1. 程式人生 > 其它 >使用TCPdump 抓取http報文 ,解析http報文格式及客戶端、服務端互動過程

使用TCPdump 抓取http報文 ,解析http報文格式及客戶端、服務端互動過程

技術標籤:網路TCP...httptcpiptcpdump

目錄

一.3次握手建立連線

二.客戶端傳送請求: 請求行(URL POST http版本 ) + 請求頭部 + 請求資料

三.服務端響應: 【狀態行(版本 狀態碼 狀態描述 回車 換行)+響應頭部(值 回車 換行)】+響應正文

四、 4次揮手


一.3次握手建立連線

11:23:00.792238 IP icset.49771 > 20.201.27.113.8089: S 4184594686:4184594686(0) win 5840 <mss 1460,sackOK,timestamp 911221237 0,nop,wscale 7>
        0x0000:  4500 003c f90b 4000 4006 d0c9 14c8 2be5  E..<
[email protected]
@.....+. 0x0010: 14c9 1b71 c26b 1f99 f96b d8fe 0000 0000 ...q.k...k...... 0x0020: a002 16d0 b394 0000 0204 05b4 0402 080a ................ 0x0030: 3650 21f5 0000 0000 0103 0307 6P!......... 11:23:00.792757 IP 20.201.27.113.8089 > icset.49771: S 953016439:953016439(0) ack 4184594687 win 28960 <mss 1460,sackOK,timestamp 304447332 911221237,nop,wscale 7> 0x0000: 4500 003c 0000 4000 3d06 ccd5 14c9 1b71 E..<
[email protected]
=......q 0x0010: 14c8 2be5 1f99 c26b 38cd e077 f96b d8ff ..+....k8..w.k.. 0x0020: a012 7120 ae64 0000 0204 05b4 0402 080a ..q..d.......... 0x0030: 1225 7f64 3650 21f5 0103 0307 .%.d6P!..... 11:23:00.792766 IP icset.49771 > 20.201.27.113.8089: . ack 1 win 46 <nop,nop,timestamp 911221237 304447332> 0x0000: 4500 0034 f90d 4000 4006 d0cf 14c8 2be5
[email protected]
@.....+. 0x0010: 14c9 1b71 c26b 1f99 f96b d8ff 38cd e078 ...q.k...k..8..x 0x0020: 8010 002e 4e23 0000 0101 080a 3650 21f5 ....N#......6P!. 0x0030: 1225 7f64 .%.d

二.客戶端傳送 請求行(URL POST http版本 ) + 請求頭部 + 請求資料

HTTP請求格式(請求協議):

img

請求行 :POST /xxx/xxx/xx/URL HTTP/1.1

請求頭部: Timeout: 60 ...........

