TCP window Full
2016-01-12 13:15
519 查看
TCP window full, 是指的发送端发送的数据已经达到的接受窗口的上限。继而停止发送，等待新的接收窗口的通告。
发生TCPwindow Full
的情况分析，下面得包是抓取的FTP的streamflow. 当时的情况是正在发生在客户端上传文件到服务器。
本地主机：146.11.2.87
远端服务器：147.128.6.103
1，
首先看第28406个包，服务器通告本段Ack=166441
Win=43800，即window size 43800,
下一个想要的序号为166441.
2，
接下来看第28407个包，Sequencenumber: 208781 (relative sequencenumber) [Next sequence number:210241 (relative sequence number)]
本端客户端发送208781 ~210241 共1460个字节。为什么就发生TCPwindow Full
了呢？
从第28406个包我们客户端知道服务器期待166441序号，windowsize为43800
那么166441+ 43800 = 210241
，所以客户端发送了第28406个包，即序号达到210241，就认为服务器接受端窗口已满，并停止发包。
3，
客户端只又收到28408个包之后，收到服务器端新的窗口通告，然后又开始发送新的包。
接下来的28414个包，产生了windowsize full的情况，可以用同样的方法分析。
No. Time Source Destination Protocol Length Info
28403 357.584211000
146.11.2.87 147.128.6.103
FTP-DATA 1514 FTP Data: 1460 bytes
Frame 28403: 1514 bytes on wire (12112 bits), 1514 bytescaptured (12112 bits) on interface 0
Ethernet II, Src: HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a), Dst:Cisco_30:90:40 (c8:9c:1d:30:90:40)
Internet Protocol Version 4, Src: 146.11.2.87 (146.11.2.87),Dst: 147.128.6.103 (147.128.6.103)
Transmission Control Protocol, Src Port: 60432 (60432), DstPort: 35461 (35461), Seq: 205861, Ack: 1, Len: 1460
Source Port: 60432(60432)
Destination Port:35461 (35461)
[Stream index:217]
[TCP Segment Len:1460]
Sequence number:
205861 (relative sequence number)
[Next sequencenumber:
207321 (relative sequence number)]
Acknowledgment number:1 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:32768
[Calculated windowsize: 4194304]
[Window sizescaling factor: 128]
Checksum: 0x9e9b[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
FTP Data (ed to as Source Routed Frames, that have\nbeenreceived from this port'ssegment.\000\000\000\000\253\000\000\000\a\000\000\000\000\000\000\000\000\000\000\000\001\000\000\000(\000\000\000\000\000\000\000\000\000\000\000\016\377\
No. Time Source Destination Protocol Length Info
28404357.584224000
146.11.2.87 147.128.6.103 FTP-DATA 1514 FTP Data: 1460 bytes
Frame 28404: 1514 bytes on wire (12112 bits), 1514 bytescaptured (12112 bits) on interface 0
Ethernet II, Src: HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a),Dst: Cisco_30:90:40 (c8:9c:1d:30:90:40)
Internet Protocol Version 4, Src: 146.11.2.87 (146.11.2.87),Dst: 147.128.6.103 (147.128.6.103)
Transmission Control Protocol, Src Port: 60432 (60432), DstPort: 35461 (35461), Seq: 207321, Ack: 1, Len: 1460
Source Port: 60432(60432)
Destination Port:35461 (35461)
[Stream index:217]
[TCP Segment Len:1460]
Sequence number:207321 (relative sequence number)
[Next sequencenumber: 208781 (relative sequencenumber)]
Acknowledgmentnumber: 1 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:32768
[Calculated windowsize: 4194304]
[Window sizescaling factor: 128]
Checksum: 0xfe65[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
FTP Data (1460 bytes data)
No. Time Source Destination Protocol Length Info
28405357.584266000 147.128.6.103 146.11.2.87 TCP 60 35461→60432[ACK] Seq=1 Ack=163521 Win=46720 Len=0
Frame 28405: 60 bytes on wire (480 bits), 60 bytes captured(480 bits) on interface 0
Ethernet II, Src: Cisco_30:90:40 (c8:9c:1d:30:90:40), Dst:HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a)
Internet Protocol Version 4, Src: 147.128.6.103(147.128.6.103), Dst: 146.11.2.87 (146.11.2.87)
Transmission Control Protocol, Src Port: 35461 (35461), DstPort: 60432 (60432), Seq: 1, Ack: 163521, Len: 0
Source Port: 35461(35461)
Destination Port:60432 (60432)
[Stream index:217]
[TCP Segment Len:0]
Sequence number:1 (relative sequence number)
