuxuj：-Cuuiiili-r■dijiim,att-i-dy^i:nuxuj：-Cuuiiili-r■dijiim,il.jFr-agnenitaffiiet:DTinetolive:￡2PratDCDl:TCP(6}“Meaderch-ecks-un:物4駒4[correct]Swrce：10.ia.39.Z50(10.10.3?.250)Oestinatiohs1泥，168,1.100(1?2.l&B.ln10D)[SaiirceGeoIP:U^hiONn][DestinatiEffiiGcdIP:Unknrni]^tai.Twn?SmrER□ntanrisen["tdIdedILin^h^iFc192..U4.11(H)zzv.m.m.64TCP網(wǎng)址網(wǎng)3Ahttu[ftSTpACK]iM=l抵虹1州n=@Len^Ja11.263i&7WDD220.1^1.111641鴕gELLLgTCPflDhttp>[FIN.ACK]&eq=l^=k=lr*1n=&DL?n=O911.2637*100022^.Ifil.111.^4KP54址外了>時(shí)止[XKJ5&q=lAck=ZL?n=Qioii.sa-guMoo1.1001D.1D.J9.2MlilZP€6€2551>ftp[^rM]5eq-0Nin-^ll-92Len-0MS&-U&0WS-i5ACK_PEF^-1111,$9014舶0。10,10,19.2501^2.16B.1.14X1TCP戚6ftp>62&53[SYN,ACK]S*q-0Ack-1Len-0FSS-1460泌K1211.5&01^2000192.1招D.10.1^.25CITEP54^2951>ftp[ACK.]5eq-lAcic-ltain-657(l0Lhi-01111,5^227200010.10.^.250FTPResponse;220WelcofietaVsstSoftftpServer1411.593&B3JOOO90ID.10.1*9.250FTP^9deoueit:USERdmrfnoad1L5%4FA加。11.59*606000ID.10.3-9.250ID.10.3-9.250nz.m.i.iw152.16S.1.1WTCPFTPfiOftp=■62953[^CK]駐卜北Ack=l€*1n=5朋ULd&n=D￡8能即5只：311PMm巽s^c^fy1thepassword.1711.595900000ISS.lfiB.1.10010.10.^.250FTP￡5Request:PASSusstiaii.fioaasMoo501^2.16ft.L.L<X1FTP77Response:22dLog-insuctitssful-tS..i-i5v/tEfa￡jfc^4nCapCuraydy]白Soccdcs-Tdtaphd畦lackJimrrattNt。與It■,kiMwsijevalu-e:5840M5e7If川w-inr^rwE”-￡昭口1Swja財(cái)匚宅皿奶巳「：D〔「elall尖E?）u財(cái)wnw由巳「）Acknwledgnentnuvher:1(rel-ativeacknunberj-Hfraderlength:12b/tesTran^ni玷ionControlPratacalrEreFart:ftpQ2町「D&tPort:&2951C62S51)PSeq:0,Ack:lrLen:DSourceport:ftp(.21)Destinationports?2953tfi2551)[E&am切如引2]HUjnj.=fttserMTd:wotkiMwsijevalu-e:5840M5e7If川w-inr^rwE”-￡昭口1Swja財(cái)匚宅皿奶巳「：D〔「elall尖E?）u財(cái)wnw由巳「）Acknwledgnentnuvher:1(rel-ativeacknunberj-Hfraderlength:12b/tes■■如、?.■優(yōu)此DO340000肺g3已怵46W血血27l=acD“DOM01&*g15f5曲的Be妲找BO12ooao16do刑曲國(guó)00JFixoTm■■如、?.■■>JJSacMdnoarumt^r(Dqp.E4q|,4郵足PackdU.3h0主1￡I5i：5l.*...Pii/ta:圖5.3邏輯序號(hào)與實(shí)際初始序號(hào)（分組11）分組11確實(shí)認(rèn)號(hào)字段在Wireshark的協(xié)議框中顯示1,并且在原始框中的值是“9b8ed1f6”〔比“9b8ed1f5"多1〕。