找到具有相同负载的 TCP 数据包的概率？
今天早些时候，我与一位开发人员进行了讨论，重新识别具有相同负载的特定接口上发出的 TCP 数据包。 他告诉我，由于 TCP 数据包在系统级别的构造方式，找到具有相同有效负载的 TCP 数据包（即使相同的数据多次发送）的概率非常低。 我知道这可能是由于系统的 MTU 设置（通常为 1500 字节）等原因造成的，但我真正关注的是哪种概率统计数据？ 是否有任何特定协议可以更轻松地识别匹配的有效负载？
I had a discussion with a developer earlier today re identifying TCP packets going out on a particular interface with the same payload. He told me that the probability of finding a TCP packet that has an equal payload (even if the same data is sent out several times) is very low due to the way TCP packets are constructed at system level. I was aware this may be the case due to the system's MTU settings (usually 1500 bytes) etc., but what sort of probability stats am I really looking at? Are there any specific protocols that would make it easier identifying matching payloads?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
编辑：抱歉，我最初的想法很荒谬。
你引起了我的兴趣，所以我用谷歌搜索了一下，发现了这个。 如果您想编写自己的工具，您可能必须检查每个有效负载，最简单的方法可能是某种哈希/校验和来检查相同的有效负载。 只需确保您检查的是有效负载，而不是整个数据包。
至于统计数据，我将不得不听从对 TCP 工作原理有更深入了解的人。
EDIT: Sorry, my original idea was ridiculous.
You got me interested so I googled a little bit and found this. If you wanted to write your own tool you would probably have to inspect each payload, the easiest way would probably be some sort of hash/checksum to check for identical payloads. Just make sure you are checking the payload, not the whole packet.
As for the statistics I will have to defer to someone with greater knowledge on the workings of TCP.
发送相同的有效负载可能相当常见（特别是如果您正在运行某种网络服务）。 如果您的意思是发送相同的 tcp 段（标头和全部）或整个网络数据包（ip 和 up），那么概率会大大降低。
Sending the same PAYLOAD is probably fairly common (particularly if you're running some sort of network service). If you mean sending out the same tcp segment (header and all) or the whole network packet (ip and up), then the probability is substantially reduced.
克里斯是对的。 更具体地说，数据包头中的两到三条信息应该不同：
旨在不可预测）
是随着数量的增加而增加的
发送和接收的字节数。
时间戳（尽管该字段是可选的）。
Chris is right. More specifically, two or three pieces of information in the packet header should be different:
intended to be unpredictable) which
is increases with the number of
bytes transmitted and received.
timestamps (although this field is optional).
定义有效负载唯一性的是在 tcp 上运行的协议，而不是 tcp 协议本身。
例如，您可能天真地认为在请求服务器主页时 HTTP 请求都是相同的，但引用者和用户代理字符串使有效负载不同。
类似地，如果响应是动态生成的，则它可能具有日期标头：
Date: Fri, 12 Sep 2008 10:44:27 GMT
因此，这将使响应有效负载不同。 然而，如果内容是静态的，后续的有效负载可能是相同的。
请记住，由于序列号不同，实际的数据包会有所不同，序列号应该是递增的和伪随机的。
It is the protocol running over tcp that defines the uniqueness of the payload, not the tcp protocol itself.
For example, you might naively think that HTTP requests would all be identical when asking for a server's home page, but the referrer and user agent strings make the payloads different.
Similarly, if the response is dynamically generated, it may have a date header:
Date: Fri, 12 Sep 2008 10:44:27 GMT
So that will render the response payloads different. However, subsequent payloads may be identical, if the content is static.
Keep in mind that the actual packets will be different because of differing sequence numbers, which are supposed to be incrementing and pseudorandom.