Acknowledgmentnumber: 163521 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:46720
[Calculated windowsize: 46720]
[Window sizescaling factor: 1]
Checksum: 0xe733[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
No. Time Source Destination Protocol Length Info
28406357.584299000
147.128.6.103
146.11.2.87 TCP 60 35461→60432[ACK] Seq=1 Ack=166441 Win=43800 Len=0
Frame 28406: 60 bytes on wire (480 bits), 60 bytes captured(480 bits) on interface 0
Ethernet II, Src: Cisco_30:90:40 (c8:9c:1d:30:90:40), Dst:HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a)
Internet Protocol Version 4, Src: 147.128.6.103(147.128.6.103), Dst: 146.11.2.87 (146.11.2.87)
Transmission Control Protocol, Src Port: 35461 (35461), DstPort: 60432 (60432), Seq: 1, Ack: 166441, Len: 0
Source Port: 35461(35461)
Destination Port:60432 (60432)
[Stream index:217]
[TCP Segment Len:0]
Sequence number:1 (relative sequence number)
Acknowledgmentnumber: 166441 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:43800
[Calculated windowsize: 43800]
[Window sizescaling factor: 1]
Checksum: 0xe733[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
No. Time Source Destination Protocol Length Info
28407357.584315000 146.11.2.87 147.128.6.103 FTP-DATA 1514
[TCP Window Full] FTPData: 1460 bytes
Frame 28407: 1514 bytes on wire (12112 bits), 1514 bytescaptured (12112 bits) on interface 0
Ethernet II, Src: HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a),Dst: Cisco_30:90:40 (c8:9c:1d:30:90:40)
Internet Protocol Version 4, Src: 146.11.2.87 (146.11.2.87),Dst: 147.128.6.103 (147.128.6.103)
Transmission Control Protocol, Src Port: 60432 (60432), DstPort: 35461 (35461), Seq: 208781, Ack: 1, Len: 1460
Source Port: 60432(60432)
Destination Port:35461 (35461)
[Stream index:217]
[TCP Segment Len:1460]
Sequence number: 208781 (relative sequence number)
[Next sequence number: 210241 (relative sequence number)]
Acknowledgmentnumber: 1 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:32768
[Calculated windowsize: 4194304]
[Window sizescaling factor: 128]
Checksum: 0x5bf6[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
FTP Data (1460 bytes data)
No. Time Source Destination Protocol Length Info
28408
357.584328000 147.128.6.103 146.11.2.87 TCP 60 35461→60432[ACK] Seq=1 Ack=169361 Win=48180 Len=0
Frame 28408: 60 bytes on wire (480 bits), 60 bytes captured(480 bits) on interface 0
Ethernet II, Src: Cisco_30:90:40 (c8:9c:1d:30:90:40), Dst:HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a)
Internet Protocol Version 4, Src: 147.128.6.103(147.128.6.103), Dst: 146.11.2.87 (146.11.2.87)
Transmission Control Protocol, Src Port: 35461 (35461), DstPort: 60432 (60432), Seq: 1, Ack: 169361, Len: 0
Source Port: 35461(35461)
Destination Port:60432 (60432)
[Stream index:217]
[TCP Segment Len:0]
Sequence number:1 (relative sequence number)
Acknowledgmentnumber: 169361 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:48180
[Calculated windowsize: 48180]
[Window sizescaling factor: 1]
Checksum: 0xcaaf[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
No. Time Source Destination Protocol Length Info
28409357.584691000 146.11.2.87 147.128.6.103 FTP-DATA 1514 FTP Data: 1460 bytes
Frame 28409: 1514 bytes on wire (12112 bits), 1514 bytescaptured (12112 bits) on interface 0
Ethernet II, Src: HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a),Dst: Cisco_30:90:40 (c8:9c:1d:30:90:40)
Internet Protocol Version 4, Src: 146.11.2.87 (146.11.2.87),Dst: 147.128.6.103 (147.128.6.103)
