=== ch09.docx
[chap]9́@lbg[N̒xƐ키

lbg[NǗ҂́AXlbg[N̒xƐȂĂ͂܂BȂAlbg[NxƂāAꂪlbg[N̔ɂȂł͂Ȃ̂łBlbg[N̒xƊiOɁA܂͖{Ƀlbg[Nx̂ǂmFKv܂B̏͂ł͂̎@Љ܂B
܂TCP̃G[Joƃt[@\ɂĐ܂BɃlbg[Nx̌ǋ@T܂BŌɃlbg[NƁAlbg[Nœ삷@T[rX̃x[XCݒĂ܂B̏͂I鍠ɂ́Albg[NxoAffAguV[eBOł͂gɂĂ͂łB

@lbg[Nx̉ɗpłeNjbN͂܂B̏͂ł͂ƂƂ̑TCPɓIi܂BTCPg΁AiICMPƓlɁj]ȃgtBbN𐶐邱ƂȂnł̉͂sƂł܂B

TCP̃G[Jo@\
TCP̃G[Jo@\́Albg[N̍xӏmFAffAC邽߂̍ŗǂ̃c[łBRs[^lbg[LOpł́AxiCeVjƂ̓pPbgMĂM܂ł̎Ԃ̂ƂłB
x͈iM父܂ŁjłAiM父܂łɉA悩瑗M܂Łjłv܂BʐM@Ԃł̒ʐMxApPbgn_ʂ̒n_֓͂܂ł̎ԂZ΁AxƂƂɂȂ܂B΂ɃpPbg͂܂łɑȎԂꍇAxƂ݂Ȃ܂Bx̓lbg[NǗ҂̍ő̓GłB
6͂ł́ATCPV[PXACKԍgƂŁApPbgmɓ]ɂĐ܂B{͂ł́AēxV[PXACKԍɒڂAxɂMɃV[PXԍꂽꍇi邢͂܂MȂꍇjATCPǂ邩Ă܂B

TCPđ
pPbg̍đ́ATCP̂Ƃ{IȃG[Jo@\̂ЂƂłB̋@\̓pPbgĥړIƂĂ܂B
pPbgɂ́AAvP[Vُ̈A[^̃gtBbNtsAꎞIȃT[rXQƂA܂܂Ȍl܂BpPbgxł͏󋵂pɂɕωApPbg͈ꎞIȂ̂łꍇ߁ATCPƂĂ͐vɂmAJo邱ƂdvƂȂ܂B
pPbgđKvǂ߂ȋ@\́Ađ^C}ƌĂ΂Ă܂B^C}RTOiđ^CAEgjƌĂ΂lɏ]ē삵܂BTCPgăpPbgMƍđ^C}X^[gÃpPbgACKMƃXgbv܂BpPbgMĂACKpPbgM܂ł̎ԂRTTiEhgbv^CjƌĂт܂B̎Ԃ̕ϒlAŏIIRTOl̎Zoɗp܂B
RTOl܂܂ŁAM̓ftHgRTTݒɊÂčs܂B̐ݒ͋@Ԃ̍ŏ̒ʐM̂߂ɐݒ肳ꂽ̂ŁAMpPbgRTTƂɁAۂRTOZo܂B
RTOl܂ƁAMepPbgɑ΂āAđ^C}pPbg̏ǂ𔻒f邽߂ɗp܂B}9-1TCP̍đ}̂łB

}9-1@TCPđ̊TO}
M̋@
̋@
f[^
đ1ځiRTOj
đ2ځiRTO~2j
đ3ځiRTO~4j
đ4ځiRTO~8j
đ5ځiRTO~16j
X|XȂRlNVI

pPbg𑗐MۂɁAM҂TCP ACKpPbg𑗐MȂƁAM͑MpPbgƔfăpPbgđ܂BđsꂽۂRTOl͔{ɂȂ܂BRTOlɒBOACKpPbg͂ȂꍇApPbg͍čđ܂BłACK͂ȂꍇARTOl͂ɔ{ɂȂ܂BACKpPbgM܂ŁA܂͍ŏɐݒ肵đ񐔂̍őlɒB܂ŁȀ͌JԂ܂BRTOl͍đ邽тɔ{Ă܂B
đ񐔂̍őlOS̐ݒɂ܂BWindows̏ꍇAftHg̍đ񐔂5łB唼Linux̏ꍇ15łB
TCPđ̃Tv邽߁At@Ctcp_retransmissions.pcapJ܂傤Bɂ6̃pPbg܂܂Ă܂B}9-2ɍŏ̃pPbg܂B

}9-2@f[^܂񂾒PTCPpPbg

648oCg̃f[^y2z܂TCP PSH/ACKpPbgy1zŁA10.3.30.110.3.71.7֑ꂽ̂ły3zBT^Iȃf[^pPbgłB
ʏ̏󋵂ł΁Aŏ̃pPbgMƂATCP ACKpPbgX|XƂđĂ͂łBł́ÃpPbgđpPbgƂȂĂ܂B́APacket ListsyCƕ܂BInfoJɂ͂͂[TCP Retransmission]ƂApPbg͍ɐԂeLXgŕ\Ă܂B}9-3Packet ListsyCɂpPbgđ̗łB

