总结：
1、tcp报文非数据部分4*6字节
2、RFC 973
《计算机网络》 谢希仁
three way (three message) handshake
只是一次握手
同步位SYN、初始序号seq
同步位SYN，确认位ACK，确认号，初始序号seq
0-验证计算得出的UDP校验和与wireshark是否相同。
http://baike.baidu.com/item/Wireshark
Wireshark · Go Deep. https://www.wireshark.org/
Wireshark has a rich feature set which includes the following:
- Deep inspection of hundreds of protocols, with more being added all the time
- Live capture and offline analysis
- Standard three-pane packet browser
- Multi-platform: Runs on Windows, Linux, macOS, Solaris, FreeBSD, NetBSD, and many others
- Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility
- The most powerful display filters in the industry
- Rich VoIP analysis
- Read/write many different capture file formats: tcpdump (libpcap), Pcap NG, Catapult DCT2000, Cisco Secure IDS iplog, Microsoft Network Monitor, Network General Sniffer® (compressed and uncompressed), Sniffer® Pro, and NetXray®, Network Instruments Observer, NetScreen snoop, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek, and many others
- Capture files compressed with gzip can be decompressed on the fly
- Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platform)
- Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2
- Coloring rules can be applied to the packet list for quick, intuitive analysis
- Output can be exported to XML, PostScript®, CSV, or plain text
Wireshark基本介绍和学习TCP三次握手
http://www.cnblogs.com/TankXiao/archive/2012/10/10/2711777.html
https://kb.cnblogs.com/page/130367/
Fiddler 教程
ip.src==192.168.2.51
C:\Users\sas>ipconfig
Windows IP 配置
以太网适配器 以太网:
连接特定的 DNS 后缀 . . . . . . . :
本地链接 IPv6 地址. . . . . . . . : fe80::8139:deb1:313b:adb9%3
IPv4 地址 . . . . . . . . . . . . : 192.168.2.102
子网掩码 . . . . . . . . . . . . : 255.255.255.0
默认网关. . . . . . . . . . . . . : 192.168.2.1
以太网适配器 VMware Network Adapter VMnet1:
连接特定的 DNS 后缀 . . . . . . . :
本地链接 IPv6 地址. . . . . . . . : fe80::b98b:4377:c46d:728b%4
IPv4 地址 . . . . . . . . . . . . : 192.168.32.1
子网掩码 . . . . . . . . . . . . : 255.255.255.0
默认网关. . . . . . . . . . . . . :
以太网适配器 VMware Network Adapter VMnet8:
连接特定的 DNS 后缀 . . . . . . . :
本地链接 IPv6 地址. . . . . . . . : fe80::1166:633b:a43b:d18d%6
IPv4 地址 . . . . . . . . . . . . : 192.168.61.1
子网掩码 . . . . . . . . . . . . : 255.255.255.0
默认网关. . . . . . . . . . . . . :
隧道适配器 Teredo Tunneling Pseudo-Interface:
连接特定的 DNS 后缀 . . . . . . . :
IPv6 地址 . . . . . . . . . . . . : 2001:0:9d38:953c:28ea:2425:3f57:fd99
本地链接 IPv6 地址. . . . . . . . : fe80::28ea:2425:3f57:fd99%5
默认网关. . . . . . . . . . . . . : ::
C:\Users\sas>
封包详细信息 (Packet Details Pane)
wireshark与对应的OSI七层模型
这个面板是我们最重要的，用来查看协议中的每一个字段。
各行信息分别为
Frame: 物理层的数据帧概况
Ethernet II: 数据链路层以太网帧头部信息
Internet Protocol Version 4: 互联网层IP包头部信息
Transmission Control Protocol: 传输层T的数据段头部信息，此处是TCP
Hypertext Transfer Protocol: 应用层的信息，此处是HTTP协议
https://kb.cnblogs.com/page/130367/
SyntaxView 代码
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>Fiddler 教程_知识库_博客园</title>
ImageView 图片
HexView
WebView 浏览器