https://www.cnblogs.com/tomato0906/articles/3991388.html

TCP segment of a reassembled PDU

TCP segment of a reassembled PDU In fact, when the host responds to a query or command,If you want to respond with a lot of data（信息）,而这些数据超出了TCP的最大MSS时,The host transmits this data by sending multiple packets（注意：这些包并未被分片）.

【背景知识】

MTU  最大传输单元

MSS

【分析过程】

    先说说MTU（最大传输单元）,这个MTUIn fact, it has a close relationship with the link layer protocol.EthnernetII帧的结构：DMAC+SMAC+Type+Data+CRC.由于以太网传输电气方面的限制,Every Ethernet frame has a minimum64bytes和最大1518bytes.Ethernet frames smaller or larger than this limit are treated as erroneous data frames,一般的以太网转发设备会丢弃这些数据帧.（注：小于64bytesThe data frames are generally generated due to Ethernet collisions“碎片”或者线路干扰或者坏的以太网接口产生的,对于大于1518bytesThe data frame we generally callGiant帧,This is usually caused by line interference or a bad Ethernet interface）

    由于以太网EthernetII最大的数据帧是1518bytes,刨去以太网帧的帧头（DMAC（6bytes）+SMAC（6bytes）+Type（2bytes））14bytes和帧尾CRC校验部分4bytes（This is sometimes called itFCS）,Then the rest of the place that carries the upper layer protocol isDATA域,Only the biggest1500Bytes,We call this valueMTU.这个就是网络层协议非常关心的地方,因为网络层协议比如IP协议会根据这个值来决定是否把上层传下来的数据进行分片.

     当两台远程PC互联的时候,Their data needs to pass through many routers and various network media to reach the peer,网络中不同媒介的MTU各不相同,就好比一长段的水管,由不同粗细的水管组成（MTU不同）,通过这段水管最大水量就要由中间最细的水管决定.

     对于网络层的上层协议而言（以TCP/IP协议族为例）They don't care about the thickness of the water pipe. They think it's a network layer thing.网络层IP协议会检查每个从上层协议下来的数据包的大小,并根据本机MTU的大小决定是否作“分片”处理.The biggest disadvantage of fragmentation is that it reduces transmission performance,本来一次可以搞定的事情,分成多次搞定,So the network layer is higher（is the transport layer）的实现中往往会对此加以注意.Some high-level officials will ask me that this bread cannot be sliced ​​for some reason,I want whole bread,所以会在IPAdd one to the packet header 个标签：DF（DonotFragment）.这样当这个IP数据包在一大段网络（水管里面）传输的时候,如果遇到MTU小于IP数据包的情况,转发设备 The packet is dropped as required.然后返回一个错误信息给发送者.这样往往会造成某些通讯上的问题,Fortunately, most network links areMTU1500或者大于 1500.

对于UDP协议而言,这个协议本身是无连接的协议,对数据包的到达顺序以及是否正确到达不甚关心,所以一般UDP应用对分片没有特殊要求.

对于TCP协议而言就不一样了,这个协议是面向连接的协议,对于TCP协议而言它非常在意数据包的到达顺序以及是否传输中有错误发生.所以有些TCP应用对分片有要求---不能分片（DF）.

MSS最大传输大小的缩写,是TCP协议里面的一个概念.
MSS 就是TCP数据包每次能够传输的最大数据分段.为了达到最佳的传输效能TCP协议在建立连接的时候通常要协商双方的MSS值,这个值TCPWhen the agreement is implemented often usedMTU值代替（需要减去IP数据包包头的大小20Bytes和TCP数据段的包头20Bytes）所以往往MSS为1460.Communication between the two parties will be based on both parties 提供的MSS值得最小值确定为这次connection maxMSS值.

Let's go back to the question in the preface,我们试想一下,如 If we put each time on the intermediate routerTCPconnection maxMSSMake adjustments so that it passesPPPoEmaximum of the linkMSSThe value plus the header and trailer of the packet will not exceedPPPoE的MTU大小 1492This will not cause communication problems.So the above question can be passediptcp adjust-mss 1452来解决.