}9-3@Packet ListsyCɂpPbgđ

}9-4̂悤ɁAPacket DetailsPacket BytesyCłApPbgđꂽǂ킩܂B

}9-4@đꂽpPbg

̃pPbǵiIP[ʎq][Checksum]tB[hjX̃pPbgƓ̂łB2̃pPbgPacket BytesyCr΁Ał邱Ƃ؂ł܂y1zB
Packet DetailsyCƁAđĂpPbg[SEQ/ACK Analysis]s̉ɁA񂪂邱ƂɋCÂł傤BWireshark񋟂ĂŁApPbĝ̂ɂ͊܂܂Ă܂BSEQ/ACK͂Aꂪmɍđły3zARTOl0.206by4zARTOl1Ԗڂ̃pPbg̃f^^CiΎԁjƂɂĂ邱ƂmFł܂B
c̃pPbglŁAIP[ʎq][Checksum]tB[hRTOlقȂlƂȂ܂BepPbg̎ԍڂŊmFɂ́APacket ListsyCTimeJQƂ܂i}9-5jBđRTOl{邲ƂɁAԊԊu啝ɉтĂ邱Ƃ킩܂B
TCP̍đ@\́AM҂pPbgoۂɁAJos߂ɗp܂Bx͎M҂pPbg̏oAJoۂɗpdACKiduplicate acknowledgmentsj@\Ă݂܂傤B

}9-5@RTOl̑TimeJ

dACKƍđ
dACḰAM҂Ԃ̗ꂽpPbg󂯎ƂɑTCPpPbgłBTCṔAf[^MꂽƂƓԂŎMAēxgݗĂ邱Ƃۏ؂邽߂ɁAwb_̃V[PXԍACKԍtB[hgĂ܂B

@TCPpPbg͌ɂTCPZOgƌĂԂ̂K؂łAʂɂ̓pPbgƌĂ΂Ă܂B

VTCPRlNVmꂽƂɁAnhVFCNŌƂdvȏ̂ЂƂACjVV[PXԍiISNjłBISNRlNV̗Őݒ肳ƁApPbgM邲ƂɁÃpPbg̃f[^̃TCYV[PXԍĂ܂B
@ISN5000ŁA500oCg̃pPbg𑗐MƂ܂B̃pPbgMƁAMACKԍ5500TCP ACKpPbgŕԐM܂B

V[PXԍ{Mꂽf[^̃oCgeʁACKԍ

M֕ԂACKԍ́AM҂Ɏ󂯎V[PXԍƂƂɂȂ܂B}̂}9-6łB
	
}9-6@TCPV[PXԍACKԍ
M̋@@M̋@
V[PXԍ5000@@f[^̃TCY500
ACKԍ5500
V[PXԍ5500@f[^̃TCY500
ACKԍ6000
V[PXԍ6000@f[^̃TCY500
ACKԍ6500

M҂̓V[PXԍ΁ApPbgoł܂BV[PXԍǐՂĂ΁AԍĂȂǂmFł̂łB
zÕV[PXԍMꍇApPbgƉł܂Bf[^K؂ɑgݗĂɂ́ApPbgMKv̂ŁApPbg̃V[PXԍ܂ACKpPbgđAMɍđ𑣂܂B
M҂3dACK󂯎ƁApPbg{ɏƔfAɍđs܂BđJnƁAđpPbgM܂ŁAقׂ̂ẴpPbg̑Mꎞ~܂B̏}ɕ\̂}9-7łB

}9-7@M̏dACKđɂȂ

t@Ctcp_dupack.pcapɏdACKƍđ̃Tv܂B̃Lv`t@C̍ŏ̃pPbg}9-8łB

}9-8@ACK̃V[PXԍĂ

f[^Mҁi172.31.136.85j瑗Mҁi195.81.202.68j֑MꂽTCP ACKpPbgy1źÃLv`t@Cɂ͊܂܂ĂȂpPbgőꂽf[^ɑ΂ACKłB

@Wireshark̃ftHgݒł̓V[PXԍ̉͂ȒPɂ邽߂ɁA΃V[PXԍg悤ɂȂĂ܂Ay[W̗ʃLv`ł͂̋@\gĂ܂B̋@\𖳌ɂɂ́A[Edit][Preferences]IA[Preferences]EBhE[Protocols]A[TCP]ɑIсA[Relatice sequence numbers]̉̃{bNX̃`FbNOĂB

̃pPbgACKԍ1310973186y2zŁAꂪɎMpPbg̃V[PXԍɂȂ͂łi}9-9jB

}9-9@\ĂȂV[PXԍ̃pPbg

cOȂ玟̃pPbg̃V[PXԍ1310984130y1złB͗\̂ł͂ȂA҂pPbgM̓rŏƂӖĂ܂BM̋@́ÃpPbg̃V[PXԍĂ邱ƂoA3Ԗڂ̃pPbgƂĐ}9-10̏dACK𑗐M܂B

}9-10@ŏ̏dACKpPbg

̂ꂩ̕@ŁÃpPbgdACKpPbgł邱ƂmFł܂B

EPacket DetailsyCInfoJAɐԂŕ\ĂB
EPacket DetailsyCSEQ/ACK AnalysissWJĂ݂ƁA1Ԗڂ̃pPbg̏dACKł邱Ƃ\ĂB

}9-11̂悤ɁA̃pPbgłꂪ܂B

}9-11@V[PXԍꂽ߂ɐꂽdACK

M瑗ꂽ4Ԗڂ̃pPbǵAsK؂ȃV[PXԍĂ̂Ły1zAM2ڂ̏dACK𑗐M܂y2zBƂ܂sK؂ȃV[PXԍ̃pPbg͂߁y3zA3ڂ̍Ō̏dACK܂y4zB
M3ڂ̏dACK󂯎ƂɁAׂẴpPbg̑M𒆒fApPbgđ܂B}9-12͏pPbg̍đłB

}9-12@dACKɂpPbg̍đ

JԂ܂ApPbg̍đPacket DetailsyCInfoJŊmFł܂B̗ᓯlAnɐԕŏĂ̂ł悭܂B[SEQ/ACK Analysis]Aꂪđł邱Ƃ܂y1ziēxJԂ܂ÃpPbgđƎĂ̂́ApPbgł͂ȂWireshark̋@\łjBLv`t@C̍Ō̃pPbǵAđ̎MACKpPbgƂȂ܂B

@pPbgNTCPʐM̃f[^t[ɉe^ꍇ̂@\ƂāAZNeBuACKiSelective Acknowledgementj@\܂B̃pPbgLv`ł́Aŏ3EFCnhVFCNvZXɂāAZNeBuACKLȋ@\ƂălSVG[gĂ܂B̏ꍇpPbgďdACK󂯎ƁApPbgȊÕpPbg̎MĂ΁ApPbĝ݂đ܂BZNeBuACKLɂȂĂȂƁApPbĝƂɑMꂽׂẴpPbgApPbgƂƂɍđM܂B܂ZNeBuACKɂāAf[^̃JoIɍsƂł̂łBŐVTCP/IPX^bN̎̓ZNeBuACKT|[gĂ̂ŁAʏ͂̋@\Ă͂łB

TCP̃t[
đƏdACK̓pPbg̏ɑ΂郊Jos߂TCP@\łBTCPɃpPbg\h@\ȂƂAߎSȂƂɂȂĂƎv܂AKɂTCPɂ͂̋@\Ă܂B
TCṔApPbgN肻ɂȂƁAf[^][g𒲐ĂhXCfBOEBhEƂ@\Ă܂BXCfBOEBhÉAM҂̎MEBhEgăf[^t[𐧌䂵܂B
MEBhE͎M҂w肷lŁATCPwb_Ɋi[ĂiPʁFoCgjATCP̃obt@̈Ɋi[f[^ʂ𑗐M҂ɓ`̂łB̃obt@̈̓f[^ꎞIɕۊǂ̈ŁǍf[^̓AvP[VwvgRɓnď҂܂BM1ɑMłf[^ʂ́AWindow SizetB[hɎw肳ꂽlŌ܂܂BM҂ɑ̃f[^𑗐Mɂ́AMґ̃f[^MƂACK𑗐MKv܂B܂M҂̓f[^āATCPobt@̈󂯂Kv܂B}9-13ɎMEBhE̎dg݂}Ă܂B

}9-13@M҂󂯎f[^ʂ𐧌䂷MEBhE
NCAg@T[o
obt@̈̃TCY@EBhETCY
2500oCg
2000oCg
ACK
3000oCg
1000oCg
ACK

2500oCg
500oCg
5000oCg
2000oCg
1000oCg
5000oCg

5000oCg
5000oCg
5000oCg
5000oCg
5000oCg
5000oCg


}9-13ł́AMEBhẼTCY5000oCg̃T[oɃNCAgf[^𑗐MĂ܂BNCAg2500oCg̃f[^𑗐MƃT[õobt@̈2500oCgւƌA2000oCg500oCgւƌ܂BŃT[o͂̃f[^ACK𑗂܂Bobt@̃f[^̂ŁA܂obt@ɋ󂫂ł܂B̏JԂANCAg3000oCgA1000oCgƃf[^𑗐MAT[õobt@1000oCgւƌ܂BNCAg͍ēxACK𑗂Aobt@̃f[^܂B

EChETCY̒
EBhETCY̒͂ӖPȏłAɂ܂Ƃ͌܂BTCPf[^󂯎ƁAACKꃌX|XƂđM܂AM҂̃obt@ɂf[^ɐvɏ킯ł͂Ȃ̂łB
T[õNCAg̃pPbgɖZEĂ܂ƁAobt@󂯂ƂxĂ܂Ãf[^󂯎ꏊmۂłȂȂ܂Bt[䂪sȂ΁A̓pPbgƃf[^QɂȂ܂BKɂAT[otsăf[^xĂꍇAMEBhẼTCY𒲐邱Ƃł܂B́AACKpPbgTCPwb_ŁAEBhETCY̒l邱Ƃōs܂B}9-14ɂ̗܂B

