标签：
下面是翻译国外的一篇博客，原文连接如下：
https://thesprawl.org/research/oracle-tns-protocol/
TNS(Transparent Network Substrate) 协议用于客户端连接Oracle数据库，它可以使用其他一些协议进行通信，如：TCP/IP, IPX/SPX, IPC, Named Pipes等。
TNS 包由一个header和payload 组成
0 8 16 31 +--------------+--------------+ | Packet Length| Packet Chksm | +------+-------+--------------+ 8 byte header | Type | Rsrvd | Header Chksm | +------+-------+--------------+ | P A Y L O A D | +-----------------------------+
字段说明：
l Packet Length: 包长度字段
l Packet Chksm：检测包
l Header Chksm: 检测头
l Type: 包类型
l Rsrvd: 未使用
如上图：Packet Chksm 和 Header Chksm 通常是不变的，值为0.
Type字段是包的类型字段, 下面列出type 值对应的类型说明：
|
Type |
Description |
|
1 |
Connect |
|
2 |
Accept |
|
3 |
ACK |
|
4 |
Refuse |
|
5 |
Redirect |
|
6 |
Data |
|
7 |
NULL |
|
8 |
---- |
|
9 |
ABORT |
|
10 |
---- |
|
11 |
Resend |
|
12 |
Marker |
|
13 |
Attention |
|
14 |
Control |
连接类型数据如下所示：
Transparent Network Substrate Protocol Packet Length: 254 Packet Checksum: 0x0000 Packet Type: Connect (1) Reserved Byte: 00 Header Checksum: 0x0000 Connect Version: 313 Version (Compatible): 300 Service Options: 0x0000 Session Data Unit Size: 2048 Maximum Transmission Data Unit Size: 32767 NT Protocol Characteristics: 0xc60e Line Turnaround Value: 0 Value of 1 in Hardware: 0100 Length of Connect Data: 196 Offset to Connect Data: 58 Maximum Receivable Connect Data: 512 Connect Flags 0: 0x61 Connect Flags 1: 0x61 Trace Cross Facility Item 1: 0x00000000 Trace Cross Facility Item 2: 0x00000000 Trace Unique Connection ID: 0x0000000000000000 Connect Data: (DESCRIPTION=(CONNECT_DATA=(SERVICE_NAME=ORCL)(CID=(PROGRAM= C:\oracle\product\10.2.0\client_1\bin\sqlplus.exe) (HOST=WINXPSP2)(USER=vmware)))(ADDRESS=(PROTOCOL=TCP) (HOST=192.168.1.102)(PORT=1521))) 0.018134 192.168.1.108 192.168.1.102 TNS Request, Connect (1), Connect 0000 00 0c 29 0c 9a c7 00 0c 29 fd 07 3d 08 00 45 00 ..).....)..=..E. 0010 01 26 05 0b 40 00 80 06 70 a4 c0 a8 01 6c c0 a8 .&..@...p....l.. 0020 01 66 04 66 05 f1 ac 94 a7 3e 66 d2 7e ee 50 18 .f.f.....>f.~.P. 0030 ff ff 15 91 00 00 00 fe 00 00 01 00 00 00 01 39 ...............9 0040 01 2c 00 00 08 00 7f ff c6 0e 00 00 01 00 00 c4 .,.............. 0050 00 3a 00 00 02 00 61 61 00 00 00 00 00 00 00 00 .:....aa........ 0060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0070 28 44 45 53 43 52 49 50 54 49 4f 4e 3d 28 43 4f (DESCRIPTION=(CO 0080 4e 4e 45 43 54 5f 44 41 54 41 3d 28 53 45 52 56 NNECT_DATA=(SERV 0090 49 43 45 5f 4e 41 4d 45 3d 4f 52 43 4c 29 28 43 ICE_NAME=ORCL)(C 00a0 49 44 3d 28 50 52 4f 47 52 41 4d 3d 43 3a 5c 6f ID=(PROGRAM=C:\o 00b0 72 61 63 6c 65 5c 70 72 6f 64 75 63 74 5c 31 30 racle\product\10 00c0 2e 32 2e 30 5c 63 6c 69 65 6e 74 5f 31 5c 62 69 .2.0\client_1\bi 00d0 6e 5c 73 71 6c 70 6c 75 73 2e 65 78 65 29 28 48 n\sqlplus.exe)(H 00e0 4f 53 54 3d 57 49 4e 58 50 53 50 32 29 28 55 53 OST=WINXPSP2)(US 00f0 45 52 3d 76 6d 77 61 72 65 29 29 29 28 41 44 44 ER=vmware)))(ADD 0100 52 45 53 53 3d 28 50 52 4f 54 4f 43 4f 4c 3d 54 RESS=(PROTOCOL=T 0110 43 50 29 28 48 4f 53 54 3d 31 39 32 2e 31 36 38 CP)(HOST=192.168 0120 2e 31 2e 31 30 32 29 28 50 4f 52 54 3d 31 35 32 .1.102)(PORT=152 0130 31 29 29 29 1)))