Of course, the problem can also be modifiedPC机的MTU来解决.

TCP segment of a reassembled PDU  

2011-06-19 15:36:43|  分类： 网络协议 |  标签：tcp  ip  mss  ip分片   |举报 |字号 订阅

I ran into a problem at the company last week,用wiresharkScraping the data reported by the system to the network management system, it is found that there are many packets marked as “TCP segment of a reassembled PDU”,And every segment of the message is180Byte,I saw this sign at the time,觉得是IP报文分片,the interface to the systemMTUThe value is set small,Found yes by command query 1500,has not been reset,当时有点想不通.

    Check back,Find out that your understanding is wrong,“TCP segment of a reassembled PDU”指的不是IP层的分片,IP分片在wireshark里用“Fragmented IP protocol”来标识.Check it out in detail,发现“TCP segment of a reassembled PDU”指TCP层收到上层大块报文后分解成段后发出去.So there is a question,TCPThe layer can completely drop large segments of packetsIP层,让IPThe layer completes the segmentation,为什么要在TCPWhat about layers?？ 其实这个是由TCP的MSS(Maximum Segment Size,最大报文段长度)决定的,TCPin the first packet that initiates the connectionTCPthrough the headMSSThis option informs the peer of the maximum packet that the local end can receive（当然,这个大小是 TCPThe size of the payload）,On Ethernet, this value is generally set to 1460,因为1460Byte净荷+20Byte TCP头+20Byte IP头 ＝ 1500字节,It just meets the requirements of the maximum packet of the link layer.

    As for how to determine that it is one after receiving a message"TCP segment"？If there are several messagesACKThe serial numbers are the same,and these messagesSequence Number都不一样,并且后一个Sequence Number为前一个Sequence NumberPlus the previous packet size plus1的话,肯定是TCP segment了,对于没有ACK标志时,则无法判断.

    Since receivedTCP报文都是180Byte的segment,Then it should be time to negotiatePCend informedMSS为180Byte,至于为什么这样,It can only be confirmed after the packet is capturedMSSThe problem is re-examined.另外,There is a situation that can also cause this problem：The system under test becauseMTU为220Byte而设置MSS为180Byte,But this situation can now be ruled out,因为前面讲过,已经查询过MTU值为1500.

今天利用windowsThe search function searches the contents of a shared folder on the network,Finds heavy traffic when looking for network files.Curious to usewireshark抓包发现 wireshark InfoThere are many in the column“TCP segment of a reassembled PDU”提示信息.I am puzzled by Baidu and found that everyone is asking this question and there is no good answer on the Internet.想到“TCP segment of a reassembled PDU”只是wireshark的提示信息,那么在sniffer proWhat kind of hints will be given,用sniffer打开同样的trace Find hints inside“Continuation of missing frame”和"Continuation of frame xx"现在大概知道“TCP segment of a reassembled PDU”是什么意思,In fact, if the host responds to a query or command, it needs to respond with a lot of data（信息）而这些数据超出了TCP的最大MSS时,主机会通过发送多个数据包来传送这些数据（注意：这些包并未被分片）.对wiresharkIn other words, these pairs of packets corresponding to the same query command are marked“TCP segment of a reassembled PDU”

问题,wiresharkHow to identify that multiple packets are responses to the same query packet? wireshark是根据sequence number来识别,这些数据包ACK number是相同的,当然numberThe value is the same as that in the query packetnext sequence number也是一样的.

CIFS/SMBHow inefficient the protocol treats file queries！A query for a filename is two frames long1514字节和一个1294The frame length in bytes to respond.

