This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Understanding HTTP Packet Data

0

I am trying to understand how the acknowledgment number is generated. I thought it was the sequence number + the length. Could someone please explain this to me? The first packet is my computer as the source, and it alternates from there. Image: https://ibb.co/miHFUk

asked 23 Jul '17, 11:52

droidus's gravatar image

droidus
1333
accept rate: 0%


2 Answers:

1

Your understanding is correct, but your Length column doesn't show the size of the TCP payload alone but most likely the size of the whole frame including Ethernet, IP and TCP layer. Seq numbers only reflect the TCP payload.

answered 23 Jul '17, 12:35

sindy's gravatar image

sindy
6.0k4851
accept rate: 24%

Is there any way to show the TCP payload alone?

(23 Jul '17, 15:45) droidus

Right click on one of the TCP data packets and choose follow TCP stream. A new window will pop up containing the TCP data.

(23 Jul '17, 21:14) Uli

0

The ACK-Number in TCP is used to acknowledge received data from the sender:

  • A send B 100 Bytes of data with sequence number 1000
  • B receives this data and acknowledge this with sending a packet with ACK number 1100
  • A send further 100 Bytes (now with sequence number 1100)
  • B receives the second packet and acknowledge this with ACK number 1200

However for data from B to A the sequence and acknowledge numbers for this direction is independent of A -> B.

Now to real live:

  • A can send more TCP data packets in a row without waiting for the acknowledgement. (Data packet 1 with seq 1000 and 100 Bytes; data packet 2 with seq 1100 and 100 Bytes data; data packet 3 with seq 1200 and 100 Bytes data, etc)
  • B acknowledge not every packet on its on. It can summarize the acknowledgement. (B send packet with ACK number 1300 for data packet 1, 2 and 3)
  • The frequency of ACKs depends of the implementation of the TCP stack, the received packets (e.g. A send B a packet with PSH bit set) and features like "Delayed ACK" etc.

Pakets with SYN or FIN bits set are acknowledged by incrementing the received sequence number by 1 (A->B SYN with seq 100 => B->A SYN/ACK with seq 3200 and ack 101 => A->B ACK with seq 101 and ack 3201).

answered 23 Jul '17, 12:53

Uli's gravatar image

Uli
9031515
accept rate: 29%