This is the final article in a three-part series devoted to studying normal traffic. As was explained in Studying Normal Traffic, Part One and Studying Normal Traffic,Part Two: Studying FTP Traffic, we often focus our attention on the characteristics of suspicious packets without first becoming familiar with the characteristics of normal traffic. A good and easy way of doing this is to generate, capture and examine your own normal traffic. The first two articles in this series showed how to capture packets using WinDump and reviewed some of the basics of normal TCP/IP traffic. In this article, we will be looking at two other aspects of normal TCP traffic: the structure of TCP packets, and the use of TCP options. Note that in order to understand this material, you should already know the fundamentals of TCP/IP.
TCP Packet Structure
If you've read the previous articles in this series or worked with tcpdump or WinDump, you are probably familiar with the format of their output for TCP traffic. If not, here's a quick review of the meaning of the fields:
這是一個學習正常的流量三個部份的最后一章。正如在講第一部分和第二部分：FTP流量研究一樣,我們要將我們的注意力集中在那些還沒有被我們熟悉其流量特征的可疑的數(shù)據(jù)報。一個簡單而又實用的方法是去產(chǎn)生,捕獲并且檢查你自己的正常流量。上兩章展現(xiàn)了如何用WinDump捕獲數(shù)據(jù)報，并且回顧了TCP/IP的一些基礎(chǔ)知識。在這一個文章中,我們將會看著正常TCP流量的其他二個方面: TCP的結(jié)構(gòu)打包, 和TCP選擇項的使用。在此之前，為了更好地了解材料,你應(yīng)該已經(jīng)知道TCP/IP 的基本原理。
TCP包的結(jié)構(gòu)
如果你已經(jīng)看這一系列的早先文章或者合作或者有tcpdump或WinDump編程經(jīng)驗, 你應(yīng)該熟悉他們的輸出格式。如果還不熟悉，下面進行簡單的回顧: