This is the final article in a three-part series devoted to studying normal traffic. As was explained in Studying Normal Traffic, Part One and Studying Normal Traffic,Part Two: Studying FTP Traffic, we often focus our attention on the characteristics of suspicious packets without first becoming familiar with the characteristics of normal traffic. A good and easy way of doing this is to generate, capture and examine your own normal traffic. The first two articles in this series showed how to capture packets using WinDump and reviewed some of the basics of normal TCP/IP traffic. In this article, we will be looking at two other aspects of normal TCP traffic: the structure of TCP packets, and the use of TCP options. Note that in order to understand this material, you should already know the fundamentals of TCP/IP.
TCP Packet Structure
If you've read the previous articles in this series or worked with tcpdump or WinDump, you are probably familiar with the format of their output for TCP traffic. If not, here's a quick review of the meaning of the fields:
這是一個學習正常的流量三個部份的最后一章。正如在講第一部分和第二部分：FTP流量研究一樣,我們要將我們的注意力集中在那些還沒有被我們熟悉其流量特征的可疑的數據報。一個簡單而又實用的方法是去產生,捕獲并且檢查你自己的正常流量。上兩章展現了如何用WinDump捕獲數據報，并且回顧了TCP/IP的一些基礎知識。在這一個文章中,我們將會看著正常TCP流量的其他二個方面: TCP的結構打包, 和TCP選擇項的使用。在此之前，為了更好地了解材料,你應該已經知道TCP/IP 的基本原理。
TCP包的結構
如果你已經看這一系列的早先文章或者合作或者有tcpdump或WinDump編程經驗, 你應該熟悉他們的輸出格式。如果還不熟悉，下面進行簡單的回顧: