
Connect to TIBCO EMS Server
===========================


            O                                        O
           /|\                                      /|\
           / \                                      / \
          client                                   server 
   10.196.130.180:41995 - - - - - - - - - - - > 10.168.217.58:20004 


ack = numero di sequenza che il mittente si aspetta di ricevere (preso in considerazione solamente se il ack flag è TRUE).                    

DUMP Traffico... generato durante la connect :

jack0e@jack0e-laptop:~$ sudo tcpdump -i eth0 host 10.168.217.58 and port 20004 -A -s 10000 -w connect_tibemsd.txt
jack0e@jack0e-laptop:~$ hexdump ­C connect_tibemsd.txt
jack0e@jack0e-laptop:~$ wireshark connect_tibemsd.txt

    Mittente         No Flag                                 Len CheckSUM     X 
    ================ == ==================================== === ===========  | 
    CLIENT >> SERVER  1 [0x02] SYN      (seq =  0,         )   0              | 
                                                                              |
                                                                              | 
    Mittente         No Flag                                 Len CheckSUM     | 
    ================ == ==================================== === ===========  | 
    SERVER >> CLIENT  2 [0x12] SYN, ACK (seq =  0, ack =  1)   0              | Apertura connessione TCP  
                                                                              |        ( RFC 793 ) 
                                                                              |
    Mittente         No Flag                                 Len CheckSUM     | 
    ================ == ==================================== === ===========  | 
    CLIENT >> SERVER  3 [0x10] ACK      (seq =  1, ack =  1)   0              X   



