43 lines
2 KiB
Markdown
43 lines
2 KiB
Markdown
# TCP capture lab: one connection, every segment
|
|
|
|
The instructions and questions are on the Canvas page (TCP Lab, part 1). This file lists what is here, how to run it, and how to read what it prints.
|
|
|
|
## What is what
|
|
|
|
| File | |
|
|
| :--- | :--- |
|
|
| `capture.py` | given, do not change it: builds the network, runs one transfer, captures it, and prints every packet |
|
|
| `captures/` | the saved captures, made when you run `capture.py`; you can open them in Wireshark too |
|
|
|
|
The network: `h1 (10.0.0.1) --- s1 --- h2 (10.0.0.2)`. The switch s1 holds every packet for 10 ms, so a round trip takes 20 ms. h1 connects to h2, sends 3000 bytes, and says it is done sending; h2 counts the bytes, answers `got 3000 bytes`, and closes.
|
|
|
|
## Build and run
|
|
|
|
In the course container, from this folder:
|
|
|
|
```
|
|
python3 capture.py
|
|
python3 capture.py --relative
|
|
python3 capture.py slow
|
|
python3 capture.py udp
|
|
python3 capture.py show captures/tcp.pcap
|
|
```
|
|
|
|
`capture.py` on its own prints the TCP connection with sequence numbers as sent; `--relative` counts them from the start of the connection, the way Wireshark shows them. `slow` has h2 read slowly so the window closes, `udp` sends the same 3000 bytes over UDP, and `show` prints a saved capture again. Every run starts a new connection, so the raw sequence numbers change each time.
|
|
|
|
## Reading the output
|
|
|
|
One line per packet, captured at h1:
|
|
|
|
| Column | Meaning |
|
|
| :--- | :--- |
|
|
| `time (ms)` | milliseconds since the first packet |
|
|
| `direction` | who sent it |
|
|
| `flags` | the TCP flags that are set |
|
|
| `seq` | the sequence number of the segment's first byte |
|
|
| `ack` | the next byte the sender expects from the other side (only when ACK is set) |
|
|
| `len` | bytes of data carried, not counting headers |
|
|
| `win` | the window: how many more bytes the sender of this segment will accept |
|
|
| `note` | what tshark noticed, such as a zero window |
|
|
|
|
Two TCP options are turned off so the numbers match the lecture: timestamps and window scaling. A capture from your own computer will have both.
|