接收类型数据如下所示：
Transparent Network Substrate Protocol Packet Length: 32 Packet Checksum: 0x0000 Packet Type: Accept (2) Reserved Byte: 04 Header Checksum: 0x0000 Accept Version: 312 Service Options: 0x0000 Session Data Unit Size: 2048 Maximum Transmission Data Unit Size: 32767 Value of 1 in Hardware: 0100 Accept Data Length: 0 Offset to Accept Data: 32 Connect Flags 0: 0x61 Connect Flags 1: 0x61 0000 00 0c 29 fd 07 3d 00 0c 29 0c 9a c7 08 00 45 00 ..)..=..).....E. 0010 00 48 7c cf 40 00 80 06 f9 bd c0 a8 01 66 c0 a8 .H|.@........f.. 0020 01 6c 11 d9 04 67 b6 88 7a 22 0e a7 cb 81 50 18 .l...g..z"....P. 0030 ff 01 1d 97 00 00 00 20 00 00 02 04 00 00 01 38 ....... .......8 0040 00 00 08 00 7f ff 01 00 00 00 00 20 61 61 00 00 ........... aa.. 0050 00 00 00 00 00 00 ......
拒绝类型数据如下所示：
0.047753 192.168.1.102 192.168.1.108 TNS Response, Refuse (4), Refuse 0000 00 0c 29 fd 07 3d 00 0c 29 0c 9a c7 08 00 45 00 ..)..=..).....E. 0010 00 8f 53 e2 40 00 80 06 22 64 c0 a8 01 66 c0 a8 ..S.@..."d...f.. 0020 01 6c 05 f1 04 0d e8 a0 2d 2b 67 0d 99 85 50 18 .l......-+g...P. 0030 fe ff 59 03 00 00 00 67 00 00 04 00 00 00 22 00 ..Y....g......". 0040 00 5b 28 44 45 53 43 52 49 50 54 49 4f 4e 3d 28 .[(DESCRIPTION=( 0050 54 4d 50 3d 29 28 56 53 4e 4e 55 4d 3d 31 35 33 TMP=)(VSNNUM=153 0060 30 39 32 33 35 32 29 28 45 52 52 3d 31 32 35 31 092352)(ERR=1251 0070 34 29 28 45 52 52 4f 52 5f 53 54 41 43 4b 3d 28 4)(ERROR_STACK=( 0080 45 52 52 4f 52 3d 28 43 4f 44 45 3d 31 32 35 31 ERROR=(CODE=1251 0090 34 29 28 45 4d 46 49 3d 34 29 29 29 29 4)(EMFI=4))))
如果有下面的错误则产生拒绝包：
TNS-12514 - TNS:listener could not resolve SERVICE_NAME given in connect descriptor caused by invalid SID string provided in the connect string.
DATA 包是类型6，包括2个字节的 flag 标志位，1字节的 packet id，可选的 TTI id，还有数据本身。
0 16 24 31 +-----------+----+-----+ | Data Flag | ID |<TTI>| +----------------------+ | D A T A | +----------------------+
字段说明：
l Data Flag: 数据标识
l ID： 包ID
l TTI: TTI(Two-Task Interface) ID
l DATA: 有效数据
Data Flag 通常是 0x0000， 当所有数据发送完毕指示文件结尾，值为 0x0040
下面是列出了有效的数据包ID:
ID: 0x01
描述：协议协商。下面这些标识是可以接受的协议版本：
0x06 0x05 0x04 0x03 0x02 0x01 0x00
客户端平台字符串像：IBMPC/WIN_NT-8.1.0
示例：
0.277372 192.168.1.108 192.168.1.102 TCP kwdb-commn > iax [PSH, ACK] Seq=786 Ack=425 Win=65111 Len=37 0000 00 0c 29 0c 9a c7 00 0c 29 fd 07 3d 08 00 45 00 ..).....)..=..E. 0010 00 4d 05 14 40 00 80 06 71 74 c0 a8 01 6c c0 a8 .M..@...qt...l.. 0020 01 66 04 67 11 d9 0e a7 cd 94 b6 88 7b ca 50 18 .f.g........{.P. 0030 fe 57 a0 d0 00 00 00 25 00 00 06 04 00 00 00 00 .W.....%........ 0040 01 06 05 04 03 02 01 00 49 42 4d 50 43 2f 57 49 ........IBMPC/WI 0050 4e 5f 4e 54 2d 38 2e 31 2e 30 00 N_NT-8.1.0.
