1 / 19

TCP Protocol Analysis

TCP Protocol Analysis. Access UMKC Home Page. Slides provided by Bob Cotter, updated by Shuai Zhao. UMKC Home Page. Ethereal Filter. TCP (First syn). TCP (Syn+Ack). TCP (Second ack). TCP (First packet – HTTP request). TCP (ack for first data packet). TCP – IP info. Ethernet Frame.

scoates
Download Presentation

TCP Protocol Analysis

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. TCP ProtocolAnalysis Access UMKC Home Page Slides provided by Bob Cotter, updated by Shuai Zhao

  2. UMKC Home Page

  3. Ethereal Filter

  4. TCP (First syn)

  5. TCP (Syn+Ack)

  6. TCP (Second ack)

  7. TCP (First packet – HTTP request)

  8. TCP (ack for first data packet)

  9. TCP – IP info

  10. Ethernet Frame

  11. Reassembled Packet

  12. Follow TCP Stream

  13. tcpdump on Linux • On Windows: WinDump • Using LibPacp library as Wireshark • Run tcpdump as root

  14. tcpdump basic usage • sudo tcpdump –nnvvSdst 134.193.116.82 • sudo tcpdump –vvS dst 134.193.116.82 • sudo tcpdump –i any/eth0/en0

  15. Look for traffic based on host name/protocol/ip block/port • sudo tcpdump host www.umkc.edu • sudo tcpdump icmp/ip • sudo tcpdump 192.168.0.0/24 • sudo tcpdump port 80 • combination using “and” • sudo tcpdump srcip port x.x.x.x and dstip y.y.y.y

  16. tcpdump write/read • tcpdump –w filename • tcpdump –r captured file

  17. Using wireshark read saved tcpdump file

  18. Summary • TCP is a complex protocol, but tools are available to analyze it. • Client / Server Programs are widely used. • Analysis of the protocols (at all layers) can lead to a greater understanding of how the applications work.

More Related