請求資料 : JSON資料

1、=====傳送請求行
11:23:00.793257 IP icset.49771 > 20.201.27.113.8089: P 1:44(43) ack 1 win 46 <nop,nop,timestamp 911221238 304447332>
        0x0000:  4500 005f f90f 4000 4006 d0a2 14c8 2be5  [email protected]@.....+.
        0x0010:  14c9 1b71 c26b 1f99 f96b d8ff 38cd e078  ...q.k...k..8..x
        0x0020:  8018 002e 55b2 0000 0101 080a 3650 21f6  ....U.......6P!.
        0x0030:  1225 7f64 504f 5354 202f 7073 6263 2f61  .%.dPOST./xxxx/a  
        0x0040:  7069 2f68 6172 6477 6172 652f 3835 3131  pi/xxxxxxxx/8511
        0x0050:  3630 3537 2048 5454 502f 312e 310d 0a    6057.HTTP/1.1..
11:23:00.793447 IP 20.201.27.113.8089 > icset.49771: . ack 44 win 227 <nop,nop,timestamp 304447333 911221238>
        0x0000:  4500 0034 9f1d 4000 3d06 2dc0 14c9 1b71  [email protected]=.-....q
        0x0010:  14c8 2be5 1f99 c26b 38cd e078 f96b d92a  ..+....k8..x.k.*
        0x0020:  8010 00e3 4d41 0000 0101 080a 1225 7f65  ....MA.......%.e
        0x0030:  3650 21f6                                6P!.
2、=====傳送請求頭
11:23:00.796637 IP icset.49771 > 20.201.27.113.8089: P 44:178(134) ack 1 win 46 <nop,nop,timestamp 911221241 304447333>
        0x0000:  4500 00ba f911 4000 4006 d045 14c8 2be5  [email protected]@..E..+.
        0x0010:  14c9 1b71 c26b 1f99 f96b d92a 38cd e078  ...q.k...k.*8..x
        0x0020:  8018 002e b47d 0000 0101 080a 3650 21f9  .....}......6P!.
        0x0030:  1225 7f65 436f 6e74 656e 742d 5479 7065  .%.eContent-Type
        0x0040:  3a20 6170 706c 6963 6174 696f 6e2f 6a73  :.application/js
        0x0050:  6f6e 0d0a 5469 6d65 6f75 743a 2036 300d  on..Timeout:.60.
        0x0060:  0a43 6f6e 6e65 6374 696f 6e3a 2063 6c6f  .Connection:.clo
        0x0070:  7365 0d0a 486f 7374 3a20 3230 2e32 3031  se..Host:.20.201
        0x0080:  2e32 372e 3131 330d 0a43 6f6e 7465 6e74  .27.113..Content
        0x0090:  2d4c 656e 6774 683a 2039 3536 0d0a 5573  -Length:.956..Us
        0x00a0:  6572 2d41 6765 6e74 3a20 6c69 6267 6874  er-Agent:.libght
        0x00b0:  7470 2f31 2e30 0d0a 0d0a                 tp/1.0....
11:23:00.796918 IP 20.201.27.113.8089 > icset.49771: . ack 178 win 235 <nop,nop,timestamp 304447337 911221241>
        0x0000:  4500 0034 9f1e 4000 3d06 2dbf 14c9 1b71  [email protected]=.-....q
        0x0010:  14c8 2be5 1f99 c26b 38cd e078 f96b d9b0  ..+....k8..x.k..
        0x0020:  8010 00eb 4cac 0000 0101 080a 1225 7f69  ....L........%.i
        0x0030:  3650 21f9                                6P!.