Transmission Control Protocol, Src Port: 60432 (60432), DstPort: 35461 (35461), Seq: 210241, Ack: 1, Len: 1460
Source Port: 60432(60432)
Destination Port:35461 (35461)
[Stream index:217]
[TCP Segment Len:1460]
Sequence number:210241 (relative sequence number)
[Next sequence number:211701 (relative sequence number)]
Acknowledgmentnumber: 1 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:32768
[Calculated windowsize: 4194304]
[Window size scalingfactor: 128]
Checksum: 0xee3b[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
FTP Data (1460 bytes data)
No. Time Source Destination Protocol Length Info
28410357.584714000 146.11.2.87 147.128.6.103 FTP-DATA 1514 FTP Data: 1460 bytes
Frame 28410: 1514 bytes on wire (12112 bits), 1514 bytescaptured (12112 bits) on interface 0
Ethernet II, Src: HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a), Dst:Cisco_30:90:40 (c8:9c:1d:30:90:40)
Internet Protocol Version 4, Src: 146.11.2.87 (146.11.2.87),Dst: 147.128.6.103 (147.128.6.103)
Transmission Control Protocol, Src Port: 60432 (60432), DstPort: 35461 (35461), Seq: 211701, Ack: 1, Len: 1460
Source Port: 60432(60432)
Destination Port:35461 (35461)
[Stream index:217]
[TCP Segment Len:1460]
Sequence number:211701 (relative sequence number)
[Next sequencenumber: 213161 (relative sequencenumber)]
Acknowledgment number:1 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:32768
[Calculated windowsize: 4194304]
[Window sizescaling factor: 128]
Checksum: 0x5ceb[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
FTP Data (at is associated with thistransparent\nbridge.\000Dot1dTpPortEntry\000\000\000\000y\000\000\000d\000\000\000h\000\000\000\001\000\000\000\001\000\000\000(\000\000\000\000\000\000\000\000\000\000\000\f\377\377\377\377Alist
of in
No. Time Source Destination Protocol Length Info
28411357.584753000 147.128.6.103 146.11.2.87 TCP 60 35461→60432 [ACK] Seq=1 Ack=172281Win=45260 Len=0
Frame 28411: 60 bytes on wire (480 bits), 60 bytes captured(480 bits) on interface 0
Ethernet II, Src: Cisco_30:90:40 (c8:9c:1d:30:90:40), Dst:HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a)
Internet Protocol Version 4, Src: 147.128.6.103(147.128.6.103), Dst: 146.11.2.87 (146.11.2.87)
Transmission Control Protocol, Src Port: 35461 (35461), DstPort: 60432 (60432), Seq: 1, Ack: 172281, Len: 0
Source Port: 35461(35461)
Destination Port:60432 (60432)
[Stream index:217]
[TCP Segment Len:0]
Sequence number:1 (relative sequence number)
Acknowledgmentnumber: 172281 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:45260
[Calculated windowsize: 45260]
[Window sizescaling factor: 1]
Checksum: 0xcaaf[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
No. Time Source Destination Protocol Length Info
28412357.584776000 146.11.2.87 147.128.6.103 FTP-DATA 1514 FTP Data: 1460 bytes
Frame 28412: 1514 bytes on wire (12112 bits), 1514 bytescaptured (12112 bits) on interface 0
Ethernet II, Src: HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a),Dst: Cisco_30:90:40 (c8:9c:1d:30:90:40)
Internet Protocol Version 4, Src: 146.11.2.87 (146.11.2.87),Dst: 147.128.6.103 (147.128.6.103)
Transmission Control Protocol, Src Port: 60432 (60432), DstPort: 35461 (35461), Seq: 213161, Ack: 1, Len: 1460
Source Port: 60432(60432)
Destination Port:35461 (35461)
[Stream index:217]
[TCP Segment Len:1460]
Sequence number:213161 (relative sequence number)
[Next sequencenumber: 214621 (relative sequencenumber)]
Acknowledgmentnumber: 1 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:32768
[Calculated windowsize: 4194304]
[Window sizescaling factor: 128]
