I am looking a way to compute the data transfer from server to client. Seq.no of syn-ack from server is 0(relative seq enabled) Ack.no of last packet from client is 158068267 By subtracting 158068267 from 0 we will get total number of bytes transferred from server to client. However,the approach statistics>Conversations>TCP is showing 163837601 bytes transferred from B--->A Any reason behind this difference? asked 07 Mar '13, 12:30  krishnayeddula |
One Answer:
Statistics > Conversations > TCP shows the total number of bytes transferred including overhead, such as the TCP header, the IP header, the Ethernet header, any Ethernet padding on undersized frames, etc. Subtracting the initial sequence number from the final sequence number will give you the total number of bytes of TCP data transferred (assuming the sequence number has not wrapped). This is payload only and does not include overhead. answered 07 Mar '13, 12:46  Jim Aragon |
That helps.Thanks!
What if i get, Less acknowledgement number and high sequence number.
What will be my transfer data session ?
Will this still valid - Subtracting the initial sequence number from the final sequence number will give you the total number of bytes of TCP data transferred ??
Please help.
AFAIK,Less acknowledgement and high sequence number will never happen. In your screen shot you are comparing sequence and acknowledgement from single host perspective that is why you are seeing high sequence number and low acknowledgement number but if you compare the sequence number of other end(which will be in syn-ack if it is server or in syn if it is client) with the acknowledgement of the one you are showing,ack number will outweigh(data transfer is incremental starting from 1 byte and goes on) the sequence number. Hope this clears...
IF you're using relative sequence numbers, and IF the sequence numbers haven't wrapped, and IF you captured the SYN and SYN/ACK, THEN the SEQ number is the number of bytes of TCP data transmitted by this host in this one TCP conversation up to this point, and the ACK number is the number of bytes transmitted by the other host. If you want to be really accurate, subtract one byte in each direction for the phantom byte during connection establishment, and if this is the last packet and the connection has been closed, subtract another byte in each direction for the phantom byte during teardown.