這解釋了TCP確實(shí)認(rèn)模式。TCP接收端確認(rèn)第X個(gè)字節(jié)已經(jīng)收到，并通過設(shè)置確認(rèn)號(hào)為X+1來(lái)說(shuō)明期望收到下一個(gè)字節(jié)號(hào)。分組11的序號(hào)字段在Wireshark的協(xié)議顯示為0，但在原始框中的實(shí)際值卻是“f674a5ea”。這說(shuō)明TCP連接的雙方會(huì)選擇數(shù)據(jù)流中字節(jié)的起始編號(hào)。所有初始序號(hào)邏輯上都視同為序號(hào)0。最后，客戶端發(fā)送帶有標(biāo)志ACK的TCP報(bào)文段，而不是帶SYN的報(bào)文段來(lái)完成三次握手的過程。這個(gè)報(bào)文段將確認(rèn)服務(wù)器發(fā)送的SYNACK分組，并檢查TCP連接的兩端是否正確打開合運(yùn)行?！?〕關(guān)閉連接當(dāng)兩端交換帶有FIN標(biāo)志的TCP報(bào)文段并且每一端都確認(rèn)另一端發(fā)送的FIN包時(shí)，TCP連接將會(huì)關(guān)閉。FIN位字面上的意思是連接一方再也沒有更多新的數(shù)據(jù)發(fā)送。然而，那些重傳的數(shù)據(jù)會(huì)被傳送，直到接收端確認(rèn)所有的信息。通過分組43,44和54,55我們可以看到TCP連接被關(guān)閉?！鮪bnancn5215,7022^100010,10,19.2501,1003411LM明1罰QQ1如斑」L四Qm，m齡歪典gigjjgggg1如.1如ill。。idds的.若“5315,丁WW3OT?！鮪bnancn5215,7022^100010,10,19.2501,1003411LM明1罰QQ1如斑」L四Qm，m齡歪典gigjjgggg1如.1如ill。。idds的.若“5315,丁WW3OT。19L1楣，LMO頃1口」風(fēng)泗Seq-1635Ack-2祝in■勺麗DLen-0I92.i*a..i.icci1^2.16ft.1.IMlS2.166.1.ji?l1^2.16ft.1.IM§3魔巳鄰g碇：150Herecone&WedirectarvImmg-1514FTPData:227FTPData:FTPFTP-MTFTF-DAT4011.62*434000501W?L"]L1<MTCPfiO52L1>62954[FIN.4111.^24-1760001?001010.3-9.250TCP弱宛如4A5211[ACK]4ZU.6Z45(JMDD19?L5&二?如BJ.lD.3fl.25CKP5462953>ftp(*￡K]三192.145J￡2§54>5211[FIN,11.62O5OWOO5011.6344^0010.10.J-9.250鳩11.￡24434ODDID.1G.J9.25C13911.E244WNMl10.10.^.2505415.702732ODO5055is,Zggngggg19L肝4H」加■■:TWiW淑TWIiKmTITOTE115.239.21D.151■皿jwami依—l：HW血115.139210.1518242.1MZ<J(MOD192.1fi&1.1(JD51Bl42LIL碇4知奶192.16&l.W115.2392ID.151E442.116317000100ZZO.m.Ul.64崩42.11617MDD1咬.-L.LdD22d.LfiL.LlL.64~19-2.Lfift.l.LOO5615.70^2000507942".115^3￡0022<1.1H1.112.122IftpA鼠953倬IL拭引5^=3洵Mk=F4*1n=5MQLs#1??]=H33的盤gQ54碇953aftp[MK]SeqpFSAck=3燈臨訕55帶品區(qū)*0IQmM2知Ack-75Win-5840Lten^60Ftp:?62&52[AC211HrTP/1.1200gS?]=lAcfc：=lm1r=16471Ack-1Win-DLan'Respwnst;221(iMdbye-]E=1心=1MnTLendJ笑<]=1Ark=lz1n=QII財(cái)5eFrane12:54bytesonnire(412bits),54bytescaptured(43Zbits)oniniterfaceD-EthernetII,Ere:AsustekCbl:b2:2-a(50:46:5d:bl:b2:2-a),Dst:Tp-LinkT2d:51:?6(dfi:5d:4c:2d:51:76).rateiEEtrpiirt^cifiigEi而虬.