Checksum: 0x3f38[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
FTP Data (1460 bytes data)
No. Time Source Destination Protocol Length Info
28413357.584788000 146.11.2.87 147.128.6.103 FTP-DATA 1514 FTP Data: 1460 bytes
Frame 28413: 1514 bytes on wire (12112 bits), 1514 bytescaptured (12112 bits) on interface 0
Ethernet II, Src: HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a),Dst: Cisco_30:90:40 (c8:9c:1d:30:90:40)
Internet Protocol Version 4, Src: 146.11.2.87 (146.11.2.87),Dst: 147.128.6.103 (147.128.6.103)
Transmission Control Protocol, Src Port: 60432 (60432), DstPort: 35461 (35461), Seq: 214621, Ack: 1, Len: 1460
Source Port: 60432(60432)
Destination Port:35461 (35461)
[Stream index:217]
[TCP Segment Len:1460]
Sequence number:214621 (relative sequence number)
[Next sequencenumber: 216081 (relative sequencenumber)]
Acknowledgmentnumber: 1 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:32768
[Calculated windowsize: 4194304]
[Window sizescaling factor: 128]
Checksum: 0x6aec[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
FTP Data ( the bridge for which there is no\notherapplicable entry.\000\000\000\003\231\000\000\000\002\000\000\000\000\000\000\000\002\000\000\000\001\000\000\000(\000\000\000\000\000\000\000\000\000\000\000\f\377\377\377\377Theset
of p
No. Time Source Destination Protocol Length Info
28414
357.584805000 146.11.2.87 147.128.6.103 FTP-DATA1514 [TCP Window Full] FTP Data: 1460bytes
Frame 28414: 1514 bytes on wire (12112 bits), 1514 bytescaptured (12112 bits) on interface 0
Ethernet II, Src: HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a),Dst: Cisco_30:90:40 (c8:9c:1d:30:90:40)
Internet Protocol Version 4, Src: 146.11.2.87 (146.11.2.87),Dst: 147.128.6.103 (147.128.6.103)
Transmission Control Protocol, Src Port: 60432 (60432), DstPort: 35461 (35461), Seq: 216081, Ack: 1, Len: 1460
Source Port: 60432(60432)
Destination Port:35461 (35461)
[Stream index:217]
[TCP Segment Len:1460]
Sequence number:216081 (relative sequence number)
[Next sequencenumber: 217541 (relative sequence number)]
Acknowledgmentnumber: 1 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:32768
[Calculated windowsize: 4194304]
[Window sizescaling factor: 128]
Checksum: 0x2022[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
FTP Data (e next reset\n of the bridge.\n deleteOnReset(4) - this entry is currentlyin\n use and will remain sountil the next\n reset of thebridge.\n deleteOnTimeout(5)
- thisentry is currently\n
No. Time Source Destination Protocol Length Info
28415357.584816000 147.128.6.103 146.11.2.87 TCP 60 35461→60432 [ACK] Seq=1 Ack=175201Win=49640 Len=0
Frame 28415: 60 bytes on wire (480 bits), 60 bytes captured(480 bits) on interface 0
Ethernet II, Src: Cisco_30:90:40 (c8:9c:1d:30:90:40), Dst:HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a)
Internet Protocol Version 4, Src: 147.128.6.103(147.128.6.103), Dst: 146.11.2.87 (146.11.2.87)
Transmission Control Protocol, Src Port: 35461 (35461), DstPort: 60432 (60432), Seq: 1, Ack: 175201, Len: 0
Source Port: 35461(35461)
Destination Port:60432 (60432)
[Stream index:217]
[TCP Segment Len:0]
Sequence number:1 (relative sequence number)
Acknowledgmentnumber: 175201 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:49640
[Calculated windowsize: 49640]
[Window sizescaling factor: 1]
Checksum: 0xae2b[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
发生TCPwindow Full
的情况分析，下面得包是抓取的FTP的streamflow. 当时的情况是正在发生在客户端上传文件到服务器。
本地主机：146.11.2.87
远端服务器：147.128.6.103
1，
首先看第28406个包，服务器通告本段Ack=166441
Win=43800，即window size 43800,
下一个想要的序号为166441.
