Update
This commit is contained in:
@@ -0,0 +1,208 @@
|
||||
---
|
||||
tags: [network, protocol, theory, cs]
|
||||
create time: 2026-04-17 12:15
|
||||
---
|
||||
|
||||
# 网络协议分析基础
|
||||
|
||||
## 概述
|
||||
|
||||
网络协议分析是理解网络通信的核心技术，通过分析数据包的结构和内容，可以深入理解网络协议的工作原理和通信机制。
|
||||
|
||||
## 正文
|
||||
|
||||
### TCP 三次握手与四次挥手
|
||||
|
||||
#### 三次握手 (SYN, SYN-ACK, ACK)
|
||||
|
||||
```
|
||||
客户端 服务器
|
||||
| |
|
||||
| --- SYN, seq=x --------------------> |
|
||||
| |
|
||||
| <--- SYN, ACK, seq=y, ack=x+1 ------ |
|
||||
| |
|
||||
| --- ACK, seq=x+1, ack=y+1 ---------> |
|
||||
| | 连接建立
|
||||
```
|
||||
|
||||
**各字段含义：**
|
||||
- **SYN**: 同步标志，用于建立连接
|
||||
- **ACK**: 确认标志，表示确认收到
|
||||
- **seq**: 序列号，确保数据有序传递
|
||||
- **ack**: 确认号，表示期望收到的下一个序列号
|
||||
|
||||
**抓包特征：**
|
||||
1. 第一个包：SYN 标志位为 1，ACK 为 0
|
||||
2. 第二个包：SYN 和 ACK 都为 1
|
||||
3. 第三个包：ACK 为 1，SYN 为 0
|
||||
|
||||
#### 四次挥手 (FIN, ACK, FIN, ACK)
|
||||
|
||||
```
|
||||
客户端 服务器
|
||||
| |
|
||||
| --- FIN, seq=x --------------------> | 主动关闭
|
||||
| |
|
||||
| <--- ACK, seq=y, ack=x+1 ----------- |
|
||||
| | 半关闭
|
||||
| <--- FIN, seq=y ------------------- | 被动关闭
|
||||
| |
|
||||
| --- ACK, seq=x+1, ack=y+1 ---------> |
|
||||
| | 连接关闭
|
||||
```
|
||||
|
||||
**状态转换：**
|
||||
- FIN_WAIT_1: 主动关闭方发送 FIN
|
||||
- FIN_WAIT_2: 主动关闭方收到 ACK，等待对方 FIN
|
||||
- CLOSE_WAIT: 被动关闭方收到 FIN，进入半关闭状态
|
||||
- LAST_ACK: 被动关闭方发送 FIN
|
||||
- TIME_WAIT: 主动关闭方收到 FIN，等待 2MSL 后完全关闭
|
||||
|
||||
### HTTP 协议分析
|
||||
|
||||
#### 请求结构
|
||||
|
||||
```
|
||||
Method Request-URI HTTP-Version\r\n
|
||||
Header-Name: Header-Value\r\n
|
||||
\r\n
|
||||
Message-Body
|
||||
```
|
||||
|
||||
**常见方法：**
|
||||
- **GET**: 获取资源
|
||||
- **POST**: 提交数据
|
||||
- **PUT**: 更新资源
|
||||
- **DELETE**: 删除资源
|
||||
- **HEAD**: 获取响应头
|
||||
- **OPTIONS**: 获取支持的方法
|
||||
|
||||
**常用请求头：**
|
||||
```
|
||||
Host: example.com
|
||||
User-Agent: Mozilla/5.0
|
||||
Accept: text/html,application/json
|
||||
Content-Type: application/json
|
||||
Authorization: Bearer token
|
||||
Cookie: session=xxx
|
||||
```
|
||||
|
||||
#### 响应结构
|
||||
|
||||
```
|
||||
HTTP-Version Status-Code Reason-Phrase\r\n
|
||||
Header-Name: Header-Value\r\n
|
||||
\r\n
|
||||
Message-Body
|
||||
```
|
||||
|
||||
**状态码分类：**
|
||||
- **2xx**: 成功 (200 OK, 201 Created, 204 No Content)
|
||||
- **3xx**: 重定向 (301 Moved Permanently, 302 Found, 304 Not Modified)
|
||||
- **4xx**: 客户端错误 (400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found)
|
||||
