如何理解数据包是TCP关闭数据包与sharPcap

Question

我想读取从客户端发送到服务器的数据包。我在C＃中使用sharpPcap。在这种情况下，我如何理解一个数据包是TCP CLOSE数据包：

private static void device_OnPacketArrival(object sender, CaptureEventArgs e) 
    {   
     var time = e.Packet.Timeval.Date; 
     var len = e.Packet.Data.Length; 

     var packet = PacketDotNet.Packet.ParsePacket(e.Packet.LinkLayerType, e.Packet.Data); 

     var tcpPacket = PacketDotNet.TcpPacket.GetEncapsulated(packet); 
     if(tcpPacket != null) 
     { 
      var ipPacket = (PacketDotNet.IpPacket)tcpPacket.ParentPacket; 
      System.Net.IPAddress srcIp = ipPacket.SourceAddress; 
      System.Net.IPAddress dstIp = ipPacket.DestinationAddress; 
      int srcPort = tcpPacket.SourcePort; 
      int dstPort = tcpPacket.DestinationPort; 

      Console.WriteLine("{0}:{1}:{2},{3} Len={4} {5}:{6} -> {7}:{8}", 
       time.Hour, time.Minute, time.Second, time.Millisecond, len, 
       srcIp, srcPort, dstIp, dstPort); 
     } 
    } 

Answer 1

TCP关闭在TCP协议中由FIN表示。关闭TCP连接的两端将会有4路握手。两端都会发送一个FIN，同伴会对其进行确认。你应该能够看到这与你的捕获fromework。

或许你可以在这里找到一些提示如何通过API实现这一点：http://www.codeproject.com/Articles/12458/SharpPcap-A-Packet-Capture-Framework-for-NET