transmission control protocol - wireshark · everything you always wanted to know about tcp* (*but...
TRANSCRIPT
![Page 1: Transmission Control Protocol - Wireshark · everything you always wanted to know about TCP* (*but were afraid to ask) #sf17eu •Estoril, Portugal Transmission Control Protocol Illustrated](https://reader033.vdocument.in/reader033/viewer/2022050608/5fafbe9927675d389f09f641/html5/thumbnails/1.jpg)
#sf17eu • Estoril, Portugal Transmission Control Protocol Illustrated 2
Uli Heilmeier
SharkFest ’17 Europe
#sf17eu • Estoril, Portugal • 7-10 november 2017
8 November 2017
Transmission Control Protocol Illustrated:
everything you always wanted to know about TCP*(*but were afraid to ask)
![Page 2: Transmission Control Protocol - Wireshark · everything you always wanted to know about TCP* (*but were afraid to ask) #sf17eu •Estoril, Portugal Transmission Control Protocol Illustrated](https://reader033.vdocument.in/reader033/viewer/2022050608/5fafbe9927675d389f09f641/html5/thumbnails/2.jpg)
#sf17eu • Estoril, Portugal Transmission Control Protocol Illustrated 3
![Page 3: Transmission Control Protocol - Wireshark · everything you always wanted to know about TCP* (*but were afraid to ask) #sf17eu •Estoril, Portugal Transmission Control Protocol Illustrated](https://reader033.vdocument.in/reader033/viewer/2022050608/5fafbe9927675d389f09f641/html5/thumbnails/3.jpg)
#sf17eu • Estoril, Portugal Transmission Control Protocol Illustrated 4
PCAPshttps://www.dropbox.com/s/wfarn3dfp5ro3dc/14_
TCP_Illustrated_SF17EU.zip?dl=0
![Page 4: Transmission Control Protocol - Wireshark · everything you always wanted to know about TCP* (*but were afraid to ask) #sf17eu •Estoril, Portugal Transmission Control Protocol Illustrated](https://reader033.vdocument.in/reader033/viewer/2022050608/5fafbe9927675d389f09f641/html5/thumbnails/4.jpg)
#sf17eu • Estoril, Portugal Transmission Control Protocol Illustrated 5
SEQ #
![Page 5: Transmission Control Protocol - Wireshark · everything you always wanted to know about TCP* (*but were afraid to ask) #sf17eu •Estoril, Portugal Transmission Control Protocol Illustrated](https://reader033.vdocument.in/reader033/viewer/2022050608/5fafbe9927675d389f09f641/html5/thumbnails/5.jpg)
#sf17eu • Estoril, Portugal Transmission Control Protocol Illustrated 6
SYN | FIN
01_TCP_SYN_FIN.pcapng
![Page 6: Transmission Control Protocol - Wireshark · everything you always wanted to know about TCP* (*but were afraid to ask) #sf17eu •Estoril, Portugal Transmission Control Protocol Illustrated](https://reader033.vdocument.in/reader033/viewer/2022050608/5fafbe9927675d389f09f641/html5/thumbnails/6.jpg)
#sf17eu • Estoril, Portugal Transmission Control Protocol Illustrated 7
Zero Window
04_TCP_zero_window_fast_retransmit.pcapng
![Page 7: Transmission Control Protocol - Wireshark · everything you always wanted to know about TCP* (*but were afraid to ask) #sf17eu •Estoril, Portugal Transmission Control Protocol Illustrated](https://reader033.vdocument.in/reader033/viewer/2022050608/5fafbe9927675d389f09f641/html5/thumbnails/7.jpg)
#sf17eu • Estoril, Portugal Transmission Control Protocol Illustrated 8
Dup ACKs!1!
04_TCP_zero_window_fast_retransmit.pcapng
![Page 8: Transmission Control Protocol - Wireshark · everything you always wanted to know about TCP* (*but were afraid to ask) #sf17eu •Estoril, Portugal Transmission Control Protocol Illustrated](https://reader033.vdocument.in/reader033/viewer/2022050608/5fafbe9927675d389f09f641/html5/thumbnails/8.jpg)
#sf17eu • Estoril, Portugal Transmission Control Protocol Illustrated 9
Window Size ∼108k
1460 bytes MSS➜ ∼74 packets in flight➜ ∼74 Dup ACKS
![Page 9: Transmission Control Protocol - Wireshark · everything you always wanted to know about TCP* (*but were afraid to ask) #sf17eu •Estoril, Portugal Transmission Control Protocol Illustrated](https://reader033.vdocument.in/reader033/viewer/2022050608/5fafbe9927675d389f09f641/html5/thumbnails/9.jpg)
#sf17eu • Estoril, Portugal Transmission Control Protocol Illustrated 10
Bandwidth ≌ Throughput ?