        
3、======客戶端傳送請求報文
11:23:00.797029 IP icset.49771 > 20.201.27.113.8089: P 178:1134(956) ack 1 win 46 <nop,nop,timestamp 911221242 304447337>
        0x0000:  4500 03f0 f913 4000 4006 cd0d 14c8 2be5  [email protected]@.....+.
        0x0010:  14c9 1b71 c26b 1f99 f96b d9b0 38cd e078  ...q.k...k..8..x
        0x0020:  8018 002e f206 0000 0101 080a 3650 21fa  ............6P!.
        0x0030:  1225 7f69 7b0a 0922 6368 616e 6e65 6c4e  .%.i{.."channelN
        0x0040:  6f22 3a09 2233 3922 2c0a 0922 676c 6f62  o":."39",.."glob
        0x0050:  616c 4275 7369 5472 6163 6b4e 6f22 3a09  alBusiTrackNo":.
        0x0060:  2239 3937 3131 3332 3230 3230 3132 3138  "997113220201218
        0x0070:  3131 3233 3030 696f 6330 3038 3330 3331  112300ioc0083031
        0x0080:  3239 3022 2c0a 0922 6d73 6753 4e22 3a09  290",.."msgSN":.
        0x0090:  2232 3032 3031 3231 3130 3031 3136 3035  "202012110011605
        0x00a0:  3637 3736 3230 3032 3030 3133 3239 3030  6776200200132900
        0x00b0:  3031 3333 3122 2c0a 0922 6d73 6754 7022  01331",.."msgTp"
        0x00c0:  3a09 2264 6365 702e 3630 352e 3030 312e  :."dcep.605.001.
        0x00d0:  3031 222c 0a09 2270 6572 736f 6e61 6c52  01",.."personalR
        0x00e0:  6571 5f67 7270 4864 725f 6372 6544 7454  eq_grpHdr_creDtT
        0x00f0:  6d22 3a09 2232 3032 302d 3132 2d31 3854  m":."2020-12-18T
        0x0100:  3131 3a32 333a 3030 222c 0a09 2270 6572  11:23:00",.."per
        0x0110:  736f 6e61 6c52 6571 5f67 7270 4864 725f  sonalReq_grpHdr_
        0x0120:  696e 7374 6450 7479 5f69 6e73 7464 4472  instdPty_instdDr
        0x0130:  6374 5074 7922 3a09 2243 3130 3430 3331  ctPty":."C104031
        0x0140:  3130 3035 3239 3322 2c0a 0922 7065 7273  1005293",.."pers
        0x0150:  6f6e 616c 5265 715f 6772 7048 6472 5f69  onalReq_grpHdr_i
        0x0160:  6e73 7467 5074 795f 696e 7374 6744 7263  nstgPty_instgDrc
        0x0170:  7450 7479 223a 0922 4734 3030 3130 3131  tPty":."G4001011
        0x0180:  3030 3030 3133 222c 0a09 2270 6572 736f  000013",.."perso
        0x0190:  6e61 6c52 6571 5f67 7270 4864 725f 6d73  nalReq_grpHdr_ms
        0x01a0:  6749 6422 3a09 2232 3032 3031 3231 3130  gId":."202012110
        0x01b0:  3031 3136 3035 3637 3736 3230 3032 3030  0116056776200200
        0x01c0:  3133 3239 3030 3122 2c0a 0922 7065 7273  1329001",.."pers
        0x01d0:  6f6e 616c 5265 715f 7065 7273 6f6e 616c  onalReq_personal
        0x01e0:  496e 665f 7061 7945 4e49 6422 3a09 2231  Inf_payENId":."1
        0x01f0:  3035 222c 0a09 2270 6572 736f 6e61 6c52  05",.."personalR
        0x0200:  6571 5f70 6572 736f 6e61 6c49 6e66 5f73  eq_personalInf_s
        0x0210:  6166 6544 6576 436f 6465 223a 0922 3042  afeDevCode":."0B
        0x0220:  3436 3444 3533 3438 3245 3434 3433 3245  464D53482E44432E
        0x0230:  3431 3530 3531 222c 0a09 2270 6572 736f  415051",.."perso
        0x0240:  6e61 6c52 6571 5f70 6572 736f 6e61 6c49  nalReq_personalI
        0x0250:  6e66 5f73 6166 6545 7149 6422 3a09 2234  nf_safeEqId":."4
        0x0260:  3739 3039 3231 3330 3131 3737 3334 3030  7909213011773400
        0x0270:  3038 3122 2c0a 0922 7065 7273 6f6e 616c  081",.."personal
        0x0280:  5265 715f 7065 7273 6f6e 616c 496e 665f  Req_personalInf_
        0x0290:  746d 6e6c 4964 223a 0922 3133 3538 3838  tmnlId":."135888
        0x02a0:  3838 3838 3822 2c0a 0922 7265 6365 6976  88888",.."receiv
        0x02b0:  6572 223a 0922 4331 3034 3033 3131 3030  er":."C104031100
        0x02c0:  3532 3933 222c 0a09 2273 656e 6453 7973  5293",.."sendSys
        0x02d0:  436f 6465 223a 0922 3939 3731 3133 3230  Code":."99711320
        0x02e0:  3030 3022 2c0a 0922 7365 6e64 6572 223a  000",.."sender":
        0x02f0:  0922 4734 3030 3130 3131 3030 3030 3133  ."G4001011000013
        0x0300:  222c 0a09 2273 6967 6e53 4e22 3a09 2231  ",.."signSN":."1
        0x0310:  222c 0a09 2273 6e64 4474 546d 223a 0922  ",.."sndDtTm":."
        0x0320:  3230 3230 2d31 322d 3138 5431 313a 3233  2020-12-18T11:23
        0x0330:  3a30 3022 2c0a 0922 7379 7354 7261 636b  :00",.."sysTrack
        0x0340:  4e6f 223a 0922 3939 3731 3133 3230 3030  No":."9971132000
        0x0350:  3032 3032 3031 3231 3131 3033 3632 3533  0202012111036253
        0x0360:  3835 3030 3032 3431 222c 0a09 2274 7261  85000241",.."tra
        0x0370:  6e44 6174 6522 3a09 2232 3032 3031 3231  nDate":."2020121
        0x0380:  3822 2c0a 0922 7478 4174 7472 6962 7574  8",.."txAttribut
        0x0390:  6522 3a09 2230 222c 0a09 2274 7853 6572  e":."0",.."txSer
        0x03a0:  6961 6c4e 6f22 3a09 2230 3030 3331 3239  ialNo":."0003129
        0x03b0:  3032 3032 3031 3231 3831 222c 0a09 2276  0202012181",.."v
        0x03c0:  6572 223a 0922 3031 222c 0a09 2250 6572  er":."01",.."Per
        0x03d0:  736f 6e61 6c52 6571 5f70 6572 736f 6e61  sonalReq_persona
        0x03e0:  6c49 6e66 5f6e 756d 223a 0922 3122 0a7d  lInf_num":."1".}
11:23:00.797263 IP 20.201.27.113.8089 > icset.49771: . ack 1134 win 250 <nop,nop,timestamp 304447337 911221242>
        0x0000:  4500 0034 9f1f 4000 3d06 2dbe 14c9 1b71  [email protected]=.-....q
        0x0010:  14c8 2be5 1f99 c26b 38cd e078 f96b dd6c  ..+....k8..x.k.l
        0x0020:  8010 00fa 48e0 0000 0101 080a 1225 7f69  ....H........%.i
        0x0030:  3650 21fa                                6P!.

