In the capture getting only ACK after 3 way handshake, there are also some dup ack and psh ack packet. But major count of packet is ACK. after 3 way handshake, there must be data packet but don't see any in complete capture.
asked 05 Dec '16, 07:41  Rajputparveen |
One Answer:
Check all the packets with "Len=" at the end - those are packets with TCP data. answered 05 Dec '16, 07:43  Jasper ♦♦ |
Hi, Thanks for reply. Does all data packet keep ACK tag? there are only ACK tag whether sender or receiver sending the packet.
yes, have capture of length 1200 byte but with ACK tag only.
Yes, all TCP packets except the first SYN packet of a conversation have the ACK flag set. Every packet except the first always acknowledges the packets from the other side, even if there's no new data (in which case the ACK number simply stays the same).
Thanks for the information.
If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.