This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello, i have this problem while tracing this Pcap file, i am trying to understand the relation between ack and seq and len , i thought i understand it but check packet 7 , i don't understand ..can anyone explain to me please what is happening here ? i thought that the ack = seq no. + Len alt text, but here in line 7 what i understood doesn't apply!

asked 26 May '15, 15:28

yas1234's gravatar image

yas1234
16182023
accept rate: 0%


you have captured locally, which means that you see outgoing packets that are much larger than they actually were. This is caused by the network card performing segment offloading. The ACK you see is for a much smaller packet (which is correct). The big packet in line 5 isn't what was really sent.

If you try to track sequence and ack numbers, do NOT use captures you've taken locally. Use a third PC to record what the other two are sending.

Also see https://blog.packet-foo.com/2014/05/the-drawbacks-of-local-packet-captures/

permanent link

answered 26 May '15, 21:39

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×36
×6
×3

question asked: 26 May '15, 15:28

question was seen: 1,822 times

last updated: 26 May '15, 21:39

p​o​w​e​r​e​d by O​S​Q​A