}9-14@T[otsۂɃEBhETCY𒲐
NCAg@T[o
2000oCg
2000oCg
ACK - Window Update@1000oCg
800oCg
150oCg
ACK

obt@̈̃TCY
3000oCg
1000oCg
5000oCg
200oCg
50oCg
1000oCg

EBhETCY
5000oCg
5000oCg
1000oCg
1000oCg
1000oCg
1000oCg

}9-14ł́AT[õEBhETCY5000oCgn܂Ă܂BNCAg2000oCg̃f[^𑗂A2000oCĝŁAobt@̈̋󂫂1000oCgɂȂĂ܂܂BT[o̓obt@ɂςɂȂĂ܂ƔFÃy[XŃf[^]΁ApPbgNƔf܂BŃT[óAEBhETCY1000oCgɂƂACKNCAgɑ܂BʂƂăNCAg瑗Mf[^ʂAT[o̓f[^t[葬xŕۂAobt@̃f[^ł悤ɂȂ܂B
EBhETCY傫ꍇ܂BT[o荂Ƀf[^ł΁AEBhETCYg傷ƂACKpPbg𑗐M܂B

[EBhEʒmł̃f[^t[̈ꎞ~
T[oȏNCAg̃f[^łȂƂꍇ܂BƂĂ̓sA\͂̕sƂvl܂B炪NƃpPbgʐM̒fɂȂ܂AMEBhEɂQŏɂƂǂ߂邱Ƃ\łB
肪ꍇAT[o͎MEBhẼTCY[łƂ[EBhEʒm܂ރ[EBhEpPbg𑗐M܂BNCAg̃pPbgMƁAf[^]~܂AL[vACupPbg𑗂AT[oƂ̃RlNV͈ێ܂BL[vACupPbǵAT[o̎MEBhȄ󋵂mF邽߁AԊuő܂BT[of[^ĊJꍇɂ́A[ȊÕEBhETCYʒmpPbg𑗂܂B}9-15̓[EBhEʒm̗Ă܂B

}9-15@EBhETCY[ɐݒ肳ƃf[^]~
NCAg
T[o
2000oCg@
2000oCg
ACK@Window Update@0oCg
L[vACu
ACK@Window Update@1000oCg
900oCg

obt@̈̃TCY
3000oCg
1000oCg
0oCg
0oCg
1000oCg
100oCg

EBhETCY
5000oCg
5000oCg
0oCg
0oCg
1000oCg
1000oCg

}9-15ł́AT[o̓EBhETCY5000oCgŃf[^MJnĂ܂BNCAg4000oCg̃f[^MƁAvZbTׂɍȂANCAg̃f[^؏łȂȂĂ܂܂BT[oWindow SizetB[h0ɐݒ肵pPbg𑗐MANCAg̓f[^]𒆎~ăL[vACupPbg𑗂܂B̌T[oŃf[^M\ɂȂAEBhETCY1000oCgɂƂʒm𑗂̂ŁANCAg̓f[^MĊJ܂B

TCPXCfBOEBhE̎
TCPXCfBOEBhĚ̂ŁALv`t@Ctcp_zerowindowrecovery.pcapŎۂɌĂ݂܂傤B
̃t@C192.168.0.20192.168.0.30֑ꂽTCP ACKpPbgŎn܂Ă܂BԂ̒_Window SizetB[h̒lłAPacket ListsyCInfoJƁAPacket DetailsyCTCPwb_̗Ō܂Bŏ3̃pPbgł́ÃtB[h̒lĂ邱Ƃɕ܂i}9-16jB

}9-16@pPbgWindow SizeĂ

ŏ̃pPbg8760oCg2Ԗڂ̃pPbgł5840oCgɁA3Ԗڂ̃pPbgł͂2920oCgւƌĂ܂y1zBEBhETCY̌́AM悩̒ʐMɒxNĂꍇ̓T^Iȏ؋łBTimeJƁAEBhETCYɑĂ̂܂y2zBEBhETCYꂾƃ[܂łĂ܂ꍇAۂ4Ԗڂ̃pPbgȂĂ܂i}9-17jB

}9-17@[EBhEʒm͋@킪f[^ȏMłȂƂӖ

4Ԗڂ̃pPbg192.168.0.20192.168.0.30֑ꂽ̂łÁAȏf[^󂯎Ȃƒʒm̂ړIłBTCPwb_ɂ[ly1zAPacket ListsyCInfoJƁATCPwb_SEQ/ACK AnalysisZNVy2z΁Aꂪ[EBhEpPbgƂƂ܂B
[EBhEpPbgMƁA192.168.0.30̒ʐM@́A192.168.0.20EBhETCY̑ʒmWindow Update󂯎܂ŁAf[^𑗐M܂BŃ[EBhEN͈ꎞIȂ̂łB̂߁ÃpPbgWindow Update}9-18̂悤ɑĂ܂B
ŃEBhETCY͌SȔ͈͂64240oCg܂ő܂y1zBSEQ/ACK Analysiss΁AꂪWindow Updateƕ܂B

}9-18@f[^M\ɂȂƂ`TCPWindow UpdatepPbg

Window UpdatepPbgMƁA192.168.0.30̃zXg͍Ăуf[^M\ɂȂ̂ŁA6Ԗڂ7Ԗڂ̃pPbg𑗂܂B͔̏ɐvɍs܂Bł]ɎԂƁAf[^]̒xQNłB
xAt@Ctcp zerowindowdead.pcapɂXCfBOEBhE𒲂ׂĂ݂܂傤Bŏ̃pPbǵA195.81.202.68172.31.136.85ւ̕ʂHTTPgtBbNłB̃pPbĝƂɁA172.31.136.85[EBhEpPbgĂ܂i}9-19jB