ID: 0x02
描述：交换数据类型
示例：
0.437308 192.168.1.108 192.168.1.102 TCP kwdb-commn > iax [PSH, ACK] Seq=823 Ack=589 Win=64947 Len=67 0000 00 0c 29 0c 9a c7 00 0c 29 fd 07 3d 08 00 45 00 ..).....)..=..E. 0010 00 6b 05 15 40 00 80 06 71 55 c0 a8 01 6c c0 a8 .k..@...qU...l.. 0020 01 66 04 67 11 d9 0e a7 cd b9 b6 88 7c 6e 50 18 .f.g........|nP. 0030 fd b3 81 e2 00 00 00 43 00 00 06 04 00 00 00 00 .......C........ 0040 02 b2 00 b2 00 52 21 06 01 01 01 0d 01 01 04 01 .....R!......... 0050 01 01 01 01 01 01 ff ff 03 08 03 00 01 00 3f 01 ..............?. 0060 07 3f 01 01 01 01 03 01 05 02 01 00 00 18 80 00 .?.............. 0070 00 00 3c 3c 3c 80 00 00 00 ..<<<....
ID: 0x03
描述： TTI (Two-Task Interface)功能，作用是描述即将到来的数据包ID下面是一个TTI ID列表：
0x02 Open 0x03 Query 0x04 Execute 0x05 Fetch 0x08 Close 0x09 Disconnect/logoff 0x0C AutoCommit ON 0x0D AutoCommit OFF 0x0E Commit 0x0F Rollback 0x14 Cancel 0x2B Describe 0x30 Startup 0x31 Shutdown 0x3B Version 0x43 K2 Transactions 0x47 Query 0x4A OSQL7 0x5C OKOD 0x5E Query 0x60 LOB Operations 0x62 ODNY 0x67 Transaction - end 0x68 Transaction - begin 0x69 OCCA 0x6D Startup 0x51 Logon (present password) 0x52 Logon (present username) 0x73 Logon (present password - send AUTH_PASSWORD) 0x76 Logon (present username - request AUTH_SESSKEY) 0x77 Describe 0x7F OOTCM 0x8B OKPFC
示例：
0.475183 192.168.1.108 192.168.1.102 TCP kwdb-commn > iax [PSH, ACK] Seq=890 Ack=611 Win=64925 Len=224 0000 00 0c 29 0c 9a c7 00 0c 29 fd 07 3d 08 00 45 00 ..).....)..=..E. 0010 01 08 05 16 40 00 80 06 70 b7 c0 a8 01 6c c0 a8 ....@...p....l.. 0020 01 66 04 67 11 d9 0e a7 cd fc b6 88 7c 84 50 18 .f.g........|.P. 0030 fd 9d 8a 2d 00 00 00 e0 00 00 06 04 00 00 00 00 ...-............ 0040 03 76 02 6c c8 d5 00 06 00 00 00 01 00 00 00 38 .v.l...........8 0050 c3 12 00 05 00 00 00 e0 bf 12 00 08 c5 12 00 06 ................ 0060 53 59 53 54 45 4d 0d 00 00 00 0d 41 55 54 48 5f SYSTEM.....AUTH_ 0070 54 45 52 4d 49 4e 41 4c 08 00 00 00 08 57 49 4e TERMINAL.....WIN 0080 58 50 53 50 32 00 00 00 00 0f 00 00 00 0f 41 55 XPSP2.........AU 0090 54 48 5f 50 52 4f 47 52 41 4d 5f 4e 4d 0b 00 00 TH_PROGRAM_NM... 00a0 00 0b 73 71 6c 70 6c 75 73 2e 65 78 65 00 00 00 ..sqlplus.exe... 00b0 00 0c 00 00 00 0c 41 55 54 48 5f 4d 41 43 48 49 ......AUTH_MACHI 00c0 4e 45 12 00 00 00 12 57 4f 52 4b 47 52 4f 55 50 NE.....WORKGROUP 00d0 5c 57 49 4e 58 50 53 50 32 00 00 00 00 08 00 00 \WINXPSP2....... 00e0 00 08 41 55 54 48 5f 50 49 44 07 00 00 00 07 36 ..AUTH_PID.....6 00f0 36 38 3a 39 33 32 00 00 00 00 08 00 00 00 08 41 68:932.........A 0100 55 54 48 5f 53 49 44 06 00 00 00 06 76 6d 77 61 UTH_SID.....vmwa 0110 72 65 00 00 00 00 re....
