wireshark抓取TCP連接及斷開(kāi)實(shí)驗(yàn)

實(shí)驗(yàn)?zāi)康模?） 掌握TCP連接建立的三次握手過(guò)程2） 理解TCP連接釋放的四次握手過(guò)程實(shí)驗(yàn)原理：TCP協(xié)議工作原理參考TCP.PPTTcp顯示過(guò)濾規(guī)則：tcp.flags顯示包含TCP標(biāo)志的封包。tcp.flags.syn==1 顯示包含TCPSYN標(biāo)志的封包。tcp.flags.syn==1andtcp.flags.ack==0顯示包含TCPSYN并且不包含人。1＜標(biāo)志的封包。tcp.flags.fin==1andtcp.flags.ack==1顯示包含TCPFIN和ACK標(biāo)志的封包。tcp.window_size==0&&tcp.flags.reset!=1主要設(shè)備、器材1） 已聯(lián)網(wǎng)且運(yùn)行Windows操作系統(tǒng)的計(jì)算機(jī)2） 協(xié)議分析軟件Wireshark實(shí)驗(yàn)步驟：1） 啟動(dòng)WireShark抓包2） 訪問(wèn)學(xué)校主頁(yè)服務(wù)器，通過(guò)Wireshark捕獲通信內(nèi)容3） 分析TCP連接建立的三次握手和連接釋放的四次握手過(guò)程

源IP: 目的IP: 源端口： 目的端口： 第一次握手：wr21_□m.m*1Z1-IM.ft.ST!□.Bl.EC*.SBwr21_□m.m*1Z1-IM.ft.ST!□.Bl.EC*.SBTCP3DIMah〔c?口> 9-pCR^l[51YJ,ACK]SA^-OUh■口N^r'RS-MQL￡|->DtMH：mt■,eh>ww：^^mlfl_82.5o.JB—TH iTBlTM I7P14*rTTiCT.； WTJSIF抻由21_Ii(wl5STCP8t!ITSIWXp■時(shí)LXpHDEYHr ￡>4Q-0AtfcTTT卜§349LiSH-tHJ5E-1J35021.09437910BZ.34.3Bm.U.11.177T：P1731頑W?http[ACK]S&^-lAck-1WZ睥，Len-0331Hl皿IDBZi30i3BlZL.ld.LL.177TCP1731[TC口字沖！:nt;of-arca5S??*?'iedPRJ]9522i_iu*=u：3iza.14.11.17710.B2.34.3BTCPill1731hupitilccp[ACK]s^>i^j：E-2745n?Xj2Lfifl-uJSS2i_auhii5IZa.l'Lq.O.lSSlii屈U6.通TCPill2：!Guhrrp>上口￡■百口S[KYH.ACb]Sdq-bX：k-D■r-Ii'i-SS^ULfiTr-ij?=■nd21.1DG&3310-BZ.3Q.3H1731HTTr/l1「4朝11匚占［皂1：-51：「己?1~1laFt*tine14H-Mby￡?an節(jié)Tr管(JZBbit5)i咽bflstatrtiredl>ZBE”)DiarkiEHAi.SK EtvlmLktcfmt! Jalprl InfeBm&i!g-EhernriII.Erc=PrmH^Jl=dc:eT :BB:-dl:dc:eT)bbt:ID:33:dl:D.:3Q=-Rb :33=dl:H:3Q=-F*>+IfYfirHfcTFFifCDC01,EFC!1U.82.3u.flu.fl：',if.38：l.Dirts??<121.14_11.177j-rran9i1?1aicnntrolpriTEKOI,srcrdtt!nslocp0.731],atpart:hrtpCBOQ,saq:0,uni0Snurcepc^t：nslcqi(17315此FtTnatlanpert;http[Strriri^ndfeiR:L3SQ三皿的心fiuribfiF：0miUTM￡做fiilFEOwaadijpIsfljjrh■Hhyras：BFlans;ME(S?N)D.... -Conaertion*rirrinwFeduced?/.]-Hcri:set-U - gilZhCHMOTSfiT￡i -Lr^fTE：!HDT:SS￡.■.0■.■■a iEd康HUE：IHOTset....Q.a.-Push;Hueset Q>.-fl.c5et;Hen:set..1.-syn:5ffc u - f1ii_nat■?rInElDs?size;4S3JS。流d*[validitlion.v凸ptdETrt:￡1?由t*li)替換上圖序號(hào)： 確認(rèn)號(hào)： 數(shù)據(jù)偏移： URG: ACK: PSH: RST: SYN: FIN: 窗口：若只抓取第一次握手的數(shù)據(jù)包，則顯示過(guò)濾器的規(guī)則為 并截圖替換下圖：