}9-19@f[^]~߂[EBhEpPbg

͐}9-17̃[EBhEpPbgƂ悭Ă܂Aʂ͂܂Ⴂ܂B172.31.136.85̋@킪Window UpdatepPbg𑗂ĒʐMĊJʒm̂ł͂ȂA}9-20̂悤ɃL[vACupPbgĂ܂B

}9-20@L[vACupPbg̓[EBhE̋@Ƃ̃RlNVێ

̃pPbgɂ́APacket DetailsyCTCPwb_SEQ/ACK AnalysisZNVŁAL[vACuƂ邵Ă܂y1zBTimeJƁAŌ̃pPbgMꂽ3.4bɁÃpPbgꂽƂ킩܂B}9-21̂悤ɁAЕ̋@킪[EBhEpPbg𑗂AL[vACupPbg𑗂ƂA񂩑܂B

}9-21@[EBhEpPbgƃL[vACupPbg̑MxJԂ

L[vACupPbǵA3.4bA6.8bA13.5b̊ԊuőMĂ܂y1zBʐM@œ삵ĂOSɂẮȀȂ蒷Ȃ܂B̏ꍇATimeJ̒lZĂƁARlNVق25bԒ~Ă܂BhCRg[ł̔F؂AC^[lbgt@C_E[h悤ƂĂƂɁA25b̒xꂪǂł傤B䖝ł킯܂B

TCPG[ƃt[pPbgɂ
TCPē]AdACKAXCfBOEBhEɂčl@AxɊւguV[eBOsƂ̒ӓ_Ă܂B

ē]pPbg
ē]ŝ́ANCAgf[^T[oMĂȂƂɃNCAgCÂłB܂pPbg͂ꏊɂẮAē]ɋCtȂ킯łBႦ΃T[oŃf[^Lv`ĂꍇANCAg瑗MAđMꂽpPbg͎󂯎Ȃ̂ŁAē]pPbgڂɂ邱ƂłɗĂ܂܂BT[oŃpPbg̔Q҂ɂȂĂ邩mȂƎvANCAgŃgtBbNLv`łȂlĂ݂܂傤B΍ē]pPbg݂̑mFł܂B

dACKpPbg
M҂́AdACKē]̋t̂悤Ȃ̂ƍlĂ܂BƂ̂ANCAg̃pPbgrŏƂT[ooƂɑ邩łBdACK͑唼̏ꍇAǂ瑤ŃgtBbNLv`ƂłmFł܂B́A󂯎pPbgV[PXOĂƂɔ̂ł邱ƂvoĂBƂ΁AT[o3̃pPbĝ1Ԗڂ3Ԗڂ󂯎ꍇ͏dACKANCAg2Ԗڂ̃pPbgđ܂BT[o1Ԗڂ3Ԗڂ󂯎ĂꍇA2Ԗڂ̃pPbg͂Ȃ͈̂ꎞIȌɂ\AʏdACK͖M܂B񂱂̃ViIɐƂ͌܂BT[oł̃pPbg^AdACKȂꍇANCAgł̃pPbgLv`ĂB

[EBhEԂƃL[vACupPbg
XCfBOEBhÉAT[oŃf[^MAłȂȂ󋵂ƒڊ֌W܂BEBhETCYkA[EBhEԂɂȂ肷̂́AT[oŉ肪NĂƂƂȂ̂ŁAǂ炩̎ԂA𒲂ׂׂłBʏ̓T[oƃNCAg̗ŁAWindow UpdatepPbgmFł͂łB

x̌˂~߂
pPbgx̌łȂꍇ܂B2̋@Ԃ̒ʐMxĂATCPđdACKȂƂ̂łB̂悤ȏꍇAx̌ʂ̃eNjbNKvƂȂ܂B
x̌˂~߂ƂʓIȕ@̂ЂƂ́Aŏ̃nhVFCNƁÂƂɑpPbgׂ邱ƂłBɃNCAgWebT[oƃRlNVmĂāAWebT[oŃzXgĂTCguEY悤ƂƂ܂傤BŒӂKvȂ̂́ATCPnhVFCNAŏHTTP GETNGXgAGETNGXgɑ΂ACKAT[oNCAgɑŏ̃f[^pPbg\Aŏ6̃pPbgłB

@̍𗝉ɂ́AWireshark̎\`K؂ɐݒ肷Kv܂B[View][Time Display Format][Seconds Since Previous Displayed Packet]I܂B

ȒʐM
lbg[Nx[XC̏ڍׂɂẮA{͂̈ȍ~̕Ő܂Bł́Ax̏󋵂Ɣr邽߂ɁA펞̒ʐM̃x[XCKvƂƂ𗝉ĂĂB̂Ƃ̃Tvł́At@Clatency1.pcapgp܂BTCPnhVFCNHTTPʐMɂĂ͂̂ŌJԂ܂B܂Packet DetailsyC܂Bł͐}9-22Ɏ悤ɁATimeJɏœ_i܂B