「匚iiMLimli_MoncESg~MK-i-mD■astrnMmrMTNiarCTii-iflnaBCNiaaTr-an2.ni±5iDnCantralPratacalrEreFart:62*95J(62-952)rDstPort:ftp[21)rEeq:&SrAck:116rLen:O圖5.4TCP連接關(guān)閉2、TCP重傳當(dāng)一個(gè)TCP發(fā)送端傳輸一個(gè)報(bào)文段的同時(shí)也設(shè)置了一個(gè)重傳計(jì)時(shí)器。當(dāng)確認(rèn)到達(dá)時(shí)，這個(gè)計(jì)時(shí)器就自動(dòng)取消。如果在數(shù)據(jù)確實(shí)認(rèn)信息到達(dá)之前這個(gè)計(jì)時(shí)器超時(shí)，那么數(shù)據(jù)就會(huì)重傳。重傳計(jì)時(shí)器能夠自動(dòng)靈活設(shè)置。最初TCP是基于初始的SYN和SYNACK之間的時(shí)間來(lái)設(shè)置重傳計(jì)時(shí)器的。它基于這個(gè)值多次設(shè)置重傳計(jì)時(shí)器來(lái)防止不必要的重傳。在整個(gè)TCP連接中，TCP都會(huì)注意每個(gè)報(bào)文段的發(fā)送和接到相應(yīng)確實(shí)認(rèn)所經(jīng)歷的時(shí)間。TCP在重傳數(shù)據(jù)之前不會(huì)總是等待一個(gè)重傳計(jì)算器超時(shí)。TCP也會(huì)把一系列重復(fù)確認(rèn)的分組當(dāng)作是數(shù)據(jù)喪失的征兆。（1）SACK選項(xiàng)協(xié)商在上面的每次跟蹤中，我們能觀察建立連接的三次握手。在SYN分組中，發(fā)送端在TCP的首部選項(xiàng)中通過包括SACKpermitted選項(xiàng)來(lái)希望使用TCPSACK。在SYNACK包中接收端表示愿意使用SACK。這樣雙方都同意接收選擇性確認(rèn)信息。SACK選項(xiàng)如圖所示:FlimizpE|的》用笄匚虹吠期泅/iSto.Tim.SdltehOnrirKhnn[*tdIdedIL*n^:jiFcISTTfifiTlTlOO4FCFSq62-M7>http[R^T,ACK：&eq-lAck-2用in-#Len-^llFlimizpE|的》用笄匚虹吠期泅/iSto.Tim.SdltehOnrirKhnn[*tdIdedIL*n^:jiFcISTTfifiTlTlOO4FCFSq62-M7>http[R^T,ACK：&eq-lAck-2用in-#Len-^ll42.1^12460001^2.1.10022(1.1^1.112.122HTTP^50GET/i/nsc/1istefi?user-57fe&c616e6d5fi6i6tllCiaCtjac?&_13找勺聆19快5742.151J22<lOO1紋.1翎.虹詞口22^.141.111.64TCP￡6￡2455>http[SVN]Seq-4urindl典LeTNSS-WW。蠟-4SACKJERM1￡8妃?19]33駒口011.10022^.1C1.Ill.>6>1TCP礪宛956>hitlp[S^JS&q=OMil(1=8192Li&nc=D械55=1牯Q柘=4SACL_P€RM4Z.22^3^00l?Z.m1.1CTTCP碰Hit切>fi2955[SN?MK]Seq=QAck=lrfi0=^192L^n=O國(guó)55=14網(wǎng)柘=I卯152.1C&.1.M022^.1C1.111.?4TCP弱宛955=■hit(o[ME]5e?i=lA￡k=liiiln=66176L-erv=DI.-：:p.p:ipr^O/imlwk3.10J性部RwS1Q-344rnmiHrur^dJlgC6http:-fi29S&[￡VN,A￡K]￡?-<]Ack-1Win-&ig2Len-0MSS-14DS9142.22752100022d.151.111.649242.22SCifiMC?022d.M虬112.122?0htW:-[ACK]Seq-154節(jié)n?lMLcn^DJ枇rHl,帝LlTCFRe：Krari!SET*i第42.274MJOffl)22fl.lBl.lll.549642.27459400022fl.1?1.111.641如.]m」LL<XIIJZ.lfi&.l.lW即httpn成％6[ACK]seq=lAck=9flW帶m=F6BD3脆HE7L1NOD<M(GIFS#熟7:?ht^p[ACK]Seq?lAck?