1. TCP Protocol Analysis
Access UMKC Home Page

2. How do we capture packets?
Use a hardware protocol analyzer.
Expensive, complex.
Use a software protocol analyzer
Tie into network protocol stack
Capture packets based on some filter
Pcap.lib, tcpdump
Present the packet data to the user in a readable format
Many programs available: Ethereal -> Wireshark
cs423-cotter

3. 2/24/2019
UMKC Home Page
cs423-cotter
cs423-cotter

4. Ethereal Filter
cs423-cotter

5. TCP (First syn)
cs423-cotter

6. TCP (Second syn + ack)
cs423-cotter

7. TCP (Second ack)
cs423-cotter

8. TCP (First packet – HTTP request)
2/24/2019
TCP (First packet – HTTP request)
cs423-cotter
cs423-cotter

9. TCP (ack for first data packet)
2/24/2019
TCP (ack for first data packet)
cs423-cotter
cs423-cotter

10. 2/24/2019
UMKC Home Page (2008)
cs423-cotter
cs423-cotter

11. TCP – IP info (First syn)
2/24/2019
TCP – IP info (First syn)
cs423-cotter
cs423-cotter

12. 2/24/2019
TCP (First syn)
cs423-cotter
cs423-cotter

13. 2/24/2019
TCP (Second syn + ack)
cs423-cotter
cs423-cotter

14. 2/24/2019
TCP (Second ack)
cs423-cotter
cs423-cotter

15. TCP (First packet – HTTP request)
2/24/2019
TCP (First packet – HTTP request)
cs423-cotter
cs423-cotter

16. ACK + TCP segment data
2/24/2019
cs423-cotter
cs423-cotter

17. 2/24/2019
Reassembled Packet
cs423-cotter
cs423-cotter

18. 2/24/2019
UMKC Home Page (1/2012)
cs423-cotter
cs423-cotter

19. UMKC Home Page (9/2012)
cs423-cotter

20. 2/24/2019
Summary
TCP is a complex protocol, but tools are available to analyze it.
Client / Server Programs are widely used.
Analysis of the protocols (at all layers) can lead to a greater understanding of how the applications work.
cs423-cotter
cs423-cotter