2，
接下来看第28407个包，Sequencenumber: 208781 (relative sequencenumber) [Next sequence number:210241 (relative sequence number)]
本端客户端发送208781 ~210241 共1460个字节。为什么就发生TCPwindow Full
了呢？
从第28406个包我们客户端知道服务器期待166441序号，windowsize为43800
那么166441+ 43800 = 210241
，所以客户端发送了第28406个包，即序号达到210241，就认为服务器接受端窗口已满，并停止发包。
3，
客户端只又收到28408个包之后，收到服务器端新的窗口通告，然后又开始发送新的包。
接下来的28414个包，产生了windowsize full的情况，可以用同样的方法分析。
No. Time Source Destination Protocol Length Info
28403 357.584211000
146.11.2.87 147.128.6.103
FTP-DATA 1514 FTP Data: 1460 bytes
Frame 28403: 1514 bytes on wire (12112 bits), 1514 bytescaptured (12112 bits) on interface 0
Ethernet II, Src: HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a), Dst:Cisco_30:90:40 (c8:9c:1d:30:90:40)
Internet Protocol Version 4, Src: 146.11.2.87 (146.11.2.87),Dst: 147.128.6.103 (147.128.6.103)
Transmission Control Protocol, Src Port: 60432 (60432), DstPort: 35461 (35461), Seq: 205861, Ack: 1, Len: 1460
Source Port: 60432(60432)
Destination Port:35461 (35461)
[Stream index:217]
[TCP Segment Len:1460]
Sequence number:
205861 (relative sequence number)
[Next sequencenumber:
207321 (relative sequence number)]
Acknowledgment number:1 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:32768
[Calculated windowsize: 4194304]
[Window sizescaling factor: 128]
Checksum: 0x9e9b[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
FTP Data (ed to as Source Routed Frames, that have\nbeenreceived from this port'ssegment.\000\000\000\000\253\000\000\000\a\000\000\000\000\000\000\000\000\000\000\000\001\000\000\000(\000\000\000\000\000\000\000\000\000\000\000\016\377\
No. Time Source Destination Protocol Length Info
28404357.584224000
146.11.2.87 147.128.6.103 FTP-DATA 1514 FTP Data: 1460 bytes
Frame 28404: 1514 bytes on wire (12112 bits), 1514 bytescaptured (12112 bits) on interface 0
Ethernet II, Src: HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a),Dst: Cisco_30:90:40 (c8:9c:1d:30:90:40)
Internet Protocol Version 4, Src: 146.11.2.87 (146.11.2.87),Dst: 147.128.6.103 (147.128.6.103)
Transmission Control Protocol, Src Port: 60432 (60432), DstPort: 35461 (35461), Seq: 207321, Ack: 1, Len: 1460
Source Port: 60432(60432)
Destination Port:35461 (35461)
[Stream index:217]
[TCP Segment Len:1460]
Sequence number:207321 (relative sequence number)
[Next sequencenumber: 208781 (relative sequencenumber)]
Acknowledgmentnumber: 1 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:32768
[Calculated windowsize: 4194304]
[Window sizescaling factor: 128]
Checksum: 0xfe65[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
FTP Data (1460 bytes data)
No. Time Source Destination Protocol Length Info
28405357.584266000 147.128.6.103 146.11.2.87 TCP 60 35461→60432[ACK] Seq=1 Ack=163521 Win=46720 Len=0
Frame 28405: 60 bytes on wire (480 bits), 60 bytes captured(480 bits) on interface 0
Ethernet II, Src: Cisco_30:90:40 (c8:9c:1d:30:90:40), Dst:HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a)
Internet Protocol Version 4, Src: 147.128.6.103(147.128.6.103), Dst: 146.11.2.87 (146.11.2.87)
Transmission Control Protocol, Src Port: 35461 (35461), DstPort: 60432 (60432), Seq: 1, Ack: 163521, Len: 0
Source Port: 35461(35461)
Destination Port:60432 (60432)
[Stream index:217]
[TCP Segment Len:0]
Sequence number:1 (relative sequence number)
Acknowledgmentnumber: 163521 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:46720
[Calculated windowsize: 46720]
[Window sizescaling factor: 1]
Checksum: 0xe733[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
No. Time Source Destination Protocol Length Info
28406357.584299000
147.128.6.103