：l■&54{TB且就『叫m詁5[mlITCP^etrans^iissio^54flK#斯色與$1onLE如HKi例明1如LL傾Q103447156F-40C0―1擔(dān)門碰LEdMndwvsize叫1典：SL92(CaloulateJF引的部size:B192]e>Ch^tk&un!fvalidatiofldisabledlEiND-Oper-atian(NOP)?iftindciffscales2(nunt1plyg4〕fflM&-0pH&rat1on-[)W)?NO-0|>er5t1MEW)ETCPSACKPeirnifitedOptiani：True115.239210.151220.LB1111.^4藥:■-http[1PCFEiekrafisii~i：ST1口丘]Leni-OSei>"4Arfc-15€Q=1Mk=l圖5.5SACK選項(xiàng)在TCPSACK選項(xiàng)中，如果連接的一端接收了失序數(shù)據(jù)，它將使用選項(xiàng)區(qū)字段來(lái)發(fā)送關(guān)于失序數(shù)據(jù)起始和結(jié)束的信息。這樣允許發(fā)送端僅僅重傳喪失的數(shù)據(jù)。TCP接收端不能傳遞它們接收到的失序數(shù)據(jù)給處于等待狀態(tài)的應(yīng)用程序，因?yàn)樗偸莻鬟f有序數(shù)據(jù)。因此，接收到的失序數(shù)據(jù)要么被丟掉，要么被存儲(chǔ)起來(lái)。接收端的存儲(chǔ)空間是有限的，TCP發(fā)送端必須保存一份已發(fā)送的數(shù)據(jù)的副本，以防止數(shù)據(jù)需要重發(fā)。發(fā)送端必須保存數(shù)據(jù)直到它們收到數(shù)據(jù)確實(shí)認(rèn)信息為止。接收端通常會(huì)分配一個(gè)固定大小的緩沖區(qū)來(lái)存儲(chǔ)這些失序數(shù)據(jù)和需要等待一個(gè)應(yīng)用程序讀取的數(shù)據(jù)。如果緩沖區(qū)空間不能容納下更多數(shù)據(jù)，那么接收端只有將數(shù)據(jù)丟棄，即使它是成功到達(dá)的。接收端的通知窗口字段用來(lái)通知發(fā)送端還有多少空間可以用于輸入數(shù)據(jù)。如果數(shù)據(jù)發(fā)送的速度快于應(yīng)用程序處理數(shù)據(jù)的速度，接收端就會(huì)發(fā)送一些信息來(lái)告知發(fā)送端其接收窗口正在減小。在這個(gè)跟蹤文件中，接收端通知窗口的大小是變化的，從16520個(gè)字節(jié)到17520個(gè)字節(jié)。TCP發(fā)送端在發(fā)送之前有一個(gè)容納數(shù)據(jù)的有限空間。然而，和接收端不同的是，發(fā)送端是限制自己的發(fā)送速率。如果緩沖區(qū)的空間滿了，嘗試寫入更多數(shù)據(jù)的應(yīng)用程序?qū)⒈蛔枞钡接懈嗟目臻g可以利用為止。〔2〕分組的喪失與重傳用顯示過濾器搜索重傳。3.3DJi.SW\firn31*3344-nm|Hrur4cllD；JEtaEdK：僵.,g.bCapnimjSroWSocxdos-TAtaphanyJactJnumafcyatOIla」□?￡胡、中。-書鼻旦回jaARtilhJGFill*]ICprWMhskfHlSmk叔早EJ￥>iH<ionB1匚岫^AfcJw'SWfNaTanvfairerOntin^janF^dIdcdIL?n^h^nTcmmmm?115TCP54[T-CFRietrwi5iwi&5ian]mins>http[FINPAO]S?q-1Adk-1Win-1493424156fl3fl00002MTCP斑g>TntOHNTaCKJs^q=lACk=lrt1ii=l*1W*3.010637000ixz.m1.1W115.Z39.J1O.151TCP54iTCffiecraflsinssToiiT如目典>忒心5tq=lAck=l1<J1*1.015619000152.163-1.10D2MTCP541KP(ie(fiwswiss1o{iil砒g拖>St牛1Ack=lwin=lf10741.2106^0019Z.lfiB_l.100115-Z39.I1O.151TCP54[TCPfiecransnisslQft]>IlCtp[FlNrft€M]segl^i:=lidnf=M10B-44.21567^(100192.L6