三.服務端響應: 狀態行(版本 狀態碼 狀態描述 回車 換行)+響應頭部(值 回車 換行)+響應正文

HTTP響應格式(響應協議):

img

狀態行: HTTP/1.1 200 OK + 響應頭部

響應正文 :

1. 狀態行 (版本 狀態碼 狀態描述 回車 換行) + 應答頭部(頭欄位:值 回車 換行)
11:23:02.859112 IP 20.201.27.113.8089 > icset.49771: P 1:113(112) ack 1134 win 250 <nop,nop,timestamp 304449401 911221242>
        0x0000:  4500 00a4 9f20 4000 3d06 2d4d 14c9 1b71  [email protected]=.-M...q
        0x0010:  14c8 2be5 1f99 c26b 38cd e078 f96b dd6c  ..+....k8..x.k.l
        0x0020:  8018 00fa ccdc 0000 0101 080a 1225 8779  .............%.y
        0x0030:  3650 21fa 4854 5450 2f31 2e31 2032 3030  6P!.HTTP/1.1.200
        0x0040:  204f 4b0d 0a74 7261 6e73 6665 722d 656e  .OK..transfer-en
        0x0050:  636f 6469 6e67 3a20 6368 756e 6b65 640d  coding:.chunked.
        0x0060:  0a43 6f6e 7465 6e74 2d54 7970 653a 2061  .Content-Type:.a
        0x0070:  7070 6c69 6361 7469 6f6e 2f6a 736f 6e3b  pplication/json;
        0x0080:  6368 6172 7365 743d 5554 462d 380d 0a63  charset=UTF-8..c
        0x0090:  6f6e 6e65 6374 696f 6e3a 2063 6c6f 7365  onnection:.close
        0x00a0:  0d0a 0d0a                                ....
11:23:02.859287 IP icset.49771 > 20.201.27.113.8089: . ack 113 win 46 <nop,nop,timestamp 911223306 304449401>
        0x0000:  4500 0034 f915 4000 4006 d0c7 14c8 2be5  [email protected]@.....+.
        0x0010:  14c9 1b71 c26b 1f99 f96b dd6c 38cd e0e8  ...q.k...k.l8...
        0x0020:  8010 002e 391c 0000 0101 080a 3650 2a0a  ....9.......6P*.
        0x0030:  1225 8779                                .%.y
        