}9-22@̃gtBbN͂Ɏn܂Ă萳킾ƍl

̒ʐMV[PX͔ɑAŜ0.1bĂ܂B
ȍ~̃Lv`t@ĆAgtBbNł͂܂ApPbg̑MꂽႢ܂B

ʐM̒x\\x
x̓t@Clatency2.pcapĂ݂܂傤B}9-23킩悤ɁA2̃t@C̃pPbǵA΂ׂēłB

}9-23@2Ԗڂ5Ԗڂ̃pPbgxĂ

6̃pPbgĂƂAŏ̒x̒ɋCÂ܂BNCAgi172.16.16.128jTCPnhVFCNJn邽߂ɍŏSYNpPbg𑗂ĂAT[oi74.125.95.104jSYN/ACK󂯎܂łɁA0.87b̒xꂪ܂B̓NCAgƃT[oԂɂʐM@ɂĈNx̍ŏ̒łB
]pPbg̐iAꂪ̒xłƔfł܂BT[oSYNpPbg󂯎ĂA𑗂܂łɕKvȏ͂킸łBƂ̂AgX|[gwʂɊւ邱Ƃ͂ȂłBT[õgtBbNȂ葽ƂĂAʏSYNpPbgɑ΂SYN/ACKpPbgɂvɉ邱Ƃ\łB܂T[o͍x̌ł͂܂B
NCAgx̌ł͂܂B̎_łSYN/ACKpPbgMȏ̏sĂȂłB
NCAgƃT[o̗ɖ肪ȂƂƁAŏ2̃pPbg̊ԂɁAx̌ƂƂɂȂ܂B
ĂƁA3EFCnhVFCNACKpPbgM͂ɍsANCAgHTTP GETNGXg܂B2̃pPbg𐶐鏈́ASYN/ACK󂯎ɃNCAgŃ[JɍŝŁANCAgׂ̕ȂA2̃pPbg̑M͐vɍs܂B
5Ԗڂ̃pPbgAɒxĂ܂BŏHTTP GETNGXgMꂽƁAT[oԋpꂽACKpPbg͂܂ł1.15bĂ܂BHTTP GETNGXg󂯎ƁAT[o̓f[^MJnOɂ܂TCP ACK𑗂܂ȀقƂǕS͂܂Bx̕ʂ̒łB
xƁAŏ̃nhVFCNłSYN/ACKłȂAقACKpPbgłx̒󂪎f܂B̏񂩂̓lbg[N̍x͕̌܂񂪁ANCAgƃT[ołȂƂ͂킩̂ŁA҂̊Ԃ̒ʐM@킪x̌Ƃ킩܂BŃt@CAEH[A[^AvLVȂǂ𒲂ׂ邱ƂŁAƐl邱Ƃł܂B

ʐM̒x\\NCAg̒x
̒x̃ViÍAt@Clatency3.pcapɊ܂܂Ă܂i}9-24jB

}9-24@ŏHTTP GETpPbgxĂ

̃Lv`͐vTCPnhVFCNŐɎn܂Ał͒x̒͌܂BnhVFCNƁA4Ԗڂ̃pPbgłHTTP GETNGXg܂ł́AׂĂ̂悤łBƂ낪̃pPbgŁA1.34b̒x܂B
x̌ɂ߂ɂ́A3Ԗڂ4Ԗڂ̃pPbg̊ԂŉN𒲂ׂȂ΂Ȃ܂B3Ԗڂ̃pPbg̓NCAgT[oɑꂽTCPnhVFCN̍ŌACKpPbgŁA4Ԗڂ̃pPbg̓NCAgT[oɑꂽGETNGXgłB҂ɋʂĂ̂́AǂNCAg瑗Mꂽ̂ŁAT[oƂ͖֌Wł_łBƂNCAgN_ƂȂĂ̂ŁAACKꂽƂɁAGETNGXgsׂłB
cOȂAACKGETւ̑Jڂ͐vɂ܂łBGETpPbg̐ƑMɂ̓AvP[Vwł̏Kvł̂ŁȀ̒xƂ̂́ANCAg̏ǂĂȂƂӖɂȂ܂B܂肱̒ʐM̍x̌́ANCAgɂ̂łB

ʐM̒x\\T[o̒x
Ō̒x̃ViI̓T[o̒xŁAt@Clatency4.pcapg܂i}9-25jB

}9-25@ŏIpPbg܂ōx̒󂪌Ȃ

2̋@ԂTCPnhVFCN̓X[YvɍsA܂Ă܂BŏGETNGXgƂ̉ACKpPbg̑M΂₭s܂B̃t@Cł͍ŏIpPbg܂ŁAx̒󂪌Ȃ̂łB
6Ԗڂ̃pPbǵANCAgGETNGXgɉăT[o瑗ꂽŏHTTPf[^pPbgłAT[oGETNGXgɑ΂đTCP ACK̓0.98bxĂ܂B5Ԗڂ6Ԗڂ̃pPbgւ̑Jڂ́AnhVFCNłACKGETNGXgւ̈ڍsƔɂ悭Ă܂Bł́AT[oœ_ƂȂ܂B
5Ԗڂ̃pPbǵANCAg󂯎GETNGXgɑ΂T[oACKłBT[oACKpPbg𑗐M炷Af[^MJnȂ΂Ȃ܂B̃pPbg̑Mf[^擾ApPbggݗāAMHTTPvgRɂčs܂B̓AvP[VwvgRȂ̂ŁAT[oɂ鏈xKvƂȂ܂BẴpPbg̒x́AT[õf[^ǂĂȂƂӖĂAx̗R̓T[oƂƂɂȂ܂B