S-1.100-1B1.111.64TCP54[T€FRetransni^sian]叫46hStp[FINrlJUCSC]Scq-lAcfc-lIdini-lild9i4&.?10747a0D192.l€6_1.10D115-23S-21O.151TCP54[1T-EPRe^r-an5nis5ian]幻94口http[-n<AOC]Scq-1Ack-1Win-Li11046.tl57i65OOO192.16ft.1.1002寸_1?1.111.64TCP54[T€FRetransni^sian]￡2-946fttpIFLiWSC]Scq-1Acfc-l136■*&弟施々ODD1KI■14^.132.1&4KF5*IrcpRetrflnsnissioni]而蹲JBhttp[FIN.iMIKl5tq=lAck=lwin=l?13748^23947300192.1651.1001EKJ-14?.132.ia4TCP54[TCPftecraMisniisioo]SHIS>http[FIN.5eq=lAck=l*-in=lf1394&^590130001W.145.132.1341?2■1踞lal<MItfTTlP21?(TCP^e(raflsnissionilunp/l.l2(M?1414?523MM00192.1651.1001EKJ-14?.132.ia4TCP54ITCPfteifiwswiisicHiil>jig[可磚隊(duì)??.?r1荷：1■■頃W14?4?.52394M00nz.iea-i.iao103.U5-132.104TCP54[TCPfietraiiEnisElan]6391?>Tktjj[FlNrACKJSe?=lAcfc=lNln=l?14^SO.723936000堀_14^-132.184TCP54[TCPRetransni^sian]http[FINrACK]&eq-lAdk-1Win-Li14450.724.013400192.L?S.1.100也.1419.132.164TCP54[TO1Re^r-Eun5ni&5ian]的tpj/uAOC]Seq-1Adk-1Win-Li14551.407944^00192.16S.1.1Q051TCP54[TCPRetransni^sian]"R田卻[fiiMtACK]&eq-lAdk-1Win-Li14651415942000192.1^8.1.100220TCP54[rcrRetransnitsionijhttp[FINfc5€Q=1Aci：=lWin=l*1*?51.1Z+Q3MQQ1陽(yáng)1礎(chǔ)I.IOD1WTCP541TCP^eifiwsw^ssionil可咨34h<tikiN,^：H；J&eq=lAcK=lMin=H15051IZ^MMOO152.163-1.1W13fl-145.132.134TCP541TCPfiecfaflsiiiissloniljjgjg心)5et=lAdc=lwln=l?15457,9的22腳QQ1陽(yáng)1礎(chǔ)I.IOD1WTCP54ITCP^eifiwsw^ssionil址§珥下茹［區(qū)1土??r1M?:1，頃,:i15557.^26^1000192.LCB.1.10DIM-U9-132.164TCP54[TCPC￡trafiEni&EiDnJ也:MJ9Tietp[FiNrMIK.Seq-1Acfe-lriin-lfW103.436-92fi0M192.1￡S.1.1002網(wǎng).141.111.￡4TCP54[T-CFRetr-an5ni&5ian]戚網(wǎng)55http[FIN.ACK]Scq-1Acik-lWin-&6209104.036^61000192.L€S-1.LUO220-M1-JL11.刮TCP54[1T-EPRe：trafiEni&5ion]62955httpACK]Seq-1Acfc-1Nin-&6212lC'5.236-9&aCiM192.1€6-1.1<10~-151-l.ll.fi4TCP54[T-CFRetr-an5ni&5ian]皿55"jig[fi』AOC]Seq-1Acfc-1Nin-&6215107627(16^0001^2.1^8.1.1(10TCPS4(TO脂Hartw社!sioo]碇955Tril：「LW<]只牛1Ack=iiJin.