146.11.2.87 TCP 60 35461→60432[ACK] Seq=1 Ack=166441 Win=43800 Len=0
Frame 28406: 60 bytes on wire (480 bits), 60 bytes captured(480 bits) on interface 0
Ethernet II, Src: Cisco_30:90:40 (c8:9c:1d:30:90:40), Dst:HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a)
Internet Protocol Version 4, Src: 147.128.6.103(147.128.6.103), Dst: 146.11.2.87 (146.11.2.87)
Transmission Control Protocol, Src Port: 35461 (35461), DstPort: 60432 (60432), Seq: 1, Ack: 166441, Len: 0
Source Port: 35461(35461)
Destination Port:60432 (60432)
[Stream index:217]
[TCP Segment Len:0]
Sequence number:1 (relative sequence number)
Acknowledgmentnumber: 166441 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:43800
[Calculated windowsize: 43800]
[Window sizescaling factor: 1]
Checksum: 0xe733[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
No. Time Source Destination Protocol Length Info
28407357.584315000 146.11.2.87 147.128.6.103 FTP-DATA 1514
[TCP Window Full] FTPData: 1460 bytes
Frame 28407: 1514 bytes on wire (12112 bits), 1514 bytescaptured (12112 bits) on interface 0
Ethernet II, Src: HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a),Dst: Cisco_30:90:40 (c8:9c:1d:30:90:40)
Internet Protocol Version 4, Src: 146.11.2.87 (146.11.2.87),Dst: 147.128.6.103 (147.128.6.103)
Transmission Control Protocol, Src Port: 60432 (60432), DstPort: 35461 (35461), Seq: 208781, Ack: 1, Len: 1460
Source Port: 60432(60432)
Destination Port:35461 (35461)
[Stream index:217]
[TCP Segment Len:1460]
Sequence number: 208781 (relative sequence number)
[Next sequence number: 210241 (relative sequence number)]
Acknowledgmentnumber: 1 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:32768
[Calculated windowsize: 4194304]
[Window sizescaling factor: 128]
Checksum: 0x5bf6[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
FTP Data (1460 bytes data)
No. Time Source Destination Protocol Length Info
28408
357.584328000 147.128.6.103 146.11.2.87 TCP 60 35461→60432[ACK] Seq=1 Ack=169361 Win=48180 Len=0
Frame 28408: 60 bytes on wire (480 bits), 60 bytes captured(480 bits) on interface 0
Ethernet II, Src: Cisco_30:90:40 (c8:9c:1d:30:90:40), Dst:HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a)
Internet Protocol Version 4, Src: 147.128.6.103(147.128.6.103), Dst: 146.11.2.87 (146.11.2.87)
Transmission Control Protocol, Src Port: 35461 (35461), DstPort: 60432 (60432), Seq: 1, Ack: 169361, Len: 0
Source Port: 35461(35461)
Destination Port:60432 (60432)
[Stream index:217]
[TCP Segment Len:0]
Sequence number:1 (relative sequence number)
Acknowledgmentnumber: 169361 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:48180
[Calculated windowsize: 48180]
[Window sizescaling factor: 1]
Checksum: 0xcaaf[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
No. Time Source Destination Protocol Length Info
28409357.584691000 146.11.2.87 147.128.6.103 FTP-DATA 1514 FTP Data: 1460 bytes
Frame 28409: 1514 bytes on wire (12112 bits), 1514 bytescaptured (12112 bits) on interface 0
Ethernet II, Src: HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a),Dst: Cisco_30:90:40 (c8:9c:1d:30:90:40)
Internet Protocol Version 4, Src: 146.11.2.87 (146.11.2.87),Dst: 147.128.6.103 (147.128.6.103)
Transmission Control Protocol, Src Port: 60432 (60432), DstPort: 35461 (35461), Seq: 210241, Ack: 1, Len: 1460
Source Port: 60432(60432)
Destination Port:35461 (35461)
[Stream index:217]
[TCP Segment Len:1460]
Sequence number:210241 (relative sequence number)
[Next sequence number:211701 (relative sequence number)]
Acknowledgmentnumber: 1 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:32768
