解析 TCP segment headers
TCP headers 包含源/目标 ports, 序列 numbers, flags, 和 window 大小. Learn 到解码 TCP headers 为网络分析.
- 1
TCP 头是 20-60 bytes. Fields: 源端口 (2 bytes), dest 端口 (2 bytes), 序列数字 (4), acknowledgment 数字 (4), 数据 offset + flags (2), window 大小 (2), checksum (2), urgent pointer (2), options (0-40). Flags: SYN, ACK, FIN, RST, PSH, URG, ECE, CWR.
- 2 十六进制解码器 →
解码 the hex representation of a TCP header. The first 4 bytes are source and destination ports. For example, 0x0050 is port 80 (HTTP). Decode each field according to its offset and size.
- 3 二进制解码器 →
解码 the flags byte in binary. Each bit represents a flag: FIN (0x01), SYN (0x02), RST (0x04), PSH (0x08), ACK (0x10), URG (0x20). SYN+ACK = 0x12 = 00010010 in binary. This reveals the connection state.
常见问题
- 什么 TCP flags mean?
- SYN: synchronize 序列 numbers (连接启动). ACK: acknowledgment 数字是 有效. FIN: 完成 (graceful close). RST: 重置 (abort 连接). PSH: push 数据 immediately. URG: urgent pointer 是有效. 组合的 flags indicates 连接阶段 (SYN, SYN-ACK, ACK 为 handshake).
- 什么是 TCP window 大小?
- 它 indicates 如何许多 bytes receiver 能够接受无 acknowledgment — flow control. larger window means higher 吞吐量 (更少 waiting 为 ACKs). Window 扩缩容 (RFC 7323) allows windows larger than 65535 通过 using 规模因子在 options.