- **5xx**: 服务器错误 (500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable)
|
||||
|
||||
**常用响应头：**
|
||||
```
|
||||
Content-Type: application/json; charset=utf-8
|
||||
Content-Length: 1234
|
||||
Cache-Control: max-age=3600
|
||||
ETag: "abc123"
|
||||
Set-Cookie: session=xxx; Path=/; HttpOnly
|
||||
```
|
||||
|
||||
### TLS/SSL 加密通信
|
||||
|
||||
#### TLS 握手流程
|
||||
|
||||
```mermaid
|
||||
sequenceDiagram
|
||||
participant C as 客户端
|
||||
participant S as 服务器
|
||||
|
||||
C->>S: ClientHello<br/>(支持的加密套件、随机数)
|
||||
S-->>C: ServerHello<br/>(选择的加密套件、随机数、证书)
|
||||
S-->>C: Certificate<br/>(服务器证书)
|
||||
S-->>C: ServerHelloDone
|
||||
|
||||
C->>S: ClientKeyExchange<br/>(预主密钥，用服务器公钥加密)
|
||||
C->>S: ChangeCipherSpec<br/>(通知后续使用加密通信)
|
||||
C->>S: Finished<br/>(握手完成，加密验证)
|
||||
|
||||
S-->>C: ChangeCipherSpec
|
||||
S-->>C: Finished
|
||||
|
||||
Note over C,S: 开始加密通信
|
||||
```
|
||||
|
||||
**关键概念：**
|
||||
- **证书链**: 从服务器证书到根证书的信任链
|
||||
- **预主密钥**: 通过非对称加密传输，用于生成会话密钥
|
||||
- **会话密钥**: 通过预主密钥和双方随机数生成，用于对称加密
|
||||
- **SSL Pinning**: 客户端验证服务器证书，防止中间人攻击
|
||||
|
||||
### 数据包分析要点
|
||||
|
||||
#### 抓包指标
|
||||
|
||||
**性能指标：**
|
||||
- **RTT (Round Trip Time)**: 往返时延
|
||||
- **吞吐量**: 单位时间传输的数据量
|
||||
- **丢包率**: 丢失的数据包比例
|
||||
- **重传率**: 重发数据包的比例
|
||||
|
||||
**连接指标：**
|
||||
- **TCP 窗口大小**: 接收窗口和拥塞窗口
|
||||
- **连接状态**: ESTABLISHED, TIME_WAIT 等
|
||||
- **连接复用**: Keep-Alive, HTTP/2 连接复用
|
||||
|
||||
#### 过滤技巧
|
||||
|
||||
**基于协议过滤：**
|
||||
```
|
||||
# HTTP/HTTPS
|
||||
http or http2 or ssl
|
||||
|
||||
# TCP 特定标志
|
||||
tcp.flags.syn == 1 # SYN 包
|
||||
tcp.flags.ack == 1 # ACK 包
|
||||
tcp.flags.fin == 1 # FIN 包
|
||||
tcp.flags.reset == 1 # RST 包
|
||||
```
|
||||
|
||||
**基于内容过滤：**
|
||||
```
|
||||
# 特定 User-Agent
|
||||
http.user_agent contains "Chrome"
|
||||
|
||||
# 特定域名
|
||||
http.host == "example.com"
|
||||
|
||||
# HTTP 错误
|
||||
http.response.code >= 400
|
||||
|
||||
# 请求体内容
|
||||
http.file_data contains "keyword"
|
||||
```
|
||||
|
||||
**基于网络层过滤：**
|
||||
```
|
||||
# 源/目标地址
|
||||
ip.src == 192.168.1.1
|
||||
ip.dst == 192.168.1.1
|
||||
|
||||
# 端口范围
|
||||
tcp.port >= 1024 and tcp.port <= 65535
|
||||
```
|
||||
|
||||
## 关联笔记
|
||||
|
||||
- [[CS/TOOLS/网络抓包]]
|
||||
- [[CS/SECURITY/网络安全基础]]
|
||||
- [[CS/OS/TCP 协议详解]]
|
||||
|
||||
## 参考资源
|
||||
|
||||
- RFC 文档: https://www.rfc-editor.org/
|
||||
- Wireshark 指南: https://www.wireshark.org/docs/wsug_html_chunked/
|
||||
Reference in New Issue
Block a user