IP协议报文格式
IP协议（Internet Protocol）是TCP/IP协议族中最核心的协议，提供不可靠的、无连接的、尽力而为的数据报传输服务。
一、IP头报文格式
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version| IHL |Type of Service| Total Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Identification |Flags| Fragment Offset |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Time to Live | Protocol | Header Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Destination Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
二、IP头报文字段解释
|
字段 |
长度 |
含义 |
|---|---|---|
|
Version |
4比特 |
|
|
IHL |
4比特 |
首部长度，如果不带Option字段，则为20，最长为60，该值限制了记录路由选项。以4字节为一个单位。 |
|
Type of Service |
8比特 |
服务类型。只有在有QoS差分服务要求时这个字段才起作用。 |
|
Total Length |
16比特 |
总长度，整个IP数据报的长度，包括首部和数据之和，单位为字节，最长65535，总长度必须不超过最大传输单元MTU。 |
|
Identification |
16比特 |
标识，主机每发一个报文，加1，分片重组时会用到该字段。 |
|
Flags |
3比特 |
标志位： 图2 IP Flag字段格式
0 1 2
+-----+------+------+
| 0 | DF | MF |
+-----+------+------+
|
|
Fragment Offset |
13比特 |
片偏移：分片重组时会用到该字段。表示较长的分组在分片后，某片在原分组中的相对位置。以8个字节为偏移单位。 |
|
Time to Live |
8比特 |
生存时间：可经过的最多路由数，即数据包在网络中可通过的路由器数的最大值。 |
|
Protocol |
8比特 |
协议：下一层协议。指出此数据包携带的数据使用何种协议，以便目的主机的IP层将数据部分上交给哪个进程处理。 常见值：
|
|
Header Checksum |
16比特 |
首部检验和，只检验数据包的首部，不检验数据部分。这里不采用CRC检验码，而采用简单的计算方法。 |
|
Source Address |
32比特 |
源IP地址。 |
|
Destination Address |
32比特 |
目的IP地址。 |
|
Options |
可变 |
选项字段，用来支持排错，测量以及安全等措施，内容丰富。选项字段长度可变，从1字节到40字节不等，取决于所选项的功能。 |
|
Padding |
可变 |
填充字段，全填0。 |
三、IP Header Options
|
CLASS |
NUMBER |
长度 |
含义 |
|---|---|---|---|
|
0 |
0 |
- |
Code为0代表了选项列表的结束，放在所有选项链表的后面，用来补字节对齐。 该选项无长度字段，占一个字节。 选项格式如下： +--------+
|00000000|
+--------+
Type=0
|
|
0 |
1 |
- |
表示无操作的选项。用在各种选项之间，占一个字节。用于填充4字节对齐。 选项格式如下： +--------+
|00000001|
+--------+
Type=1
|
|
0 |
2 |
11字节 |
表示安全和处理限制的选项。 该选项提供一种主机可以发送安全、分隔、处理限制及TCC（关闭使用组）的参数功能。 选项格式如下： +--------+--------+---//---+---//---+---//---+---//---+
|10000010|00001011|SSS SSS|CCC CCC|HHH HHH| TCC |
+--------+--------+---//---+---//---+---//---+---//---+
Type=130 Length=11
|
|
0 |
3 |
可变 |
松散的源站选路（为数据报指定一系列必须经过的IP地址） 选项格式如下： +--------+--------+--------+---------//--------+
|10000011| length | pointer| route data |
+--------+--------+--------+---------//--------+
Type=131
|
|
0 |
7 |
可变 |
记录路径（让每个路由器都记下它的IP地址）。 选项格式如下： +--------+--------+--------+---------//--------+
|00000111| length | pointer| route data |
+--------+--------+--------+---------//--------+
Type=7
|
|
0 |
8 |
4字节 |
流标识选项。该选项长度固定为4字节，code值为136，后面的字段固定为0x02，流ID为2字节。该选项提供了一种携带SATNET流标识符通过不支持流方式的网络。 选项格式如下： +--------+--------+--------+--------+
|10001000|00000010| Stream ID |
+--------+--------+--------+--------+
Type=136 Length=4
|
|
0 |
9 |
可变 |
严格的源站选路选项。与宽松的源站选路类似，但是要求只能经过指定的这些地址，不能经过其他的地址。 选项格式如下： +--------+--------+--------+---------//--------+
|10001001| length | pointer| route data |
+--------+--------+--------+---------//--------+
Type=137
|
|
2 |
4 |
可变 |
时间戳选项。 选项格式如下： +--------+--------+--------+--------+
|01000100| length | pointer|oflw|flg|
+--------+--------+--------+--------+
| internet address |
+--------+--------+--------+--------+
| timestamp |
+--------+--------+--------+--------+
| . |
.