=M■Frane47:54bytessmwire(432bits),54bytiM,captunedCJ3?bits)oninterficieD-EthernetII.5「lA5MstckC_bl;b2-2a世以；5d;hli;b2;M)?D5t;Tp-LinkT_2d;51;5d;4c;2d;51;?61InternetPnrtBCOlVersionL5rc:192?HB.1.1W(0?pDst：115.Z39.2MLianil5.239.Z10.151)?TransHisfiiofiCwit^lP^tocol,.5rcPo「n宛948*294寺hPstP-ort^htos(3Q),鈕明L*ck:1(L*enc5的DO四5d4c2d5176SO仙Sdblb22aDfi0445DO.ILhQvpf]..*?.E.MIODO的3?ec4。003D0600WCD郵016473ef.(9.9雨?(XJ20如f5e4M50e*5743+0境曲035011P..函對(duì)，.P.M擁4057如aeDOg■堂fFtai七修a明wflJ/urAPAil血口訴甲pcapn..-PjcIae卻)iDufb^d:S...Pr^fla:DAuk:圖5.6TCP的重傳通過觀察分組的序號(hào)、確認(rèn)號(hào)的變化，研究重傳行為。四、實(shí)驗(yàn)報(bào)告內(nèi)容在實(shí)驗(yàn)的基礎(chǔ)上，答復(fù)以下問題:1.客戶服務(wù)器之間用于初始化TCP連接的TCPSYN報(bào)文段的序號(hào)〔sequencenumber〕是多少？在該報(bào)文段中，是用什么來(lái)標(biāo)識(shí)該報(bào)文段是SYN報(bào)文段的？Sequencenumber是1SynsetFCP!p-^?frp[s/rj]win-?!^Le>DN55-14WMS-1TEval-^TSect-0￡*：K-flEFM-Ll11=?(■就枷汕u海Ilv.22FCPl11=?(■就枷汕u海Ilv.22j.a口禎101猊57■,玷ZLZ1ZQZ.1W.222.71ZLZZQ.gTFQWCCi1D.1G.37.397173is.707.*1?.232.71a24g.57.3S2125G.S7S53H0202.1?.222.71212Gfi.87S??3--<iiu_16.57.3am?fi.S&nffiU202.1H.222.71Z12B6.海KdW1U_16.57.3S￡12:9?S.202.1W.222.71ZL3DS鑫1口:?M煎ID.IG.J7.3Sa31^8^L333Q&.ZOZ.m.ZZZiTlZL32ifi.10-1?!-J7.30ZL33iS.Sc-l^dLiZCiZDZ.lZfl.Z22.71ZLMi51?.5K!3C<]in,liSB]7.35ZSLSS6.SS*141l<I2112.1：^.222.71：lShiu-ih-5r.插1U.1D.5-.j-5Z^.U^.ZZZoTlJ7.2HZD2.L2O.2ZZ.71ID.ia.57.3D.ue.232.Z1IL.16.5?.3a2CQ.Ue.222.71-2ffl.ue.222.7BZD2i12$i2ZZ.7157.30ZD2.L2Q.22Z.7137>^HZD2i12$i2ZE.71IL.16.57.SB202.124.332.71g需MgHgEFTP需ftpftpmDR?x5.u￡1T-rJE4pfsiE!-Jwr-a￡l-ltlr--.Ls3Asp-5y?1EFupQs■F-TwTTT5T?5-TwT應(yīng)T幻斜*嵩x^x[XK]?三flick-1Len-0TSt-r-OGs?域ESeri'C"v3.7.S(Bulls?24)ready.>STPDniTKi.^pj'E'EVsrdrequ-lrmd-forjnanynaus.ussF日nctiyniiuwloggsdIn.iiTfSOfiCLHTrirST.Lf?MT即吧；L9helpHohelpmailable'/■七CMrreiTttflrecitr/.lyj宜SdfEEA-rswaii-QT§ecr?uSjCK-PEF「“日J(rèn)llfi!70b>1-KOft>h1fA(&24blTSi),7Bb>l*5C^^ui'dil[融」L>lTW)QH1nT-Si'Tl-ZiUell'llTrieii.apesU'llyarj_Ta!7b!W(00*21!M=rj.=7ta=bD).dct:FUjldnsO-fi!b4：A5QMila!aDsl￡!b4!cEi)Ime-necPrcrcuzolwslonS*71總噸Tr405^*55innControlP「et5sLSreF^rt;brlp-<!口L<1)fDrtRctt-ftp(El)iSsq-C*PLen;PSorceport;fcrlp-1?(41El)Inartinnport