tcp重传tcp会话重建
我正在尝试编写一个重建 tcp 会话的程序。我有一个包含数据包的 pcap 文件。问题是我不知道在重传时应该使用哪些数据包来构建会话。
重传 http://img412.imageshack.us/img412/4655/retransmission.png
这是wireshark 显示的有关此会话的内容。我应该使用哪些数据包来重建会话？第一个数据包还是重传的数据包？其中哪些有有效数据？
我找不到附加 pcap 文件的方法，如果您愿意，我可以将 pcap 文件上传到某个地方。
Im trying to write a program that reconstructs tcp sessions. I have a pcap file which have packets. The problem is i dont know which packets i should use to construct sessions when there is a retransmission.
retransmission http://img412.imageshack.us/img412/4655/retransmission.png
here is what wireshark shows about this session. Which packets should i use to reconstruct the session? First packets or retransmited packets? Which of them have valid datas?
I couldnt find a way to attach pcap file if you want i can upload pcap file to somewhere..
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您可能只想提取您确定已交付的数据。这意味着您只需要提取那些已被 ACK 重传的数据包。发送端收到的ACK携带接收端已接收到的字节数。这些字节是已成功接收的数据。
您需要第一个数据包（我假设您认为 3 次握手数据包），因为它们携带初始序列号 (ISN)，因此可以将数据的第一个字节（八位字节）的（绝对）序列号识别为 ISN + 1
。 ，您检查过这篇文章吗？
You probably want to extract only data for which you're sure that has been delivered. That means you need to extract only those retransmitted packets that have been ACK-ed. ACK received on the sending side carries the number of bytes that have been received at the receiving side. Those bytes are data that has been received successfully.
You need first packets (I assume you think of 3-way handshake packets) as they carry Initial Sequence Numbers (ISN) so can recognize (absolute) sequence number of the first byte (octet) of data as ISN + 1.
Regarding the implementation, have you checked this article?