Na.Tin?￡dLT￡?0nfeiiHl3DnweperldilpadbnglhProb?nlhfa Zlfl.珀，HMD13IMJKfWTCPgilarjtysurfer>ht?p[洲]Seq-Q^1n-fll9Z ?5MdWwS-JSACK_PEM^110IJ06211719E.1M.1ITOZZK>.L>ELillH.143014-W?■TCPbrnkrr.jfrvicr!>htep[5*N]5eq-0 LtrMJNSMdffln5-Z5ACK_PEiy^l45lfl2.ltB.l_lK22>.l±L.fil.7QMMEOTCPnacl-ckTp>help[jyh] Kss-l+fiDms-25?K_Ptm-i3_fl$1024US.Wf.SS.2tB.3013SSTCPqilacskw^urfar>hrep[syn]sAq-Ci ims^-14^as-2sack_peu^-isfiij部mMr』[SJ-EblE].65b/c站匕非〔h日bits]?EThdrnAT11,5FC_：EHttil€￡ir_?dJ3a:1C[OO.lO!65_B_N!lcLQ￡C：Tp-LirkT_lf--M--+0 .Oc.tad:ir.-￡424-0}h維勺「響個(gè)皿叫.芝已"11.100OS2-iw.l.i(W)8mti216.K)』二強(qiáng)1.CMJ-即?氣Ml}TfraiisiklsxlonControlProtKJol95rcPwt:DilKtsfeysurfcrC3413))DatPort:http(BO)?Seq;D>Ile;DSourcepcrc;g'il-itskysurfer(301?：iPwEnirtEriport-http("WJ[Hr。策Index!2]sdqiiti^f!nuribtirj0 {r?liTlvd nud?r}ItfWEhi：處追yE宜日Fl叫rMZElDm ■CongtstinntfindwfcedyKcd{Ciflt)"hatstftnQ ■ECN-Echfl；Ssec_.D ■WgEJNfiiT2?C-..0....■MkrZ*網(wǎng)S：!Hiit54T-...?！鯬uShLHOC24T，…i-…■耳時(shí)皿！nmwr田 1.■Syn-Set Q■p]r"HatsetrindawyHie;BL1?2BEhacksui-QxddbJ[>alidaTlond1sabl?d?Bapidcthj(12byt*)第二次握手：找出第二次握手的數(shù)據(jù)包并截取對(duì)該數(shù)據(jù)包的展開(kāi)圖，根據(jù)截圖填寫(xiě)橫線內(nèi)容。EE<Al^bIV/inn/JIWEvh^rMtM€lliGTDtfoftEE<Al^bIV/inn/JIWEvh^rMtM€lliGTDtfoft1jFaMHSfh^duler}tiWp4itHD)-Vir^0h*ckB?Kli'LitailBn*■r可血>^TriljssEi?i1ciliET+J-hHwIhJi：E-L>a aN l|EsI&0國(guó)兇■國(guó)岬￥1目Hl'ictf: fbpi-kcLmna*rfrn34721-uT^：E4SlZl.a^.6.37 6 TCP&l lS4gtTCTp>^A-iiiSig-pcrT[TrtM,ACK]5iK|-UUk?￡lL￡f>0t14S21-fiB4■&2110-B2.30.3H 13.-14,11.177 TCP1731 鉤?iil■：：!：>Lhrrp[FfH]5&：|-|.|tairt-g-535H5TK34921.094^91Z77 1Q.B2.3Q.3B TCPSB L?31http>n.iccp[S￥MPi：K)E-sq-0Adi-1nln.jadOLen-QK&l—35521-054371§10nHZi3Oi3B mnld.lln17T ICP1T31 羽rasiccp?http[ACK]5&^?LAck-1^fmJI5535Len-09512i.uA7o^gNikg.m.舶 lia-M.il.177 TCP1/51 &J[TCF-土的，qnrOfAf PC<|]95221-1uirjjL133.