Unit 4: TCP, UDP and ports · Lesson 2 of 6 · 16 min
The three-way handshake
Follow SYN, SYN-ACK and ACK in a capture, then watch the connection close.
mission
- You are
- The analyst checking a monitoring alert.
- Situation
- A monitor says connections to web01 on 443 are opening and closing without data. You have one of them in handshake.pcap.
- Goal
- Read the full life of one TCP connection and say whether it completed normally.
- Hand in
- The number of connections opened in http.pcap, for comparison.
The handshake as a mail ropeway
List the connection
The flags in square brackets tell the story: SYN to open, SYN-ACK to agree, ACK to confirm, FIN to close.
tshark -r handshake.pcap
1 0.000000 10.10.0.23 → 10.20.0.11 TCP 54 52044 → 443 [SYN] Seq=0 Win=64240 Len=0
2 0.000400 10.20.0.11 → 10.10.0.23 TCP 54 443 → 52044 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0
3 0.000800 10.10.0.23 → 10.20.0.11 TCP 54 52044 → 443 [ACK] Seq=1 Ack=1 Win=64240 Len=0
4 0.010800 10.10.0.23 → 10.20.0.11 TCP 54 52044 → 443 [FIN, ACK] Seq=1 Ack=1 Win=64240 Len=0
5 0.011200 10.20.0.11 → 10.10.0.23 TCP 54 443 → 52044 [FIN, ACK] Seq=1 Ack=2 Win=65160 Len=0
6 0.011600 10.10.0.23 → 10.20.0.11 TCP 54 52044 → 443 [ACK] Seq=2 Ack=2 Win=64240 Len=0
you should see A clean open and a clean close with no data in between. A health check, most likely.
Count connection attempts
A connection starts with a SYN that is not also an ACK. Counting those counts connections.
tshark -r http.pcap -Y 'tcp.flags.syn==1 && tcp.flags.ack==0' | wc -l
3
you should see Three connections, one per web page.
Read the same flags in tcpdump
tcpdump writes [S] for SYN, [S.] for SYN-ACK, [.] for ACK and [F.] for FIN-ACK.
tcpdump -nn -r handshake.pcap -c 3
reading from file handshake.pcap, link-type EN10MB (Ethernet), snapshot length 65535
09:01:00.000000 IP 10.10.0.23.52044 > 10.20.0.11.443: Flags [S], seq 3717026329, win 64240, length 0
09:01:00.000400 IP 10.20.0.11.443 > 10.10.0.23.52044: Flags [S.], seq 3656664648, ack 3717026330, win 65160, length 0
09:01:00.000800 IP 10.10.0.23.52044 > 10.20.0.11.443: Flags [.], ack 1, win 64240, length 0
Time the handshake
The gap between SYN and SYN-ACK is the round trip to the server.
tshark -r handshake.pcap -T fields -e frame.number -e frame.time_delta -e tcp.flags.str | head -n 3
1 0.000000000 ··········S·
2 0.000400000 ·······A··S·
3 0.000400000 ·······A····
you should see 0.4 ms each way: the server is on the local network.
defender tip Round-trip time is a cheap distance check. A local server suddenly answering in 80 ms is worth a second look.
What a defender takes away
- 1SYN, SYN-ACK, ACK opens. FIN from each side closes.
- 2Count SYNs without ACK to count connection attempts.
- 3Lots of opens without data is either health checks or someone checking which doors exist.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.