Hi, May be my basics is not really correct. But shouldn't next sequence no. be sequence no. + tcp len + 1 ? Please help. asked 07 Jun '17, 02:34  user_shark converted to question 07 Jun '17, 02:36  Jasper ♦♦ |
One Answer:
No, it's "current sequence number" plus TCP payload length. The only exception are SYN and FIN flags, which both count as "ghost bytes", so if any of those is present in a packet, the sequence number is increased by +1 (plus actual payload length, if any). answered 07 Jun '17, 02:37 Jasper ♦♦ |