-14.11.177 ill.62.3^.38 TCPill ITS!hup5iilccp[ACK] 45n?H?2LSfl-03512i-10?S<L5ISi.l■&4.0.155 tcp制 ”如Imp?■ipc-SJfl*[svm,.也kJsigq-DAde-fiwlrfr-SSafiLian■曰res-33J21.10^331QhBZ.34.3B 1^=14.11=177 HTTP173TLP05T—wrvEHTTP/IbI門(mén)GHh砒4eAi匚￥aFraim349:*50byt?anwirefagnFt國(guó)).ifiObyt臼曙paired(4BOEtu)域ETharH￡-T[[.srcE3S.il:d&.Li.S,J：rft□S:2i'db.Si.jO:ffcj,wnc!Pi?iai_41!fc:c7<uu ;41■ric=￡7^4BWflEA-ffCflCOl,KF!：!121.14.11-177Clia.14.11.177),,MT：Ilk盟.3ClM日CLO.Sa.MijQSO匕rransnisslanconcrolpror.K.oiiarcfott;hc.cp?w.-j.dstpwl;fi31c.qaCJ.?3Lj?，??；y(心；l.Ler>;0Snurcepert;httpiBO)此Ft^nat和npert-psiccptLTJl)[srrunIndax:13SQ三』qusr心由舊b猷e0gFAl^Tlvia riuti^sF)4jckmw"ledgenerTEnuber;1<rei-ii:1^edekruatcrjHE^dgr15.Eh;3-Fl^an-W?CgPW,*5：Hju........■ccviQjjr1onulrdD*F：4<kj-；4dOrwiJ2H￡rcs^t.u...…-gJzhmNOTSGTE??0?....?unasTi：;hdtsec...1■■■■-AcknowlHbhisx;E5..?A.J?hrMrt-???t-—.0.-? !HiH5*T..1.-5>i'i_SAt.i.O-Fin;Mm:serWinripw!size;5噩口*Eh?u“i_viMDuanlOC??lHriit^andiEi>hl?d^]+a|XCl￡r*fcS:<4byTiSES):+[SBq/gcAnalyslsl替換上圖序號(hào)： 確認(rèn)號(hào)： 數(shù)據(jù)偏移： URG: ACK: PSH: RST: SYN: FIN: 窗口：若只抓取第二次握手的數(shù)據(jù)包，則顯示過(guò)濾器的規(guī)則為 并截圖替換下圖：（提示需要syn字段為1而ack字段為1）

li4 330.1*1.za1UL3U-l]3r2-522D.L5L.2U.1-1524 220.15i.20.14￡610-4.MJ7抵0.1S1.26.81730i*OO92HQ.1AL河IS尺04.T1W1ZZQ.l&l.ZiOl.lQJ鈕O.Sl^L^?220.1&L.11B.L4M￡O_7I1€??220.141.bl.WS.liUM21S.ld.-32.a0rLli4 330.1*1.za1UL3U-l]3r2-522D.L5L.2U.1-1524 220.15i.20.14￡610-4.MJ7抵0.1S1.26.81730i*OO92HQ.1AL河IS尺04.T1W1ZZQ.l&l.ZiOl.lQJ鈕O.Sl^L^?220.1&L.11B.L4M￡O_7I1€??220.141.bl.WS.liUM21S.ld.-32.a0rLDntaiHticn19Z.H4.1IDOl'J2.1^5.1.1DD1^0nlfl2.i6S.l.10019Z.1W.110019Z.1M.110Q1^12.1^.1.1011ia2.i6￡.i.io<]i^S.i^.iIMditpadbngihProtwalM.TCPTCPFrppFFPKtckktckE*普?笠林Enrchttpj-ta1dn1gnt-r?n[sm.hccp>pac-ncfy[swh,ack]saq-a*1卜淚白L@nE?T3B-i++Ohrrp>Tfiiscdd-feMt*[sym.ack]wX*Mk-0 mss?L44Ohccp>a[SYU,Mg]5eq-Qwk-0Vln-SRiOLtn-dmss-IJJQSi<K_Pt^-laA?hmp>ti-cd55[取Xg]SecrD占ck7iJg5BJ0leMt-55-1110Xk_PESM?1mhccp>brakar_2-firv*ica[s?Bkk]s&q-4相:k?i?1Z地l?i-￡imss-144-￡is?k_ihccp，nxcl-d&Tp[syh,mk]saq-OAcfc-iAlr^E-540lh*ras-i*40hccp:-■firil3KWky5"T?a「[tvw.ac?r]*ck-i*1n-65il5-L?n-0 w-ihFFHriiiJC-MbyE4dibh1rA[HC4bl口J.htlby【鋌 [#映bill)EiETharnAi:ii,src.fp-LlnkT_if.ifij4.Ci(-M.0ci6d.if.da!4D)9皿匚！