This * * * is 28 bytes. I suggest you keep the TCP header format at hand before you look down.

1 and 2 bytes (09 80) indicate the source port number, which is 2432 port and the port of the file server (convert 0980 into decimal);

3, 4 bytes (00 15) indicate the destination port number, 2 1 port, ftp port;

Bytes 5, 6, 7 and 8(9f 56 97 5a) represent a 32-bit serial number;

9. 10, 1 1, 12 (0000000) indicates the confirmation sequence number (it should be a message requesting connection);

The first four bits of 13 byte (70) (7 means the first length, four bytes are exactly 28 bytes, and the last four bits are useless);

14 byte (02) is only useful in the last five bits, 0000 10, and the second bit on the right is 1, which means that SYN is 1, which means that this is a requested connection;

15 and 16(fa f0) indicate the window size;

17 and 18(6f 17) represent checksums;

19 and 20(00 00) are emergency pointers (because the leftmost bit in the six bits of 14 byte is 0, these two bytes are useless);

2 1-28 is an option field (complicated, you can look it up yourself if you want to dig deep).

It's over! ! !