This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Initial SYN handshake

0

During the initial SyN handshake we see a "windows size" field in the trace file. Is that field sent by the client (sender) or the destination (server) ?

My understanding is that the initial SYN in the beginning of the three way handshake is always started from the client (sender), is that correct ?

asked 13 Aug '13, 19:45

Robbie%20S's gravatar image

Robbie S
26224
accept rate: 0%


2 Answers:

0

Yes that is correct.

"Active opener trying to connect to the Passive Listener"

answered 13 Aug '13, 21:39

krishnayeddula's gravatar image

krishnayeddula
629354148
accept rate: 6%

0

The SYN is sent by the system that is initiating the TCP connection. That is usually, but not always, the client. For example, in FTP, the FTP client will initiate a connection to the FTP server on the command channel (port 21). Each system is both a sender and a receiver. The client sends commands, and the server sends responses.

However, when files are uploaded or downloaded, a separate connection is established. In active FTP, the server connects to the client; in passive FTP the client connects to the server. Data flows in one direction only. Which system is the sender depends on whether the transfer is an upload or a download.

Both systems send their window size.

answered 13 Aug '13, 22:07

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%