B-Yt4iliccir_ad-3ai.li：{DO.ifi.GSiad.l^.ic}hircfirn?三巴乎qL丁舟三2.:1瓦蘭口-1抽殳"土刊平、日土 Ttan^BiHionCorrtro'iProcKol.5rcPxrt■hctp(50)iGatEi;lotuj低叩{WO?},Srq-O站“Q.le;QSourcepcrc:httpi?0}EA±ClnkT*iCinpdr-T.IdCU^Iitap￡30<]j'J[nrunindax:flEqqugjfinuBbwaOglslg仲n?**>&■)^ckiwledgercntn^nber;O(rel-itlireackrw^ber)HEdblengch;Mby^esBFlags-O<12<M,*ck；0 ■C4r^4St1ianWlrdifeH1MdwC4d{CMj!!HOC5?t?Q =EC*4-EClWIsec??Q Urflerc；HPt3<K...1....-Atkrwwledpenenc:Set-...Q…■Push!HOCS4T=-..J■Hfc5#T：HQCS-fcT±i^H..1.■sjti-set.i.10-Pin;hat?t5(idi>iyin；5卒令SchAcksufi-OxirrJi『H11W5dl￡abl?diBl<ipElartf°{4bye堅(jiān)] 第三次握手：找出第三次握手的數(shù)據(jù)包并截取對(duì)該數(shù)據(jù)包的展開(kāi)圖，根據(jù)截圖填寫(xiě)橫線內(nèi)容。LMi?m'.i"t與?q；1.3S2Z1.10W3mc14.11ilT735321-10fifid.5121.1W.D.15S354 lO-fiz-.ae.^e四欠初如*1做C432 殳bjTK牌區(qū)質(zhì)此LMi?m'.i"t與?q；1.3S2Z1.10W3mc14.11ilT735321-10fifid.5121.1W.D.15S354 lO-fiz-.ae.^e四欠初如*1做C432 殳bjTK牌區(qū)質(zhì)此(432blxsZ15rc;PrviHX-JL;dc;c7(W;efl:QQ;4L;dc;c7)PDat;3B;22;dl10.Bl.34.3B1M..14.11.177i：d.-34.il.aT710.HZ.3Q.3B1?1]d.11.1771D.B2i30i3B]^r21-QT-4&4*1Z1.I-M.ft.sr]4S21-U^oJl21-0M354121.U.1±.177kmiiIKkEtJhfiDI■■:M：M1：?Z7A■膽&Lei-0WJMd->u res>Fislcqs>Irrcp「ISYM]非中財(cái)I?1n-h5535Lbn-UMSSE?a.4taUtalSTSi51SI09^?IOC0Z.3Q,3Frraniia35)S>EthErnst . .[nrcrnrtProtDCDl!5-c;1D.Ki30.3B(14.BZ.3D.30)PDrt;121.14.1±.177ClZL.U.ni.lTTl-rrMnsri-laaIonCDnErra"!ProtD'^Q!"l,number)size;Q3333■?dndD￥+'ZhACtSiMi-DxAd!IL[m311dlTiQr'id1&d^"lad]+[5ECL>!AiCKAnalysisl皿；JiQurtopor!iKl-:-:pC17S1jDdSFElriiTlanpis^T-kucpC&OJ[Scre-siiIndex;UBO5equH-ceninbL1(relitivsirlncw'lcrlgffierTtn.nber；1HA^dAi-替換上圖序號(hào)： 確認(rèn)號(hào)： 數(shù)據(jù)偏移： URG: ACK: PSH: RST: SYN: FIN: 窗口： 是否可以只抓取第三次握手的數(shù)據(jù)包，為什么？若不能，如何確定是第三次握手的數(shù)