xt[[N
6̃pPbggāAlbg[Nx̌T܂B̃ViI͏XGɌm܂񂪁A}9-26ۂ̒xguƂɖ𗧂͂łB{͂ǂTCPʐMɂĂ͂܂܂B

@UDPxɂĂ͂قƂǐGĂ܂BUDP͍łMႭAxo񕜂@\ĂȂłB̑Af[^z̐M߂邽߂ɗpAvP[VwvgRiICMPjA̖SĂ܂B

}9-26@ۂ̒xgủɖ𗧂}
NCAg@T[o
SYN@SYN/ACK@ACK@7wvgR̃NGXg@ACK@7wvgR̃f[^
x@NCAgx@T[ox

lbg[Nx[XC̊m
܂ȂꍇAlbg[Nx[XCAlbg[N̒x邽߂̏dvȃf[^ƂȂ܂Bł̓lbg[Nx[XCAlbg[N̂܂܂ȈʒuŎWꂽgtBbÑTvłAuȁvlbg[NgtBbNƌȂ̂łƒ`܂Blbg[Nx[XCmړÍAlbg[NʐM@킪@\ĂȂƂɁArΏۂƂ邽߂łB
Ƃ΃lbg[N̂̃NCAgA[JWebAvP[VT[oւ̃OCɎԂƂĂƂ܂傤B̃gtBbNLv`ălbg[Nx[XCƔrƁAWebT[o͐ɉĂ̂ɁAWebAvP[Vɑgݍ܂ꂽORecɂODNSNGXg̑xA펞2{xƂ邩܂B
lbg[Nx[XCƔrȂĂODNST[oxƋCÂm܂񂪁A̍قƂȂȂ܂B10DNSNG̏펞0.1bx̂́A1̃NGɐ펞1bȏォ̂Ɠ炢̖łAlbg[Nx[XCȂAO҂m̂͂Ȃ荢łB
lbg[N݂͑Ȃ߁Albg[Nx[XC̃R|[lgȂĂ܂B̍ł̓lbg[Nx[XC̃R|[lg܂BׂẴlbg[NɊYꍇ΁AقƂǓĂ͂܂Ȃꍇł傤BɂAeR|[lg̓x[XC3̊{JeSłTCgAzXgAAvP[VŌv邱Ƃ\łB

TCg̃x[XC
TCg̃x[XC̖ړÍAlbg[N̕IȃTCg̃gtBbNɊւՓIȃXibvVbg𓾂邱ƂłBWANׂ̂ẴZOgŎŝzłB
̃x[XCɊ܂܂R|[lĝ͎悤ɂȂ܂B

gpĂvgR
lbg[ÑGbWi[^t@CAEH[jŃZOĝׂĂ̒ʐM@킩̃gtBbNLv`ۂɁA[Statistics][Protocol Hierarchy]I[Protocol Hierarchy Statistics]EBhEJAׂĂ̒ʐM@킩̃gtBbNQƂ܂BقǂƏƂ炵킹邱ƂŁA펞ɌvgR݂͑Ă邩A邢͐VvgR܂܂ĂȂmFł܂BvgR̃gtBbN啝ɑĂȂǂ܂B

u[hLXggtBbN
lbg[NZOĝׂẴu[hLXggtBbN܂܂܂BTCĝǂŃLv`Ău[hLXggtBbN̓Lv`ł܂B펞͂ǂ@킪ʂ̃u[hLXggtBbN𑗂Ă̂mFłAu[hLXg̗ʂ菭Ȃ肵Ȃɕ܂B

F؃V[PX
Active DirectoryAWebAvP[VAgDŗL̃\tgȂǁAT[rXɑ΂邳܂܂ȃNCAg̔F؏̃gtBbN܂܂܂BʂɔF؂ɂ͎Ԃ܂Bx[XCɂāAF؂ʐMx̌ǂfł܂B

f[^][g
lbg[N̂TCg炳܂܂ȕʂ̃TCgւ̑ʃf[^]̑茋ʂ\܂BLv`̊TvWireshark̃Ot@\𗘗pāA]ƃRlNVƂ̐mFł܂B炭ꂪTCgx[XC̒łƂdvȂ̂ł傤BʐMxꍇAx[XCƓf[^̓]sǍʂrĂBΒʐM{ɒx̂ǂ킩A܂ǂŒxguĂ̂T肪ɂȂ܂B

zXgx[XC
zXgx[XCƂĂAׂẴzXg̃x[XCmKv͂܂BgtBbNɑA܂̓~bVNeBJȃT[oł̂ݍsΏ\łBT[oxƊǗ傩{̓db|Ă悤ł΁ÃT[õx[XC͊mĂ܂傤B
zXgx[XC̃R|[lg͈ȉ̒ʂłB

gpĂvgR
[Protocol Hierarchy Statistics]EBhEgāAzXg̃gtBbNLv`܂BقǂƏƂ炵킹邱ƂŁA펞ɌvgR݂Ă邩A邢͐VvgR܂܂ĂȂmFł܂BvgR̃gtBbN啝ɑĂȂǂ܂B

