Catalog

TCP Message format ：

IP Message format  

  Structure of Ethernet frame ：

ICMP Message format ：

TCP Message format ：

URG： Indicates whether the data sent in this newspaper paragraph contains emergency data ：URG=1 There is urgent data . When URG=1 when , The following urgent pointer field is valid
ACK： Indicates whether the previous confirmation number field is valid ：ACK=1 It is effective ; Only when ACK=1 when , The previous confirmation number field is valid ;TCP Regulations , After the connection is established ,ACK It has to be for 1
PSH： Tell the other party whether to push the data to the upper layer immediately after receiving the message segment . If the value is 1, Indicates that the data should be submitted to the upper level immediately , Instead of caching
RST： Indicates whether to reset the connection ： if RST=1, explain TCP There was a serious connection error （ If the host computer crashes ）, Connection must be released , Then reestablish the connection
SYN： Use... When establishing a connection , Used to synchronize serial numbers ： When SYN=1,ACK=0 when , Indicates that this is a message segment requesting connection ; When SYN=1,ACK=1 when , Indicates that the other party agrees to establish a connection ;SYN=1 when , This is a message requesting or agreeing to establish a connection ; Only in the first two handshakes SYN Only then 1
FIN： Mark whether the data has been sent ： if FIN=1, Indicates that the data has been sent , Can release connection

IP Message format  

edition （version）： Occupy 4 position , finger IP Version of protocol . Used by both parties IP The version of the agreement must be consistent . Currently widely used IP The agreement version number is 4（ namely IPv4）. The version number is 6（ namely IPv6）
The length of the first （ Internet message header length IHL）： Occupy 4 position , The maximum decimal value that can be represented is 15. The unit represented by the header length field is 32 position （4 byte , And TCP The unit of the length field in the header is the same ）. because IP The fixed length of the head is 20 byte , Therefore, the minimum value of the header length field is 5（0101）. When the length of the head is 15（1111） when , The length of the representation is 60 Byte when IP The length of the head of the group is not 4 The integral times of , It must be filled with the last filled field to achieve 4 Integer multiple .
Distinguish between service （tos）： Occupy 1 byte , For better service . This field was called service type in the old standard , But it has never been used . Only when differentiating Services , This field works . In general, this field is not used .
Total length （totlen）： Occupy 2 byte , The length of the sum of the head and data , The unit is byte . The maximum length that can be expressed is 65535 byte . stay IP The link layer protocol below layer specifies the maximum length of the data field of a data frame , This is called the maximum transmission unit MTU（maximum transfer unit）. When one IP When the datagram is encapsulated into the frame of the link layer , The total length of this datagram （ That is, the first part plus the data part ） It must not exceed the... Specified by the link layer below MTU value .
Ethernet rules MTU by 1500 byte . If the length of the transmitted datagram exceeds that of the link layer MTU value , It is necessary to segment the excessively long data .
identification （identification）： Occupy 2 byte . The network layer software maintains a counter in memory , Every time a datagram is generated , The counter is added 1, And assign this value to the identification field . But this “ identification ” And different from TCP Serial number in the header , because IP Is a connectionless service , There is no problem of receiving datagrams in order . When the datagram length exceeds that of the network MTU And when you have to segment , The value of this identification field is copied to the identification field of all segmented message slices . The same value of the identification field enables each data segment after fragmentation to correctly reload the original data .
sign （flag）： Occupy 3 position , There are only two that make sense right now .
The middle digit of the flag field is marked as DF（dongt fragment）, intend “ Inseparable ”. When DF=0 Partition is allowed only when . Flag field lowest MF（more fragment）.MF=1 I.e. after “ There are also slices. ” Datagram .MF=0 This is the last of several data slices .
Slice offset （offsetfrag）： Occupy 13 position . Film offset indicates ： Longer IP Message after fragmentation , The relative position of a piece in the original group . in other words , Relative to the starting point of the user data field , Where does the film start . Film offset with 8 Bytes are offset units . The length of each piece must be 8 Integer multiples of bytes .
Time to live （TTL）： Occupy 8 position , English abbreviation TTL（Time To Live）, Indicates the lifetime of datagrams in the network . This field is set by the source of the datagram . The purpose is to prevent undeliverable data from circling the Internet without limitation . The router puts... Before forwarding the datagram every time TTL Value reduction 1. if TTL The value is reduced to zero , Just discard this message , Not forwarding .
agreement ： Occupy 8 position , The protocol field indicates which protocol is used for the data carried by this datagram （ The protocol field in the above packet is 6 Said the use of TCP agreement ）, In order to use the destination host IP The layer knows which protocol the data part should be handed over for processing .

