This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Getting only ACK after 3 handshake

0

In the capture getting only ACK after 3 way handshake, there are also some dup ack and psh ack packet. But major count of packet is ACK.

after 3 way handshake, there must be data packet but don't see any in complete capture.

alt text

asked 05 Dec '16, 07:41

Rajputparveen's gravatar image

Rajputparveen
6112
accept rate: 0%


One Answer:

1

Check all the packets with "Len=" at the end - those are packets with TCP data.

answered 05 Dec '16, 07:43

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Hi, Thanks for reply. Does all data packet keep ACK tag? there are only ACK tag whether sender or receiver sending the packet.

yes, have capture of length 1200 byte but with ACK tag only.

(05 Dec '16, 07:54) Rajputparveen
1

Yes, all TCP packets except the first SYN packet of a conversation have the ACK flag set. Every packet except the first always acknowledges the packets from the other side, even if there's no new data (in which case the ACK number simply stays the same).

(05 Dec '16, 08:00) Jasper ♦♦

Thanks for the information.

(05 Dec '16, 23:53) Rajputparveen

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(06 Dec '16, 01:42) grahamb ♦