據(jù)包。三次握手之后，客戶端要請(qǐng)求服務(wù)器傳送數(shù)據(jù)第一次請(qǐng)求數(shù)據(jù):954 1￡1_EIS.30.1ZSL_34.11.1T7]5LZ1。尹?5口100?.JO.3HL-4S：21-LIM621llJ-aj.30.ia34■&21-tlA35954 1￡1_EIS.30.1ZSL_34.11.1T7]5LZ1。尹?5口100?.JO.3HL-4S：21-LIM621llJ-aj.30.ia34■&21-tlA35。7735421.094376iO.B2i34i3B352SI10W<'31?1Id.11,17733321.10441311.1771Q.B2.3O.3B+FraHA951:327anwlrai□陌>6bliaj,S27嚀1明cipiLrad￡況?&b1xs)itThrrnn：iip5rc;FrviaK-JLsdc;W；*=i3;QQ;4L;dc;Cat;3Bi22;dli30.;39；Te◎日；HMdl;30.伸ffiIritErnetPrrtncnli5-c;ID.BQ.3D.3B0.0.BZ.3D.3B)PDrt;121.14.11..177CLZL.U.ni.lT?^MQurcmporn:gsxlrui:加nptri-低卬CS03[火miInddA:iSS]SequHiceninbo-MQurcmporn:gsxlrui:加nptri-低卬CS03[火miInddA:iSS]SequHiceninbo-;L[hcvfrcqijenceErte「；】網(wǎng)irlncw'lcrigffientnuaber:1偵sFlags2(relitivE:-SGMSicenimbe-)(relitlMESEquen-ZEnunhs-)](rel-a.t^veacknumber)(p:m,jck3酊5nd陽(yáng)牌函■頊SCi-Hsr心tEOHEchn:r*?tsetUtigent；HetsecAdfnowledneneiT：;5nt-Push：5GCKASStIH￡TC喘-NiJESdfE-Ncrtjetsize;as333aChccl：9Lm=0^18eMfuisHdlt^Ond^S：吐i】El+住Eci/qcAnalysis]TCP RTM蝦嚇財(cái))替換上圖序號(hào)： 確認(rèn)號(hào)： 數(shù)據(jù)偏移： URG: ACK: PSH: RST: SYN: FIN: 窗口： 你是如何確定是第一次的請(qǐng)求的數(shù)據(jù)包：若通過(guò)過(guò)濾規(guī)則如何找出第一次的請(qǐng)求數(shù)據(jù)包：服務(wù)器要傳送數(shù)據(jù)給客戶端第一次回復(fù)數(shù)據(jù):找出第一次回復(fù)的數(shù)據(jù)包并截取對(duì)該數(shù)據(jù)包的展開(kāi)圖，根據(jù)截圖填寫(xiě)橫線內(nèi)容。7KcaI^I19/1DEV1J444Eih^rhttF*ot<-tSfhi^dulerltlapp4itBD)-Vir^0h*[k3叵區(qū)lil> ￡■:■WiHfi*jJjriUjSaWEIE"T+14(+i?t工WyE?LbBlH白日#!3盡由**0M業(yè)1值日1壓<c.. ￥國(guó)E抻1目nii-tf凸pl4?E1.B1.JTa risr:ZEEl^rrlihi<lbbE-nnljnaLJalarrr1TuFfJl-UMg1丑-IB.瓦國(guó)了1U-w.gMTCPIfrrcxp>rmTiqg-pcci[sitj,ackjs^?jajck-uWii'i-iMuL-21'i-Ut34S21gdiuB2.3O.3Bia_14.il,177TCP1751?我nslcqp:*hrrpr：>H]5&：r?jrln-65535_m?Uhe-:■-1460isfifT5?34921.DM339ian14.11.17710R2.3$.3BTCP1731httpvreiccp 心：]5cq-0Adf-LWln-3oJQLen-DHS2-1-JlD.BZi3O.3Bm-ia.ll,!??KF1730.jiHecp>http[ACK]Ee^-LAck-1MZ553,L?n-D95121-L15I7OSO10-B2.3O.3Bia-M.i±.i77TCP1731&j[t>z?:的，白nrofirAA￡-s?L>lAdpec]J522i_au6=￡i3iza.i4.ii.10.B2.34.3BTCP1721htx口>ftdccp[；ju:k]三eq-LA￡k-Z!74 L￡fi-0WIMQ雙!iIDH2.34.3BTCP2ZG0Imp>sp'：-22W[S￥HP*ckJseq-GACh-fiiwln-5&3flLCh-Sres>]5d21=10K13lD.BEi3O.3BIfl11-IT?HTTPIF責(zé)POSTs^.