[Calculated windowsize: 4194304]
[Window size scalingfactor: 128]
Checksum: 0xee3b[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
FTP Data (1460 bytes data)
No. Time Source Destination Protocol Length Info
28410357.584714000 146.11.2.87 147.128.6.103 FTP-DATA 1514 FTP Data: 1460 bytes
Frame 28410: 1514 bytes on wire (12112 bits), 1514 bytescaptured (12112 bits) on interface 0
Ethernet II, Src: HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a), Dst:Cisco_30:90:40 (c8:9c:1d:30:90:40)
Internet Protocol Version 4, Src: 146.11.2.87 (146.11.2.87),Dst: 147.128.6.103 (147.128.6.103)
Transmission Control Protocol, Src Port: 60432 (60432), DstPort: 35461 (35461), Seq: 211701, Ack: 1, Len: 1460
Source Port: 60432(60432)
Destination Port:35461 (35461)
[Stream index:217]
[TCP Segment Len:1460]
Sequence number:211701 (relative sequence number)
[Next sequencenumber: 213161 (relative sequencenumber)]
Acknowledgment number:1 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:32768
[Calculated windowsize: 4194304]
[Window sizescaling factor: 128]
Checksum: 0x5ceb[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
FTP Data (at is associated with thistransparent\nbridge.\000Dot1dTpPortEntry\000\000\000\000y\000\000\000d\000\000\000h\000\000\000\001\000\000\000\001\000\000\000(\000\000\000\000\000\000\000\000\000\000\000\f\377\377\377\377Alist
of in
No. Time Source Destination Protocol Length Info
28411357.584753000 147.128.6.103 146.11.2.87 TCP 60 35461→60432 [ACK] Seq=1 Ack=172281Win=45260 Len=0
Frame 28411: 60 bytes on wire (480 bits), 60 bytes captured(480 bits) on interface 0
Ethernet II, Src: Cisco_30:90:40 (c8:9c:1d:30:90:40), Dst:HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a)
Internet Protocol Version 4, Src: 147.128.6.103(147.128.6.103), Dst: 146.11.2.87 (146.11.2.87)
Transmission Control Protocol, Src Port: 35461 (35461), DstPort: 60432 (60432), Seq: 1, Ack: 172281, Len: 0
Source Port: 35461(35461)
Destination Port:60432 (60432)
[Stream index:217]
[TCP Segment Len:0]
Sequence number:1 (relative sequence number)
Acknowledgmentnumber: 172281 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:45260
[Calculated windowsize: 45260]
[Window sizescaling factor: 1]
Checksum: 0xcaaf[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
No. Time Source Destination Protocol Length Info
28412357.584776000 146.11.2.87 147.128.6.103 FTP-DATA 1514 FTP Data: 1460 bytes
Frame 28412: 1514 bytes on wire (12112 bits), 1514 bytescaptured (12112 bits) on interface 0
Ethernet II, Src: HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a),Dst: Cisco_30:90:40 (c8:9c:1d:30:90:40)
Internet Protocol Version 4, Src: 146.11.2.87 (146.11.2.87),Dst: 147.128.6.103 (147.128.6.103)
Transmission Control Protocol, Src Port: 60432 (60432), DstPort: 35461 (35461), Seq: 213161, Ack: 1, Len: 1460
Source Port: 60432(60432)
Destination Port:35461 (35461)
[Stream index:217]
[TCP Segment Len:1460]
Sequence number:213161 (relative sequence number)
[Next sequencenumber: 214621 (relative sequencenumber)]
Acknowledgmentnumber: 1 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:32768
[Calculated windowsize: 4194304]
[Window sizescaling factor: 128]
Checksum: 0x3f38[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
FTP Data (1460 bytes data)
No. Time Source Destination Protocol Length Info
28413357.584788000 146.11.2.87 147.128.6.103 FTP-DATA 1514 FTP Data: 1460 bytes
Frame 28413: 1514 bytes on wire (12112 bits), 1514 bytescaptured (12112 bits) on interface 0
Ethernet II, Src: HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a),Dst: Cisco_30:90:40 (c8:9c:1d:30:90:40)