        
2、響應正文
11:23:02.860896 IP 20.201.27.113.8089 > icset.49771: P 113:1368(1255) ack 1134 win 250 <nop,nop,timestamp 304449402 911223306>
        0x0000:  4500 051b 9f21 4000 3d06 28d5 14c9 1b71  [email protected]=.(....q
        0x0010:  14c8 2be5 1f99 c26b 38cd e0e8 f96b dd6c  ..+....k8....k.l
        0x0020:  8018 00fa 17f4 0000 0101 080a 1225 877a  .............%.z
        0x0030:  3650 2a0a 3465 300d 0a7b 2263 6f64 6522  6P*.4e0..{"code"
        0x0040:  3a22 3030 3030 3030 222c 2263 6f6e 7665  :"000000","conve
        0x0050:  7274 5273 705f 6772 7048 6472 5f6d 7367  rtRsp_grpHdr_msg
        0x0060:  4964 223a 2232 3032 3031 3231 3130 3038  Id":"20201211008
        0x0070:  3136 3036 3637 3736 3230 3032 3030 3133  1606677620020013
        0x0080:  3239 3030 3122 2c22 6467 746c 456e 766c  29001","dgtlEnvl
        0x0090:  7022 3a6e 756c 6c2c 2263 6f6e 7665 7274  p":null,"convert
        0x00a0:  5273 705f 6f72 676e 6c47 7270 4864 725f  Rsp_orgnlGrpHdr_
        0x00b0:  6f72 676e 6c49 6e73 7467 5074 7922 3a22  orgnlInstgPty":"
        0x00c0:  4734 3030 3130 3131 3030 3030 3133 222c  G4001011000013",
        0x00d0:  2274 7853 6572 6961 6c4e 6f22 3a22 3030  "txSerialNo":"00
        0x00e0:  3033 3132 3930 3230 3230 3132 3138 3122  031290202012181"
        0x00f0:  2c22 7379 7354 7261 636b 4e6f 223a 2239  ,"sysTrackNo":"9
        0x0100:  3937 3131 3332 3030 3030 3230 3230 3132  9711320000202012
        0x0110:  3131 3130 3336 3235 3338 3530 3030 3234  1110362538500024
        0x0120:  3122 2c22 6d61 6322 3a6e 756c 6c2c 2272  1","mac":null,"r
        0x0130:  6573 7054 696d 6522 3a6e 756c 6c2c 2274  espTime":null,"t
        0x0140:  7261 6e73 436f 6465 223a 6e75 6c6c 2c22  ransCode":null,"
        0x0150:  636f 6e76 6572 7452 7370 5f72 7370 736e  convertRsp_rspsn
        0x0160:  496e 666f 5f63 6f6e 7465 7874 4c69 7374  Info_contextList
        0x0170:  223a 5b7b 2263 6f6e 7665 7274 5273 705f  ":[{"convertRsp_
        0x0180:  7273 7073 6e49 6e66 6f5f 636f 6e74 6578  rspsnInfo_contex
        0x0190:  744c 6973 745f 6861 7264 7761 7265 5761  tList_hardwareWa
        0x01a0:  6c6c 6574 4964 223a 2230 3038 3139 3030  lletId":"0081900
        0x01b0:  3030 3030 3332 3137 3022 2c22 636f 6e76  000032170","conv
        0x01c0:  6572 7452 7370 5f72 7370 736e 496e 666f  ertRsp_rspsnInfo
        0x01d0:  5f63 6f6e 7465 7874 4c69 7374 5f63 6f6e  _contextList_con
        0x01e0:  7465 7874 4964 223a 2230 3030 3030 3030  textId":"0000000
        0x01f0:  3030 3030 3030 3536 3522 2c22 636c 6173  000000565","clas
        0x0200:  7322 3a22 636f 6d2e 7073 6263 2e63 6273  s":"com.psbc.cbs
        0x0210:  2e64 6365 702e 6877 616c 6c65 7432 2e64  .dcep.hwallet2.d
        0x0220:  6365 702e 6474 6f2e 4948 7757 616c 6c65  cep.dto.IHwWalle
        0x0230:  7450 6572 736f 6e61 6c41 7070 6c79 5265  tPersonalApplyRe
        0x0240:  7370 6f6e 7365 2463 6f6e 7465 7874 4c69  sponse$contextLi
        0x0250:  7374 227d 5d2c 2263 6f6e 7665 7274 5273  st"}],"convertRs
        0x0260:  705f 7273 7073 6e49 6e66 5f70 7479 4964  p_rspsnInf_ptyId
        0x0270:  223a 6e75 6c6c 2c22 7665 7222 3a22 3031  ":null,"ver":"01
        0x0280:  222c 2262 6174 6368 4e6f 223a 6e75 6c6c  ","batchNo":null
        0x0290:  2c22 7265 6365 6976 6572 223a 2247 3430  ,"receiver":"G40
        0x02a0:  3031 3031 3130 3030 3031 3322 2c22 636f  01011000013","co