^rvEl-nTF.d.,1門(mén)fhHsHeA!匚EtTtFE)：；5、-N<\hyT#1：i-n*Tr皆Ld日口hlTii,心口h/T#1：■ZAPrirEH日。'IT■：■?ETharnt![[.=rceMssw Nmr白Casizaidbsjl.jvirfi-.i,e”P(pán)i?iaRi_41!K：c7(uu:-2v_v3!41!K=c7j-crriiii-i-iiiTRdcacin,s-c:121.U-11-177CL21-U.1±.:1T乃.ux:ld.82.3d.3B0^.82.SO-380BTtHnsnlaalcnCantrilPrirtPOTliSrcRwi:ItccpfJKf)rDitE~t;rBlecpQTILLSeq;L(Ack;2F4(Len;0Snurceport;http(BQ)[■■rc"lnitronpirt:■■*!ciep(ITITli[n:rtaiiIn心!13S]saqiiGf'F^ainiiibdr:1grailulvos-tcptncAnuti?r)占ukn呷IcdgEem :：7d k-earfcnuibcrjhe占declength;2Qbyte:-ElFlyOalOu. -aart^SFElDri5ndowF^duoailC1-^J=hui:ssti-U. -E￡fJ^Gi：hD:NOTSBC..D -iJ-gent;Hmsec..>1■...-AcfcnawlEdGHSienc:5er-...O...=Fuah:Hafc.s?t CL.-H^S￡fE!H￡TCS*T U.-S^n：HOLS?T D-Pin:Hsrt5?fi^ndwisiic:4132chAcfcsi^izaxfAa^.WMdulsdl￡*HW][Gi?dchiack^jH：palso][HidmWWUfiE曰值EQ/ACK七]『Th】T】!；.antvrti七s^giEni：】ri■fi-yc;351][Th*RTTKUKtZThHSG^fbiflC話令$EU.iJU&SSSWJJdCafp^]替換上圖序號(hào)： 確認(rèn)號(hào)： 數(shù)據(jù)偏移： URG: ACK: PSH: RST: SYN: FIN: 窗口：你是如何確定是第一次的回復(fù)的數(shù)據(jù)包：若通過(guò)過(guò)濾規(guī)則如何找出第一次的回復(fù)數(shù)據(jù)包：1、捕捉斷開(kāi)連接的數(shù)據(jù)包，顯示過(guò)濾器的規(guī)則為并截圖替換下圖：Na.Tinv□nAin^iDriweperidilpadbngihProbHal^-iTd1421WWW1WZZQil-B-lill?14503dTCPbrpkrr-service?■htep[叮吼XX]Seq-fli?l^ck-ltlZKn-l驚gLtn-014]1-D44W23D.l-M.lia.L-l192.1W.1.IDOBDKUMTCPhetpabrakHr_3i?rY-lcH[FEnt,^K]±wq*lDHAck-*M1ii4n??efl0也i-l?l.iS77220.1S1.26.1QS132.16￡.1.100flOKAO722HTTPHTTP1.12Q04K項(xiàng)1-1?1144220.iSi.2G.lOSia2.i6￡.i.ioaao30.2SOE-HTTPHTTP1.1200€KCTiiXC/trtrtlJ1M111?TW219Z.1M.1IKZZD.141.Z5IDS301Z50WTCPmdi3>heep[FInKF]3(^1009Mk-3F33511叩l<n-fl1TQ1199ZW192.1M.11WZZD.141.Z510$3010W3dTCP聊>http[Flh.M叮5cq-10B3Ack-1350^n-1153Len-0mid1.5173]O22D.1I1.2D.1411D2.If-li.l.!□□□□3O0G1”T￡P(guān)heepa1?umjhp[flh,aCr：]2aq-3*41Ack-43]W*ln-Q433l?ft-D2121.5J7?F?i22O.i￡L.2D.i4Sia2.i^s.i.ioa的iCO￡ATCPhxp>H*idn1ght-T??