一、TCP/IP数据包基础知识

 Type包含IPv4/ARP/IPv6

 Protocol包含TCP/UDP/ICMP/IGMP/IGRP/GRE/ESP/AH

 

 

python print_pcap.py --pcapfile=data/pcap_pub/wireshark/mysql_complete.pcap

[TCP]	[1216309825.14	2008-07-17 15:50:25]	192.168.0.254:56162(00:00:00:00:00:00) ----->192.168.0.254:3306(00:00:00:00:00:00)	SEQ=3436755789	ACK=0	FLAGS=['SYN']	WIN=32792	DATA=	ttl=64	DATA_BINARY=	LEN=0
[TCP]	[1216309825.14	2008-07-17 15:50:25]	192.168.0.254:3306(00:00:00:00:00:00) ----->192.168.0.254:56162(00:00:00:00:00:00)	SEQ=3442775511	ACK=3436755790	FLAGS=['ACK', 'SYN']	WIN=32768	DATA=	ttl=64	DATA_BINARY=	LEN=0
[TCP]	[1216309825.14	2008-07-17 15:50:25]	192.168.0.254:56162(00:00:00:00:00:00) ----->192.168.0.254:3306(00:00:00:00:00:00)	SEQ=3436755790	ACK=3442775512	FLAGS=['ACK']	WIN=513	DATA=	ttl=64	DATA_BINARY=	LEN=0

（2）UDP头

包含源端口地址，目的端口地址

（3）ICMP头

包含：ICMP Type与各种Type对应的Code

四、应用层数据