.
Type = 68
|
四、IP报文示例
Frame 1: 94 bytes on wire (752 bits), 94 bytes captured (752 bits)
Encapsulation type: Ethernet (1)
Arrival Time: Jan 27, 2010 00:54:37.128187000
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1264524877.128187000 seconds
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 94 bytes (752 bits)
Capture Length: 94 bytes (752 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:ip:udp:gtp:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: 00:18:82:c6:59:6a (00:18:82:c6:59:6a), Dst: 00:18:82:c6:57:df (00:18:82:c6:57:df)
Destination: 00:18:82:c6:57:df (00:18:82:c6:57:df)
Address: 00:18:82:c6:57:df (00:18:82:c6:57:df)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: 00:18:82:c6:59:6a (00:18:82:c6:59:6a)
Address: 00:18:82:c6:59:6a (00:18:82:c6:59:6a)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IP (0x0800)
Internet Protocol Version 4, Src: 10.206.184.1 (10.206.184.1), Dst: 10.206.130.115 (10.206.130.115)
Version: 4
Header Length: 20 bytes
Differentiated Services Field: 0x48 (DSCP 0x12: Assured Forwarding 21; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0100 10.. = Differentiated Services Codepoint: Assured Forwarding 21 (0x12)
.... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 80
Identification: 0x1eec (7916)
Flags: 0x00
0... .... = Reserved bit: Not set
.0.. .... = Don't fragment: Not set
..0. .... = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (17)
Header checksum: 0x6757 [validation disabled]
[Good: False]
[Bad: False]
Source: 10.206.184.1 (10.206.184.1)
Destination: 10.206.130.115 (10.206.130.115)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
User Datagram Protocol, Src Port: gtp-user (2152), Dst Port: gtp-user (2152)
Source Port: gtp-user (2152)
Destination Port: gtp-user (2152)
Length: 60
Checksum: 0x0000 (none)
[Good Checksum: False]
[Bad Checksum: False]
[Stream index: 0]
GPRS Tunneling Protocol
Flags: 0x32
001. .... = Version: GTP release 99 version (1)
...1 .... = Protocol type: GTP (1)
.... 0... = Reserved: 0
.... .0.. = Is Next Extension Header present?: No
.... ..1. = Is Sequence Number present?: Yes
.... ...0 = Is N-PDU number present?: No
Message Type: T-PDU (0xff)
Length: 44
TEID: 0x19086922
Sequence number: 0x3cd9
T-PDU Data 40 bytes
Internet Protocol Version 4, Src: 10.96.106.89 (10.96.106.89), Dst: 10.137.190.243 (10.137.190.243)
Version: 4
Header Length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 40
Identification: 0x8764 (34660)
Flags: 0x02 (Don't Fragment)
0... .... = Reserved bit: Not set
.1.. .... = Don't fragment: Set
..0. .... = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: TCP (6)
Header checksum: 0x9c35 [validation disabled]
[Good: False]
[Bad: False]
Source: 10.96.106.89 (10.96.106.89)
Destination: 10.137.190.243 (10.137.190.243)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 10370 (10370), Dst Port: mstmg-sstp (6601), Seq: 1, Ack: 1, Len: 0
Source Port: 10370 (10370)
Destination Port: mstmg-sstp (6601)
[Stream index: 0]
[TCP Segment Len: 0]
Sequence number: 1 (relative sequence number)
Acknowledgment number: 1 (relative ack number)
Header Length: 20 bytes
.... 0000 0001 0000 = Flags: 0x010 (ACK)
000. .... .... = Reserved: Not set
...0 .... .... = Nonce: Not set
.... 0... .... = Congestion Window Reduced (CWR): Not set
.... .0.. .... = ECN-Echo: Not set
.... ..0. .... = Urgent: Not set
.... ...1 .... = Acknowledgment: Set
.... .... 0... = Push: Not set
.... .... .0.. = Reset: Not set
.... .... ..0. = Syn: Not set
.... .... ...0 = Fin: Not set
Window size value: 17520
[Calculated window size: 17520]
[Window size scaling factor: -1 (unknown)]
Checksum: 0xcf19 [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Urgent pointer: 0
五、IP协议栈结构
+------+ +-----+ +-----+ +-----+
|Telnet| | FTP | | TFTP| ... | ... |
+------+ +-----+ +-----+ +-----+
| | | |
+-----+ +-----+ +-----+
| TCP | | UDP | ... | ... |
+-----+ +-----+ +-----+
| | |
+--------------------------+----+
| Internet Protocol & ICMP |
+--------------------------+----+
|
+---------------------------+
| Local Network Protocol |
+---------------------------+
发表评论