        0x02b0:  6e76 6572 7452 7370 5f67 7270 4864 725f  nvertRsp_grpHdr_
        0x02c0:  696e 7374 6750 7479 5f69 6e73 7467 4472  instgPty_instgDr
        0x02d0:  6374 5074 7922 3a22 4331 3034 3033 3131  ctPty":"C1040311
        0x02e0:  3030 3532 3933 222c 226d 7367 5470 223a  005293","msgTp":
        0x02f0:  2264 6365 702e 3630 362e 3030 312e 3031  "dcep.606.001.01
        0x0300:  222c 2263 6f6e 7665 7274 5273 705f 6772  ","convertRsp_gr
        0x0310:  7048 6472 5f72 6d6b 223a 6e75 6c6c 2c22  pHdr_rmk":null,"
        0x0320:  6d73 6753 4e22 3a22 3230 3230 3132 3131  msgSN":"20201211
        0x0330:  3030 3131 3630 3536 3737 3632 3030 3230  0011605677620020
        0x0340:  3031 3332 3930 3030 3133 3331 222c 226d  013290001331","m
        0x0350:  6573 7361 6765 223a 2222 2c22 7369 676e  essage":"","sign
        0x0360:  534e 223a 2231 222c 2263 6f6e 7665 7274  SN":"1","convert
        0x0370:  5273 705f 6f72 676e 6c47 7270 4864 725f  Rsp_orgnlGrpHdr_
        0x0380:  6f72 676e 6c4d 7367 4964 223a 2232 3032  orgnlMsgId":"202
        0x0390:  3031 3231 3130 3031 3136 3035 3637 3736  0121100116056776
        0x03a0:  3230 3032 3030 3133 3239 3030 3122 2c22  2002001329001","
        0x03b0:  6865 6164 584d 4c22 3a6e 756c 6c2c 2273  headXML":null,"s
        0x03c0:  6e64 4474 546d 223a 2232 3032 302d 3132  ndDtTm":"2020-12
        0x03d0:  2d31 3854 3131 3a32 343a 3436 222c 2263  -18T11:24:46","c
        0x03e0:  6f6e 7665 7274 5273 705f 7273 7073 6e49  onvertRsp_rspsnI
        0x03f0:  6e66 5f72 6a63 7449 6e66 223a 22e6 8890  nf_rjctInf":"...
        0x0400:  e58a 9f22 2c22 7365 6e64 6572 223a 2243  ...","sender":"C
        0x0410:  3130 3430 3331 3130 3035 3239 3322 2c22  1040311005293","
        0x0420:  636f 6e76 6572 7452 7370 5f67 7270 4864  convertRsp_grpHd
        0x0430:  725f 696e 7374 6450 7479 5f69 6e73 7464  r_instdPty_instd
        0x0440:  4472 6374 5074 7922 3a22 4734 3030 3130  DrctPty":"G40010
        0x0450:  3131 3030 3030 3133 222c 2263 6f6e 7665  11000013","conve
        0x0460:  7274 5273 705f 6772 7048 6472 5f63 7265  rtRsp_grpHdr_cre
        0x0470:  4474 546d 223a 2232 3032 302d 3132 2d31  DtTm":"2020-12-1
        0x0480:  3854 3131 3a32 343a 3436 222c 226e 6372  8T11:24:46","ncr
        0x0490:  7074 6e53 4e22 3a6e 756c 6c2c 2263 6f6e  ptnSN":null,"con
        0x04a0:  7665 7274 5273 705f 6f72 676e 6c47 7270  vertRsp_orgnlGrp
        0x04b0:  4864 725f 6f72 676e 6c4d 5422 3a22 6463  Hdr_orgnlMT":"dc
        0x04c0:  6570 2e36 3035 2e30 3031 2e30 3122 2c22  ep.605.001.01","
        0x04d0:  636f 6e76 6572 7452 7370 5f72 7370 736e  convertRsp_rspsn
        0x04e0:  496e 665f 726a 6374 4364 223a 2230 3030  Inf_rjctCd":"000
        0x04f0:  3022 2c22 636f 6e76 6572 7452 7370 5f72  0","convertRsp_r
        0x0500:  7370 736e 496e 665f 7273 7073 6e53 7473  spsnInf_rspsnSts
        0x0510:  223a 2250 5230 3022 7d0d 0a              ":"PR00"}..
11:23:02.861263 IP 20.201.27.113.8089 > icset.49771: P 1368:1373(5) ack 1134 win 250 <nop,nop,timestamp 304449403 911223306>
        0x0000:  4500 0039 9f22 4000 3d06 2db6 14c9 1b71  E..9."@.=.-....q
        0x0010:  14c8 2be5 1f99 c26b 38cd e5cf f96b dd6c  ..+....k8....k.l
        0x0020:  8018 00fa ef3f 0000 0101 080a 1225 877b  .....?.......%.{
        0x0030:  3650 2a0a 300d 0a0d 0a                   6P*.0....