￡h[f:nbkk] w1n^-4122141-S-0MS220.1￡L.20.14￡ia2.i6￡.i.ioaBO54TCPheep>p*￡-ncfy[Pin,4：K]saq-2￡L牌K-433wir>6432a.Frari：ms”bytesmwiyb-ita)5*bjl?capcired(*-3Zfelts)?EThArn^ise,arc.ip-LlnkT_if.ifl：4flC'M^cibd.ifosc:xriT*lcar_ad-3-a-li：(00.1?.65:^￡|.2?_1￡)mdrrwEPfanacQl.srci32fii.Ul.2D.M1[SILLSI.2 wm"估壬\>1conr^olpcocmoI.sre?or-Theep(■&：■>.dstg/g 迎 ss?q241, 4S3,l<t?0Sourcepore；http(HQ)Dcst-initlnnpert-Idtuswt-Bp(300T)[sewsIndQx:口]5A4UtiTK?nui'borj2€1￡r?ladvaw仲ru^?r)Ackiwtal4di]A?dirT[Dunbar!”手(r^laTlvaaeki^u^bar)Headerlength;20bytesBFlafllSMl(FENPiCK}0- ■Cong?>t,lonW*lndDWtKk?G?d{Caft^:Nde3?t-0 ■ECN-GChQ!NOTffiC-.0 ■C：Hi>T54C…JL■■■■.*ckrwwledptnem：;Se....0...■Pvati-Hot3?_--..O--―[%??±:hoc3?t Q.■syrt-KM5?T田■?1■BmsacFMasize;W12E>Cheeksmh-口海25『[validationdi?dble4|根據(jù)截圖內(nèi)容填寫(xiě)：第一次斷開(kāi)：URG: ACK: PSH: RST: SYN: FIN: 第二次斷開(kāi)：URG: ACK: PSH: RST: SYN: FIN: 3、捕捉RST置位的包，顯示過(guò)濾器的規(guī)則為截圖（RST置位）并填寫(xiě)橫線1D.B2i3O.3BEm刑一51^5.ME就F _4白1D.B2.ae.^BlieBJQAle01!!92l&a^.3^.3BEdl0315225iacT?4.ft.361D.B2i3O.3BEm刑一51^5.ME就F _4白1D.B2.ae.^BlieBJQAle01!!92l&a^.3^.3BEdl0315225iacT?4.ft.36±FT*蛀F35 -?afcyT?Mr.1r*C432FTSL知tf^C-PCSprif*.：!(432St矽■leThernrtIIP5rc;PraiBK_riL;dc;c7{Q0;e9;HH;4L;dc;c7)PDat;3B;22;dl;?□. (3B;22;dl;3d;Si gimnml■::slwconii^flilprcrcbool,wrepo-tj耶rvfiueC3D2L3,姑c hrrp(&jj_saq.iS5u_wL_17-477_l-^ii!uUBp.KJTWgR：638H.輻帽旬ID.AS.34.郭&S'JAl.&ilim113.M7.124^a113.2O7.124.-Hfllu_a2.3e.3：B113.2Q7.1Z4.4B10BZ.3C.1D.R3.1C.3DT>ZPTCP7CP2U68就119G3崖腿]-ELm^.7H^5JLck.iBIlTWln?4?7lavauTl'ESF^pFECl，Irrcp[ao-]mq頑7* ■浴珀!?-|ii-3721^2lihexp>SbKlfiHA[F3H,ACE]咒卜寧均1Ad>1417>1ri-'iSStaIn^tmacMnE/http[XCK]S?-141T*cfc-3904aMin-371952Len>.■■.-..-.DeFt^tlanpert;httpWJ[StreanIMe;13JJ￡aquM~r=^wninfatarzU50(rol ?4-quancnrv-B-hor/'acFnovl-ad^^riAnTiKrtbar:17477(j'-aliclyfinudb?i'jHAridfii*isfiiicri!24hyESiFlagi;S14(KT,JCK)-CongertinnWindowFwducedR*■;Hereset-SfN-CChD!NQT&AL-UP^fTK!HDT￡￡￡-Ackrw^lsdQsmfxisfft-Uh：仲Ut!5*t-fi?et;5er U.-5^Tb：HffE：S￡T-…..?U-Hn:HiXCsaxwind網(wǎng)alie;QS-ZhEctsLBi:Q*d5(拒[va