TCP Protocol Analysis Access UMKC Home Page
How do we capture packets? Use a hardware protocol analyzer. Expensive, complex. Use a software protocol analyzer Tie into network protocol stack Capture packets based on some filter Pcap.lib, tcpdump Present the packet data to the user in a readable format Many programs available: Ethereal -> Wireshark cs423-cotter
2/24/2019 UMKC Home Page cs423-cotter cs423-cotter
Ethereal Filter cs423-cotter
TCP (First syn) cs423-cotter
TCP (Second syn + ack) cs423-cotter
TCP (Second ack) cs423-cotter
TCP (First packet – HTTP request) 2/24/2019 TCP (First packet – HTTP request) cs423-cotter cs423-cotter
TCP (ack for first data packet) 2/24/2019 TCP (ack for first data packet) cs423-cotter cs423-cotter
2/24/2019 UMKC Home Page (2008) cs423-cotter cs423-cotter
TCP – IP info (First syn) 2/24/2019 TCP – IP info (First syn) cs423-cotter cs423-cotter
2/24/2019 TCP (First syn) cs423-cotter cs423-cotter
2/24/2019 TCP (Second syn + ack) cs423-cotter cs423-cotter
2/24/2019 TCP (Second ack) cs423-cotter cs423-cotter
TCP (First packet – HTTP request) 2/24/2019 TCP (First packet – HTTP request) cs423-cotter cs423-cotter
ACK + TCP segment data 2/24/2019 cs423-cotter cs423-cotter
2/24/2019 Reassembled Packet cs423-cotter cs423-cotter
2/24/2019 UMKC Home Page (1/2012) cs423-cotter cs423-cotter
UMKC Home Page (9/2012) cs423-cotter
2/24/2019 Summary TCP is a complex protocol, but tools are available to analyze it. Client / Server Programs are widely used. Analysis of the protocols (at all layers) can lead to a greater understanding of how the applications work. cs423-cotter cs423-cotter