05_TCP_WS_RTT1.pcapng
![Page 10: Transmission Control Protocol - Wireshark · everything you always wanted to know about TCP* (*but were afraid to ask) #sf17eu •Estoril, Portugal Transmission Control Protocol Illustrated](https://reader033.vdocument.in/reader033/viewer/2022050608/5fafbe9927675d389f09f641/html5/thumbnails/10.jpg)
#sf17eu • Estoril, Portugal Transmission Control Protocol Illustrated 11
Bandwidth Delay Product
Receive Buffer (max WS) / RTT
![Page 11: Transmission Control Protocol - Wireshark · everything you always wanted to know about TCP* (*but were afraid to ask) #sf17eu •Estoril, Portugal Transmission Control Protocol Illustrated](https://reader033.vdocument.in/reader033/viewer/2022050608/5fafbe9927675d389f09f641/html5/thumbnails/11.jpg)
#sf17eu • Estoril, Portugal Transmission Control Protocol Illustrated 12
theory:1MB WS / 0.123s ➜∼68MBit/s
practice:40kB WS / 0.123s ➜∼2.6MBit/s
![Page 12: Transmission Control Protocol - Wireshark · everything you always wanted to know about TCP* (*but were afraid to ask) #sf17eu •Estoril, Portugal Transmission Control Protocol Illustrated](https://reader033.vdocument.in/reader033/viewer/2022050608/5fafbe9927675d389f09f641/html5/thumbnails/12.jpg)
#sf17eu • Estoril, Portugal Transmission Control Protocol Illustrated 13
Receive Buffer FTW ?
06_TCP_WS_RTT2.pcapng
![Page 13: Transmission Control Protocol - Wireshark · everything you always wanted to know about TCP* (*but were afraid to ask) #sf17eu •Estoril, Portugal Transmission Control Protocol Illustrated](https://reader033.vdocument.in/reader033/viewer/2022050608/5fafbe9927675d389f09f641/html5/thumbnails/13.jpg)
#sf17eu • Estoril, Portugal Transmission Control Protocol Illustrated 14
theory:4MB WS / 0.115s ➜∼292MBit/s
practice:525kB WS / 0.115s ➜∼36.5MBit/s
![Page 14: Transmission Control Protocol - Wireshark · everything you always wanted to know about TCP* (*but were afraid to ask) #sf17eu •Estoril, Portugal Transmission Control Protocol Illustrated](https://reader033.vdocument.in/reader033/viewer/2022050608/5fafbe9927675d389f09f641/html5/thumbnails/14.jpg)
#sf17eu • Estoril, Portugal Transmission Control Protocol Illustrated 15
![Page 15: Transmission Control Protocol - Wireshark · everything you always wanted to know about TCP* (*but were afraid to ask) #sf17eu •Estoril, Portugal Transmission Control Protocol Illustrated](https://reader033.vdocument.in/reader033/viewer/2022050608/5fafbe9927675d389f09f641/html5/thumbnails/15.jpg)
#sf17eu • Estoril, Portugal Transmission Control Protocol Illustrated 16
Perfect ?
07_TCP_WS_RTT3.pcapng
![Page 16: Transmission Control Protocol - Wireshark · everything you always wanted to know about TCP* (*but were afraid to ask) #sf17eu •Estoril, Portugal Transmission Control Protocol Illustrated](https://reader033.vdocument.in/reader033/viewer/2022050608/5fafbe9927675d389f09f641/html5/thumbnails/16.jpg)
#sf17eu • Estoril, Portugal Transmission Control Protocol Illustrated 17
slow start ruining it all
![Page 17: Transmission Control Protocol - Wireshark · everything you always wanted to know about TCP* (*but were afraid to ask) #sf17eu •Estoril, Portugal Transmission Control Protocol Illustrated](https://reader033.vdocument.in/reader033/viewer/2022050608/5fafbe9927675d389f09f641/html5/thumbnails/17.jpg)
#sf17eu • Estoril, Portugal Transmission Control Protocol Illustrated 18
Keep Alive
03_TCP_keep_alive.pcapng
![Page 18: Transmission Control Protocol - Wireshark · everything you always wanted to know about TCP* (*but were afraid to ask) #sf17eu •Estoril, Portugal Transmission Control Protocol Illustrated](https://reader033.vdocument.in/reader033/viewer/2022050608/5fafbe9927675d389f09f641/html5/thumbnails/18.jpg)
#sf17eu • Estoril, Portugal Transmission Control Protocol Illustrated 19
RFC793bis
https://tools.ietf.org/html/draft-ietf-tcpm-rfc793bis-06
![Page 19: Transmission Control Protocol - Wireshark · everything you always wanted to know about TCP* (*but were afraid to ask) #sf17eu •Estoril, Portugal Transmission Control Protocol Illustrated](https://reader033.vdocument.in/reader033/viewer/2022050608/5fafbe9927675d389f09f641/html5/thumbnails/19.jpg)
#sf17eu • Estoril, Portugal Transmission Control Protocol Illustrated 20
Questions?
Email: [email protected]: @pizza_4u
![Page 20: Transmission Control Protocol - Wireshark · everything you always wanted to know about TCP* (*but were afraid to ask) #sf17eu •Estoril, Portugal Transmission Control Protocol Illustrated](https://reader033.vdocument.in/reader033/viewer/2022050608/5fafbe9927675d389f09f641/html5/thumbnails/20.jpg)
#sf17eu • Estoril, Portugal Transmission Control Protocol Illustrated 21
Size ?
02_TCP_sequence_number.pcapng
![Page 21: Transmission Control Protocol - Wireshark · everything you always wanted to know about TCP* (*but were afraid to ask) #sf17eu •Estoril, Portugal Transmission Control Protocol Illustrated](https://reader033.vdocument.in/reader033/viewer/2022050608/5fafbe9927675d389f09f641/html5/thumbnails/21.jpg)
#sf17eu • Estoril, Portugal Transmission Control Protocol Illustrated 22
4 bytes field ➜ ∼4 GB payload
1 Gbit/s ≈ 33 sec10 Gbit/s ≈ 3.5 sec