四、 4次揮手

四次揮手     

11:23:02.861337 IP 20.201.27.113.8089 > icset.49771: F 1373:1373(0) ack 1134 win 250 <nop,nop,timestamp 304449403 911223306>
        0x0000:  4500 0034 9f23 4000 3d06 2dba 14c9 1b71  E..4.#@.=.-....q
        0x0010:  14c8 2be5 1f99 c26b 38cd e5d4 f96b dd6c  ..+....k8....k.l
        0x0020:  8011 00fa 3361 0000 0101 080a 1225 877b  ....3a.......%.{
        0x0030:  3650 2a0a                                6P*.
11:23:02.861370 IP icset.49771 > 20.201.27.113.8089: . ack 1368 win 66 <nop,nop,timestamp 911223308 304449402>
        0x0000:  4500 0034 f917 4000 4006 d0c5 14c8 2be5  [email protected]@.....+.
        0x0010:  14c9 1b71 c26b 1f99 f96b dd6c 38cd e5cf  ...q.k...k.l8...
        0x0020:  8010 0042 341e 0000 0101 080a 3650 2a0c  ...B4.......6P*.
        0x0030:  1225 877a                                .%.z
11:23:02.861428 IP icset.49771 > 20.201.27.113.8089: . ack 1373 win 66 <nop,nop,timestamp 911223308 304449403>
        0x0000:  4500 0034 f919 4000 4006 d0c3 14c8 2be5  [email protected]@.....+.
        0x0010:  14c9 1b71 c26b 1f99 f96b dd6c 38cd e5d4  ...q.k...k.l8...
        0x0020:  8010 0042 3418 0000 0101 080a 3650 2a0c  ...B4.......6P*.
        0x0030:  1225 877b                                .%.{
11:23:02.861514 IP icset.49771 > 20.201.27.113.8089: F 1134:1134(0) ack 1374 win 66 <nop,nop,timestamp 911223308 304449403>
        0x0000:  4500 0034 f91b 4000 4006 d0c1 14c8 2be5  [email protected]@.....+.
        0x0010:  14c9 1b71 c26b 1f99 f96b dd6c 38cd e5d5  ...q.k...k.l8...
        0x0020:  8011 0042 3416 0000 0101 080a 3650 2a0c  ...B4.......6P*.
        0x0030:  1225 877b                                .%.{
11:23:02.861732 IP 20.201.27.113.8089 > icset.49771: . ack 1135 win 250 <nop,nop,timestamp 304449403 911223308>
        0x0000:  4500 0034 9f24 4000 3d06 2db9 14c9 1b71  [email protected]=.-....q
        0x0010:  14c8 2be5 1f99 c26b 38cd e5d5 f96b dd6d  ..+....k8....k.m
        0x0020:  8010 00fa 335e 0000 0101 080a 1225 877b  ....3^.......%.{
        0x0030:  3650 2a0c                                6P*.