    Mittente         No Flag                                 Len CheckSUM     X 
    ================ == ==================================== === ===========  | 
    CLIENT >> SERVER  4 [0x18] PSH, ACK (seq =  1, ack =  1)  12 incorrect    | Apertura connessione TIBCO EMS
    -----------------------------------------------------------------         | 
    Run.1       77 99 aa dd 00 00 00 00 00 00 00 00      w...........         | tibemsConnection_Create (  
    Run.2       77 99 aa dd 00 00 00 00 00 00 00 00      w...........         |   &connection,  
    Run.3 myTCP 77 99 aa dd 00 00 00 00 00 00 00 00      w...........         |   serverUrl,
    -----------------------------------------------------------------         |   NULL,   
                                                                              |   userName, 
    Mittente         No Flag                                 Len CheckSUM     |   password );  
    ================ == ==================================== === ===========  |
    SERVER >> CLIENT  5 [0x10] ACK      (seq =  1, ack = 13)   0              |
                      6 [0x18] PSH, ACK (seq =  1, ack = 13)  12              |
    -----------------------------------------------------------------         |
    Run.1       00 00 00 00 00 00 00 03 00 00 32 b3      ..........2.         |
    Run.2       00 00 00 00 00 00 00 03 00 00 2a b2      ..........*.         |
    Run.3 myTCP 00 00 00 00 00 00 00 03 00 00 10 41      ...........A         |
    -----------------------------------------------------------------         |
                                                                              |
                                                                              |
    Mittente         No Flag                                 Len CheckSUM     |
    ================ == ==================================== === ===========  |
    CLIENT >> SERVER  7 [0x10] ACK      (seq = 13, ack = 13)   0              |
                      8 [0x18] PSH, ACK (seq = 13, ack = 13)  12 incorrect    |
    -----------------------------------------------------------------         |
    Run.1       00 00 00 00 00 00 00 01 00 00 21 cc      ..........!.         |
    Run.2       00 00 00 00 00 00 00 01 00 00 1c 76      ...........v         |
    -----------------------------------------------------------------         |
                      9 [0x18] PSH, ACK (seq = 25, ack = 13) 137 incorrect    |
    -----------------------------------------------------------------         |
    Run.1 00 00 00 89 99 55 ee aa 0c 00 00 00 00 17    .....U........         |
    00 00 00 77 07 63 6c 74 79 70 65 00 09 02 43 00  ...w.cltype...C.         |
    05 75 73 65 72 00 09 0a 61 6e 6f 6e 79 6d 6f 75  .user...anonymou         |
    73 00 07 69 70 61 64 64 72 00 05 7f 00 00 01 06  s..ipaddr.......         |
    6d 69 6e 6f 72 00 04 00 02 07 76 62 75 69 6c 64  minor.....vbuild         |
    00 04 00 0c 06 63 74 79 70 65 00 05 00 00 00 00  .....ctype......         |
    07 75 70 64 61 74 65 00 04 00 00 06 6d 61 6a 6f  .update.....majo         |
    72 00 04 00 04 05 68 6f 73 74 00 09 0e 6a 61 63  r.....host...jac         |
    6b 30 65 2d 6c 61 70 74 6f 70 00                 k0e-laptop.              |
    -----------------------------------------------------------------         |
    Run.2 00 00 00 89 99 55 ee aa 0c 00 00 00 00 17    .....U........         |
    00 00 00 77 07 63 6c 74 79 70 65 00 09 02 43 00  ...w.cltype...C.         |
    05 75 73 65 72 00 09 0a 61 6e 6f 6e 79 6d 6f 75  .user...anonymou         |
    73 00 07 69 70 61 64 64 72 00 05 7f 00 00 01 06  s..ipaddr.......         |
    6d 69 6e 6f 72 00 04 00 02 07 76 62 75 69 6c 64  minor.....vbuild         |
    00 04 00 0c 06 63 74 79 70 65 00 05 00 00 00 00  .....ctype......         |
    07 75 70 64 61 74 65 00 04 00 00 06 6d 61 6a 6f  .update.....majo         |
    72 00 04 00 04 05 68 6f 73 74 00 09 0e 6a 61 63  r.....host...jac         |
    6b 30 65 2d 6c 61 70 74 6f 70 00                 k0e-laptop.              |
    -----------------------------------------------------------------         |
                                                                              |
    Mittente         No Flag                                 Len CheckSUM     |
    ================ == ==================================== === ===========  |
    SERVER >> CLIENT 10 [0x10] ACK      (seq = 13, ack = 25)   0              |
                     11 [0x18] PSH, ACK (seq = 13, ack =162) 218              |  
    -----------------------------------------------------------------         |
    Run.1 00 00 00 da 99 55 ee aa 0a 00 00 00 01 17    .....U........         |
    00 00 00 c8 06 63 6f 6e 6e 73 00 06 00 00 00 00  .....conns......         |
    00 00 00 14 06 6d 69 6e 6f 72 00 04 00 03 07 76  .....minor.....v         |
    62 75 69 6c 64 00 04 00 0f 07 75 70 64 61 74 65  build.....update         |
    00 04 00 00 07 73 65 72 76 65 72 00 09 18 49 50  .....server...IP         |
    42 2d 50 45 52 46 2d 45 4d 53 2d 53 45 52 56 45  B-PERF-EMS-SERVE         |
    52 2d 53 53 4c 00 05 63 6c 69 64 00 09 01 00 06  R-SSL..clid.....         |
    6d 61 6a 6f 72 00 04 00 04 04 70 66 63 00 01 00  major.....pfc...         |
    07 73 65 63 75 72 65 00 01 01 07 72 65 71 74 74  .secure....reqtt         |
    6c 00 05 00 00 00 1e 06 62 79 74 65 73 00 06 00  l.......bytes...         |
    00 00 00 00 00 00 f3 04 63 74 64 00 01 00 06 63  ........ctd....c         |
    6f 6e 69 64 00 06 00 00 00 00 00 00 05 17 06 63  onid...........c         |
    6f 6d 70 63 00 01 01 08 76 65 72 73 69 6f 6e 00  ompc....version.         |
    09 0a 34 2e 33 2e 30 20 56 31 35 00              ..4.3.0 V15.             |
    -----------------------------------------------------------------         | 
    Run.2 00 00 00 da 99 55 ee aa 0a 00 00 00 01 17    .....U........         |
    00 00 00 c8 06 63 6f 6e 6e 73 00 06 00 00 00 00  .....conns......         |
    00 00 00 14 06 6d 69 6e 6f 72 00 04 00 03 07 76  .....minor.....v         |
    62 75 69 6c 64 00 04 00 0f 07 75 70 64 61 74 65  build.....update         |
    00 04 00 00 07 73 65 72 76 65 72 00 09 18 49 50  .....server...IP         |
    42 2d 50 45 52 46 2d 45 4d 53 2d 53 45 52 56 45  B-PERF-EMS-SERVE         |
    52 2d 53 53 4c 00 05 63 6c 69 64 00 09 01 00 06  R-SSL..clid.....         |
    6d 61 6a 6f 72 00 04 00 04 04 70 66 63 00 01 00  major.....pfc...         |
    07 73 65 63 75 72 65 00 01 01 07 72 65 71 74 74  .secure....reqtt         |
    6c 00 05 00 00 00 1e 06 62 79 74 65 73 00 06 00  l.......bytes...         |
    00 00 00 00 00 00 f3 04 63 74 64 00 01 00 06 63  ........ctd....c         |
    6f 6e 69 64 00 06 00 00 00 00 00 00 05 17 06 63  onid...........c         |
    6f 6d 70 63 00 01 01 08 76 65 72 73 69 6f 6e 00  ompc....version.         |
    09 0a 34 2e 33 2e 30 20 56 31 35 00              ..4.3.0 V15.             |
    -----------------------------------------------------------------         X