Internet Protocol Version 4, Src: 146.11.2.87 (146.11.2.87),Dst: 147.128.6.103 (147.128.6.103)
Transmission Control Protocol, Src Port: 60432 (60432), DstPort: 35461 (35461), Seq: 214621, Ack: 1, Len: 1460
Source Port: 60432(60432)
Destination Port:35461 (35461)
[Stream index:217]
[TCP Segment Len:1460]
Sequence number:214621 (relative sequence number)
[Next sequencenumber: 216081 (relative sequencenumber)]
Acknowledgmentnumber: 1 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:32768
[Calculated windowsize: 4194304]
[Window sizescaling factor: 128]
Checksum: 0x6aec[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
FTP Data ( the bridge for which there is no\notherapplicable entry.\000\000\000\003\231\000\000\000\002\000\000\000\000\000\000\000\002\000\000\000\001\000\000\000(\000\000\000\000\000\000\000\000\000\000\000\f\377\377\377\377Theset
of p
No. Time Source Destination Protocol Length Info
28414
357.584805000 146.11.2.87 147.128.6.103 FTP-DATA1514 [TCP Window Full] FTP Data: 1460bytes
Frame 28414: 1514 bytes on wire (12112 bits), 1514 bytescaptured (12112 bits) on interface 0
Ethernet II, Src: HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a),Dst: Cisco_30:90:40 (c8:9c:1d:30:90:40)
Internet Protocol Version 4, Src: 146.11.2.87 (146.11.2.87),Dst: 147.128.6.103 (147.128.6.103)
Transmission Control Protocol, Src Port: 60432 (60432), DstPort: 35461 (35461), Seq: 216081, Ack: 1, Len: 1460
Source Port: 60432(60432)
Destination Port:35461 (35461)
[Stream index:217]
[TCP Segment Len:1460]
Sequence number:216081 (relative sequence number)
[Next sequencenumber: 217541 (relative sequence number)]
Acknowledgmentnumber: 1 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:32768
[Calculated windowsize: 4194304]
[Window sizescaling factor: 128]
Checksum: 0x2022[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
FTP Data (e next reset\n of the bridge.\n deleteOnReset(4) - this entry is currentlyin\n use and will remain sountil the next\n reset of thebridge.\n deleteOnTimeout(5)
- thisentry is currently\n
No. Time Source Destination Protocol Length Info
28415357.584816000 147.128.6.103 146.11.2.87 TCP 60 35461→60432 [ACK] Seq=1 Ack=175201Win=49640 Len=0
Frame 28415: 60 bytes on wire (480 bits), 60 bytes captured(480 bits) on interface 0
Ethernet II, Src: Cisco_30:90:40 (c8:9c:1d:30:90:40), Dst:HewlettP_d1:6a:5a (34:64:a9:d1:6a:5a)
Internet Protocol Version 4, Src: 147.128.6.103(147.128.6.103), Dst: 146.11.2.87 (146.11.2.87)
Transmission Control Protocol, Src Port: 35461 (35461), DstPort: 60432 (60432), Seq: 1, Ack: 175201, Len: 0
Source Port: 35461(35461)
Destination Port:60432 (60432)
[Stream index:217]
[TCP Segment Len:0]
Sequence number:1 (relative sequence number)
Acknowledgmentnumber: 175201 (relative ack number)
Header Length: 20bytes
.... 0000 00010000 = Flags: 0x010 (ACK)
Window size value:49640
[Calculated windowsize: 49640]
[Window sizescaling factor: 1]
Checksum: 0xae2b[validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
内容来自用户分享和网络整理，不保证内容的准确性，如有侵权内容，可联系管理员处理 
相关文章推荐
- TCP版backshell的VBS脚本代码
- TCP Wrappers防火墙介绍与封锁IP地址的方法
- c语言多进程tcp服务器示例
- win2003连接限制TCP连接限制
- PowerShell脚本开发之收发TCP消息包
- Nodejs创建TCP服务器 - king0222
- C#实现TCP连接信息统计的方法
- linux shell 脚本实现tcp/upd协议通讯(重定向应用)
- Android TCP 文件客户端与服务器DEMO介绍
- Android中实现TCP和UDP传输实例
- python实现可将字符转换成大写的tcp服务器实例
- php实现TCP端口检测的方法
- Java实现Socket的TCP传输实例
- 实现了基于TCP的Java Socket编程实例代码
- Java基于Tcp协议的socket编程实例
- python实现TCP服务器端与客户端的方法详解
- python检测远程服务器tcp端口的方法
- python实现简单的TCP代理服务器
- nginx搭建tcp代理服务器
- python网络编程之TCP通信实例和socketserver框架使用例子