关于TCP/UDP与IPDifferences in the maximum packet lengthSee this article 

http://blog.163.com/hlz_2599/blog/static/142378474201341601129121/

IP分片丢失重传

尽管IP分片看起来是是透明的,但有一点让人不想使用它：即使只丢失一片数据也要重传整个数据报.为什么会发生这种情况呢？

    因为IP层本身没有超时重传的机制——由更高层来负责超时和重传（TCP有超时和重传机制,但UDP没有.一些UDP应用程序本身也执行超时和重传）.当来自TCP报文段的某一片丢失后,TCP在超时后重发整个TCP报文段,该报文段对应于一份IP 数据报.There is no way to retransmit only one piece of the datagram.事实上,If the data fragmentation is an intermediate router,而不是起始端系统,Then the super-originating system has to know how the datagram is fragmented.就这个原因,经常要避免分片.

    注：把一份IP数据报分片以后,只有到达目的地才进行重新组装（The reassembly here is different from other network protocols,They require reassembly at the next stop,而不是在最终的目的地）.重新组装由目的端的IP层来完成,其目的是使分片和重新组装过程对运输层(TCP和UDP)是透明的,Except for some possible leapfrog operations.已经分片过的数据报有可能会再次进行分片（可能不止一次）.IP首部中包含的数据为分片和重新组装提供了足够的信息.

1,MTU（Maximum Transmission Unit,MTU）,最大传输单元
（1）以太网和802.3对数据帧的长度都有一个限制,其最大值分别是1500和1492个字节.链路层的这个特性称作MTU.不同类型的网络大多数都有一个上限.如果IP层有一个数据要传,且数据的长度比链路层的MTU还大,那么IP层就要进行分片（fragmentation）,把数据报分成若干片,这样每一个分片都小于MTU.
（2）把一份IP数据报进行分片以后,由到达目的端的IP层来进行重新组装,其目的是使分片和重新组装过程对运输层（TCP/UDP）是透明的.由于每一分片都是一个独立的包,当这些数据报的片到达目的端时有可能会失序,但是在IP首部中有足够的信息让接收端能正确组装这些数据报片.
（3）尽管IP分片过程看起来透明的,但有一点让人不想使用它：即使只丢失一片数据也要重新传整个数据报.why？因为IP层本身没有超时重传机制------由更高层（比如TCP）来负责超时和重传.当来自TCP报文段的某一片丢失后,TCP在超时后会重发整个TCP报文段,该报文段对应于一份IP数据报（而不是一个分片）,没有办法只重传数据报中的一个数据分片.
（4）使用UDP很容易导致IP分片,TCP试图避免IP分片.那么TCP是如何试图避免IP分片的呢？其实说白了,采用TCP协议进行数据传输是不会造成IP分片的,因为一旦TCP数据过大,超过了MSS,则在传输层会对TCP包进行分段（如何分,见下文！）,自然到了IP层的数据报肯定不会超过MTU,当然也就不用分片了.而对于UDP数据报,如果UDP组成的IP数据报长度超过了1500,那么 IP数据报显然就要进行分片,因为UDP不能像TCP一样自己进行分段.总结：UDP不会分段,就由我IP来分.TCP会分段,当然也就不用我IP来分了！
2,MSS（Maxitum Segment Size）最大分段大小的缩写,是TCP协议里面的一个概念
（1）MSS就是TCP数据包每次能够传输的最大数据分段.为了达到最佳的传输效能TCP协议在建立连接的时候通常要协商双方的MSS值,这个值TCPWhen the agreement is implementedoften used MTU值代替（需要减去IP数据包包头的大小20Bytes和TCP数据段的包头20Bytes）所以往往MSS为1460.Communication between the two parties will be based on both parties提供的 MSS值得最小值确定为这次connection maxMSS值.
 （2）相信看到这里,还有最后一个问题：TCP是如何实现分段的呢？其实TCP无所谓分段,因为每个TCP数据报在组成前其大小就已经被MSS限制了,所以TCP数据报的长度是不可能大于MSS的,当然由它形成的IP包的长度也就不会大于MTU,自然也就不用IP分片了