    Mittente         No Flag                                 Len CheckSUM     X 
    ================ == ==================================== === ===========  | 
    CLIENT >> SERVER 12 [0x18] PSH, ACK (seq =162, ack =231)  64 incorrect    | 
    -----------------------------------------------------------------         | 
    Run.1 00 00 00 40 99 55 ee aa 0d 00 00 00 00 17    ...@.U........         | Chiusura connessione TIBCO EMS 
    00 00 00 2e 06 63 74 79 70 65 00 05 00 00 00 00  .....ctype......         | status = tibemsConnection_Close(connection);
    05 75 73 65 72 00 09 0a 61 6e 6f 6e 79 6d 6f 75  .user...anonymou         | 
    73 00 06 63 6f 6e 69 64 00 06 00 00 00 00 00 00  s..conid........         | 
    05 17                                            ..                       | 
    -----------------------------------------------------------------         X  



    Mittente         No Flag                                 Len CheckSUM     
    ================ == ==================================== === ===========  X 
    CLIENT >> SERVER 13 [0x11] FIN, ACK (seq =226, ack =231)   0              | 
                                                                              |
                                                                              |
    Mittente         No Flag                                 Len CheckSUM     | 
    ================ == ==================================== === ===========  | 
    SERVER >> CLIENT 14 [0x10] ACK      (seq =231, ack =227)   0              | Chiusura connessione TCP 
                     15 [0x11] FIN, ACK (seq =231, ack =227)   0              | 
                                                                              |
                                                                              |
    Mittente         No Flag                                 Len CheckSUM     | 
    ================ == ==================================== === ===========  | 
    CLIENT >> SERVER 16 [0x10] ACK      (seq =227, ack =232)   0              X 




Dopo aver analizzo lo scambio di messaggi che avviene durante la connessione tra C/S son fermo
al secondo messaggio inviato dal client, che non è mai uguale a quello precedente (a differenza 
del primo) e quindi non essendo corretto per il server, questo non risponde con di solito
fa in situazioni normali...

Ora bisogna scendere nel dettaglio di questo secondo messaggio... ma come si fa
a capire com'eè strutturato :

    Run.1       00 00 00 00 00 00 00 01 00 00 21 cc      ..........!.         |
    Run.2       00 00 00 00 00 00 00 01 00 00 1c 76      ...........v         |


di sicuro è a lunghezza fissa: 12 byte, di cui :
 
   * byte 1..7  sempre a 00
   * byte 8     sempre a 01
   * byte 9..10 sempre a 00
   * byte 11,12 cambiano sempre... 65535 valori possibili

   bisognerebbe avere la struttura record... ho usato un paio di decompilatore

   * boomerang http://boomerang.sourceforge.net   (proseguimento di DCC - www.itee.uq.edu.au/~cristina/dcc.html)
   * REC       http://backerstreet.com/rec/       


   boomerang se funzionasse sarebbe il TOP come risultato ma schiatta mentre analizza... però leggere meglio doc
   REC funziona ma tira fuori pseodo-assembler


   
   