Common agreement number ：

The name of the agreement	ICMP	IGMP	IP	TCP	IPv6	UDP
Protocol field value	1	2	4	6	41	17

First inspection and （checksum）： Occupy 16 position , It is also often called checksum . This field only checks the first part of the datagram , But not the data part （ And UDP、TCP The test and difference in ）.IP Every time a datagram passes through a router , Routers need to recalculate the first check sum （IP In the first part TTL、 sign 、 It's possible to change the slice offset and so on ） 

for example ： The total length of a datagram is 3820 byte , The data part is 3800 byte （IP The first part is fixed 20 byte ）, Fragment transmission is required . Suppose each piece IP The message length shall not exceed 1420 byte . Remove the fixed head length 20 byte , The length of the data part of each message shall not exceed 1400. So it's divided into 3 A data sheet , The length of the data part is 1400、1400、1000 byte . The original datagram header is copied as the header of each datagram , Just change the value of the relevant field .

Examples of data fragmentation ：

The value in the field related to fragmentation in the header of the message , The identification part is any given value ：

  Structure of Ethernet frame ：

The start part of Ethernet frame is composed of preamble and frame start delimiter , Followed by an Ethernet header , With MAC Address description destination address and source address . In the middle of the Ethernet frame is the data packet loaded by the frame containing other protocol headers , Such as IP agreement .
The Ethernet frame consists of a 32 End of bit redundancy check code , Used to check whether the data transmission is damaged . The Ethernet frame structure is shown in the figure .

The meaning of each field in the above figure is shown in the following table ：

Preamble ： It is used to make the adapter at the receiving end receive MAC The clock frequency can be adjusted quickly when the frame is , Make it the same frequency as the sender . The pre synchronization code is 7 Bytes ,1 and 0 alternate .
Frame start delimiter ： Start of frame , by 1 Bytes . front 6 position 1 and 0 alternate , The last two consecutive 1 Indicates to tell the receiving adapter ：“ Frame information is coming , Prepare to receive ”.
Purpose MAC Address ： The physical address of the network adapter that receives the frame （MAC Address ）, by 6 Bytes （48 The bit ）. The function is when the network card receives a data frame , First, the destination address of the frame will be checked , Whether it is the same as the physical address of the current adapter , If the same , Will be further processed ; If different , Throw away .
Source MAC Address ： The physical address of the network adapter that sent the frame （MAC Address ）, by 6 Bytes （48 The bit ）.
type ： Type of upper layer agreement . Due to the large number of upper layer agreements , Therefore, this field must be set when processing data , Identify which protocol the data is delivered to . for example , Field is 0x0800 when , Means to deliver data to IP agreement .
data ： Also known as payload , Represents the data delivered to the upper layer . The minimum Ethernet frame data length is 46 byte , The maximum is 1500 byte . If not enough 46 Byte time , Will fill to the minimum length . The maximum value is also called the maximum transmission unit （MTU）.
Frame check Sequence FCS Detect whether there is an error in the frame , Occupy 4 Bytes （32 The bit ）. The sender calculates the cyclic redundancy code check of the frame （CRC） value , Write this value in the frame . The receiver's computer recalculates CRC, And FCS Compare the values of the fields . If the two values are not the same , Data loss or change occurs during transmission . At this time , You need to retransmit this frame .

ICMP Message format ：

ICMP Mnemonic of message name ：

Message type   Message code   Message meaning   Message mnemonic
type：0  code：0 ： Indicates echo response (ping The reply )  Echo
type：8  code：0 ： Indicates echo request (ping request )  Echo-reply
type：3  code：0 ： The network is not accessible                       Net-unreachable
type：3  code：1 ： The host is not reachable                       Host-unreachable
type：3  code：2 ： The agreement is not reachable                       Protocol-unreachable
type：5  code：0 ： Network redirection                       Net-redirect
type：5  code：1 ： Host redirection                       Host-redirect
type：5  code：2 ： Service type and network redirection    Net-tos-redirect
type：5  code：3 ： Service type and host redirection    Host-tos-redirect
type：11 code：0 ： Overtime
type：12 code：0 ： There is a problem with the parameter                  Parameter-problem
type：13 code：0 ： Timestamp request                     Timestamp-request
type：14 code：0 ： Timestamp response                     Timestamp-reply
type：15 code：0 ： Information request                         Information-request
type：16 code：0 ： Message response                         Information-reply       

ICMP experiment ：

（1）PC0 Hair ICMP package , Departure PDU Detailed data （outbound PDU Details）

（2） The packet arrives at the switch Switch0, Inbound and outbound detailed data

Arrival ：

Outbound detailed data ：

（3）ICMP Packet arrival PC1 Hourly inbound and outbound detailed data ：

Inbound detailed data

  Outbound response details ：

 （4）PC0 received PC1 Of ICMP The response data