ID: 0x08
描述：“OK”服务器给客户端的响应
示例：
0.568852 192.168.1.102 192.168.1.108 TCP iax > kwdb-commn [PSH, ACK] Seq=611 Ack=1114 Win=64422 Len=165 0000 00 0c 29 fd 07 3d 00 0c 29 0c 9a c7 08 00 45 00 ..)..=..).....E. 0010 00 cd 7c d5 40 00 80 06 f9 32 c0 a8 01 66 c0 a8 ..|.@....2...f.. 0020 01 6c 11 d9 04 67 b6 88 7c 84 0e a7 ce dc 50 18 .l...g..|.....P. 0030 fb a6 21 cf 00 00 00 a5 00 00 06 04 00 00 00 00 ..!............. 0040 08 01 00 0c 00 00 00 0c 41 55 54 48 5f 53 45 53 ........AUTH_SES 0050 53 4b 45 59 20 00 00 00 20 32 33 42 37 31 36 30 SKEY ... 23B7160 0060 34 42 42 42 38 44 39 43 37 31 32 44 43 35 35 44 4BBB8D9C712DC55D 0070 34 30 38 36 43 32 32 42 32 00 00 00 00 04 01 00 4086C22B2....... 0080 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00a0 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 ................ 00b0 00 00 00 36 01 00 00 00 00 00 00 0c 41 21 00 00 ...6........A!.. 00c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00d0 00 00 00 00 00 00 00 00 00 00 00 ...........
ID: 0x11
描述：TTI (Two-Task Interface)功能扩展，下面是一些附加的标志
示例：
0.972469 192.168.1.108 192.168.1.102 TCP kwdb-commn > iax [PSH, ACK] Seq=2104 Ack=1162 Win=64374 Len=44 0000 00 0c 29 0c 9a c7 00 0c 29 fd 07 3d 08 00 45 00 ..).....)..=..E. 0010 00 54 05 19 40 00 80 06 71 68 c0 a8 01 6c c0 a8 .T..@...qh...l.. 0020 01 66 04 67 11 d9 0e a7 d2 ba b6 88 7e ab 50 18 .f.g........~.P. 0030 fb 76 0e be 00 00 00 2c 00 00 06 04 00 00 00 00 .v.....,........ 0040 11 6b 04 09 00 00 00 d3 00 00 00 01 00 00 00 03 .k.............. 0050 3b 05 94 fb 12 00 f4 01 00 00 70 fa 12 00 6c fa ;.........p...l. 0060 12 00 ..
ID: 0x20
描述：使用外部的程序和服务注册
示例：
ID: 0x44
描述：使用外部的程序和服务注册
示例：
ID: 0xdeadbeef
描述：附加网络选项，客户端可协商附加连接熟悉，例如：认证，加密，数据完整性，监控，
注意：wireshark 中叫这个包为 Secure Network Services
示例：
0.094489 192.168.1.108 192.168.1.102 TNS Response, Data (6), SNS 0000 00 0c 29 0c 9a c7 00 0c 29 fd 07 3d 08 00 45 00 ..).....)..=..E. 0010 00 d0 05 11 40 00 80 06 70 f4 c0 a8 01 6c c0 a8 ....@...p....l.. 0020 01 66 04 67 11 d9 0e a7 cb 81 b6 88 7a 42 50 18 .f.g........zBP. 0030 ff df 98 ef 00 00 00 a8 00 00 06 04 00 00 00 00 ................ 0040 dead beef 00 9e 0a 20 01 00 00 04 00 00 04 00 ....... ........ 0050 03 00 00 00 00 00 04 00 05 0a 20 01 00 00 08 00 .......... ..... 0060 01 00 00 02 9c 00 c7 c7 f3 00 12 00 01 de ad be ................ 0070 ef 00 03 00 00 00 04 00 04 00 01 00 01 00 02 00 ................ 0080 01 00 05 00 00 00 00 00 04 00 05 0a 20 01 00 00 ............ ... 0090 02 00 03 e0 e1 00 02 00 06 fc ff 00 01 00 02 01 ................ 00a0 00 03 00 00 4e 54 53 00 02 00 02 00 00 00 00 00 ....NTS......... 00b0 04 00 05 0a 20 01 00 00 0c 00 01 00 11 06 10 0c .... ........... 00c0 0f 0a 0b 08 02 01 03 00 03 00 02 00 00 00 00 00 ................ 00d0 04 00 05 0a 20 01 00 00 03 00 01 00 03 01 .... .........
根据 "Oracle Hacker‘s Handbook" 这是一个bug 在所有版本的oracle。
当一个服务器解析一个 DATA 数据包时，DATA flags的第二个bit 设置但第一个bit（最低位）未设置（例如：2,6,10,14等等）。当服务器接收这痒的包，它会陷入一个无限循环，占有所有的CPU处理时间。显然这对服务器性能产生负面影响。
标签：
原文地址：http://www.cnblogs.com/etangyushan/p/5674406.html
