UDP packet capture analysis, UDP application, the difference between TCP and UDP need rational data, do not remember hard

directory

Caught process

The Wireshark is used to capture packets. Use the two most common curl and ping commands to display the packet capture and enable packet capture.

# # to access my own homepage curl https://zengzhiqin.kuaizhan.com # # to check my own website address ping https://zengzhiqin.kuaizhan.comCopy the code

The Wireshark filters packets based on the IP address obtained from the ping command to obtain the packets obtained from the preceding two commands, including TCP (HTTPS based on TCP) and ICMP (ping based on ICMP), as shown in the following figure:

UDP characteristics

UDP packet capture look at the header

Wireshark is a wireshark that uses UDP packets to filter ARP packets. Wireshark is a Wireshark that uses UDP packets to filter ARP packets. Wireshark is a Wireshark that uses UDP packets.

Incidentally make fun of baidu translation, anyway this translation I do not understand.

Main features of UDP

• UDP is connectionless, that is, no connection is required before sending data
• UDP best effort delivery, reliable delivery is not guaranteed, and congestion control is not supported
• UDP is packet-oriented and has no congestion control, which is suitable for multimedia communication (such as teacher computer broadcasting and student computer lecture).
• UDP supports one-to-one, one-to-many, many-to-one and many-to-many interactive communication
• The UDP header has a small overhead of only 8 bytes

UDP Application Representative

1. Access to web pages or mobile apps

For the current mainstream mobile Internet, TCP is time-consuming to establish, and there will be the problem of broken connection. QUIC (Qucik UDP Internet Connections) is a communication protocol proposed by Google based on UDP. It realizes fast connection establishment by itself, reduces retransmission delay, and ADAPTS congestion control.

2. Streaming media protocol

Words big power power today guest li Jiaqi broadcast room, she is too beautiful!

Many live protocols use RTMP and are based on TCP. However, for live broadcast, some packages can be lost and some cannot be lost, because some important and some not important frames in the continuous frame of the video. If a few frames are lost, an audience will not feel it, but the continuous frame loss will be delayed. Therefore, selective frame loss is applied when the network is not good.

The fatal drawback of TCP to live broadcast is that when the network is not good, TCP detects that it will actively reduce the transmission speed, which is even worse. The application layer should immediately retransmit rather than actively compromise. Therefore, many live streaming applications have implemented their own video transmission protocols based on UDP.

3. Real-time games

Game real-time demand is high, the king’s glory, for one, met the problems of slow monkey a second is back to the spring, so the real-time game client and server to establish a long connection to ensure the real-time transmission, but there are so many players have long connection to tencent even if their have tencent cloud also carry not to live, the TCP connection is long need to kernel data structures of maintenance, A machine can support only a limited number of TCP connections and UDP has no connections, which was often an effective strategy for dealing with massive client connections before the introduction of asynchronous I/O.

Another reason is that TCP guarantees a strong order, a lost guarantee to wait for retransmission, the client can not wait, and the client does not care about expired data.

4. LOT of things
5. Mobile Communication field

I can’t explain the last two areas, UDP, and the real-time requirements are high, ha ha ha broken work.

TCP vs UDP

TCP always has a rigorous and reliable academic attitude, UDP always has a business mentality of trying to deliver. When UDP works, the UDP of the sender does not merge or split the packets handed down by the application, but sets up a packet length field to retain the boundary of these packets. After adding the header, it directly delivers the packets to the network layer. Looking at the UDP header information, you can also feel how rough and perfunctory he is.

TCP and UDP:

1. Compared with the TCP header, the UDP header is a little too simple, that is, the UDP structure is simpler

2. TCP has sequence number and confirmation number and emergency pointer. TCP ensures data sequence and reliable transmission, while UDP does not. For reliable transmission, error codes depend on TCP segment number and confirmation number to judge packet loss. To ensure the reliability of packet transmission, TCP assigns a serial number to each packet, and the serial number also ensures that the packets sent to the receiving entity are received in sequence. The receiving entity then sends back an acknowledgement (ACK) of the successfully received byte; If the sending entity does not receive acknowledgement within a reasonable round trip delay (RTT), the corresponding data (if lost) will be retransmitted.

3. TCP uses SYN, ACK, and FIN flags to establish a handshake. TCP is connection-oriented, UDP is not connection-oriented, and is stateless. This is the main difference. After all, there are other “reliable transmission”, “flow control”, “congestion control” and other things that are based on connectivity to icing on the cake

4. TCP has a window, that is, TCP can carry out flow control and congestion control, specific control methods look down, UDP is not, he is the application layer to the packet head to the network layer a throw, life and death have life and wealth in the day.

5. TCP is byte stream oriented and UDP is datagram based. This is not difficult to understand, a message independent transmission is only suitable for UDP such reckless transmission, TCP also carry out traffic control congestion control what, certainly can not transmit messages, too large, but to control the transmission, the number of byte throttling send good control.

6. UDP transmission speed is fast, TCP transmission speed is slow, somebody else TCP to do so many things, handshake communication window what, certainly more time-consuming.

If you want to memorize these characteristics, or very difficult, and not Huang Rong can photographic memory, the brain only need to draw the head content of the two good, the difference can be deduced by themselves, the premise is to know what those are doing.

TCP solves five problems

• Order problem
• Packet loss problem
• Connect the maintenance
• Flow control
• Congestion control

Order problems and connection maintenance can be seen in my other article “packet capture analysis OF TCP headers”, next we will look at TCP packet loss problems, and how to use sliding Windows for traffic control and congestion control.

Harvest of the old iron point to encourage it, thank you for watching ~

Next period: TCP flow control and congestion control implementation (this period inserted a team to talk about UDP)