AChArW[̃gtBbN
s[NуIts[N̒ʏgtBbÑLv`ō\܂BԑтɂRlNVgpшcĂ΁Ax[ÛׂȂ̂AƂقɖ肪̂܂B

N^Vbg_E
̃x[XC𓾂ɂ́AzXg̋NƃVbg_E̍ۂɐgtBb
NLv`Kv܂B@킪NȂAVbg_EȂA邢͋NVbg_E̍ۂ̑xɒ[ɒxꍇÃx[XCƏƍAxlbg[N֘Aǂ𔻒fł܂B

F؃V[PX
zXgœ삵Ă邠T[rX̔F؏̃gtBbNLv`Kv܂BʂɔF؂ɂ͎Ԃ܂Bx[XCɂāAF؂ʐMx̌ǂfł܂B

֘A^ˑ
̃zXgǂ̃zXgɈˑĂ邩i܂̃zXgɂǂ̃zXgˑĂ邩jm邽߂ɁAԂ̃Lv`s܂B[Statistics][Conversations]I[Conversations]EBhEJA֘AˑmF܂BɂႦ΁AWebT[oSQL ServerT[oɈˑĂ肷邱Ƃ܂BzXgԂ̈ˑ֌ẂAɈӎĂ̂ł͂Ȃ̂ŁÅmFɃzXgx[XC𗧂܂BɂāAzXg̏⍂ׂ̂߂ɓK؂ɓ삵ĂȂǂmFł܂B

AvP[Vx[XC
lbg[Nx[XC̍Ō̃JeŚAAvP[Vx[XCłB͋Ɩsȃlbg[Nx[X̃AvP[Vł͕K擾ׂłB
AvP[Vx[XC̃R|[lg͈ȉ̂ƂłB

gpĂvgR
̃x[XCłAWireshark[Protocol Hierarchy Statistics]EBhEg܂A̓AvP[VsĂzXg̃gtBbNLv`܂BقǂƔr邱ƂŁAỸAvP[VˑvgRAɋ@\Ă邩ǂ܂B

N^Vbg_E
̃x[XC𓾂ɂ́AAvP[V̋NƃVbg_E̍ۂɐgtBbNLv`Kv܂BAvP[VNȂA邢͋NVbg_E̍ۂ̑xɒ[ɒxꍇÃx[XCƏƍA˂~߂邱Ƃł܂B

֘A^ˑ
̃AvP[VˑĂzXgAvP[Vm邽߂ɁAԂ̃Lv`sA[Conversations]EBhEgĊmF܂BAvP[VԂ̈ˑ֌ẂAɈӎĂ̂ł͂Ȃ̂ŁÅmFɂ̃x[XC𗧂܂BɂāAAvP[VQ⍂ׂ̂߂ɓK؂ɓ삵ĂȂǂmFł܂B

f[^][g
Lv`̊TvWireshark̃Ot@\𗘗pāAx[XC쐬ۂ̐펞̃AvP[VT[oւ̓]ƃRlNVƂ̐mFł܂BAvP[VxƂ񍐂΁Ãx[XCgāAx̌AvP[Vׂ̕邽߂A[Uׂ̕𔻒fł܂B

x[XCɂĂ̒ǋL
lbg[Nx[XC쐬ۂɁASɗ߂Ăׂ_AOǉĂ܂B

Ex[XC쐬ꍇAŒ3񂸂͍쐬܂傤BgtBbN̏ȂԑсijAgtBbN̑ԑсiߌjAgtBbNقƂǂȂԑсi[jƂłB
E\ȂAx[XC̑ΏۂƂȂzXgŁAڃLv`͔̂܂傤BgtBbNԑтƁALv`ׂ𑝂₵AptH[}Xቺ肵āAʂƂăpPbg̏A쐬x[XCӖɂȂĂ܂ꍇ܂B
Ex[XCɂ̓lbg[NɊւ铽񂪊܂܂Ă̂ŁAZLeBɒӂ܂傤BꂽlXANZXłSȏꏊɕۑ邱ƂłBɂpł悤A茳ɒuĂ܂傤BUSBhCuAÍp[eBVɓĂׂłB
Ex[XC֘A.pcapt@C܂Ƃ߁A֘A╽σf[^][gȂǁA悭QƂĺuJyvĂ܂傤B

܂Ƃ
̏͂ł́Albg[Nx̃guV[eBOɏœ_𓖂Ă܂BTCP̖oAJo邽߂֗̕ŁAM̍@Albg[NʐM̍x̌T@Albg[Nx[XC̏dvƂ̃R|[lgɂĐ܂BŐeNjbNƁAWireshark̃Otщ͋@\i5͂Őjg΁Albg[NxƂ̓db󂯂ĂAΉ邱Ƃł͂łB

