This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

In the capture getting only ACK after 3 way handshake, there are also some dup ack and psh ack packet. But major count of packet is ACK.

after 3 way handshake, there must be data packet but don't see any in complete capture.

alt text

asked 05 Dec '16, 07:41

Rajputparveen's gravatar image

Rajputparveen
6112
accept rate: 0%


Check all the packets with "Len=" at the end - those are packets with TCP data.

permanent link

answered 05 Dec '16, 07:43

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Hi, Thanks for reply. Does all data packet keep ACK tag? there are only ACK tag whether sender or receiver sending the packet.

yes, have capture of length 1200 byte but with ACK tag only.

(05 Dec '16, 07:54) Rajputparveen
1

Yes, all TCP packets except the first SYN packet of a conversation have the ACK flag set. Every packet except the first always acknowledges the packets from the other side, even if there's no new data (in which case the ACK number simply stays the same).

(05 Dec '16, 08:00) Jasper ♦♦

Thanks for the information.

(05 Dec '16, 23:53) Rajputparveen

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(06 Dec '16, 01:42) grahamb ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×139
×2
×1

question asked: 05 Dec '16, 07:41

question was seen: 1,138 times

last updated: 06 Dec '16, 01:42

p​o​w​e​r​e​d by O​S​Q​A