Ethereal-users: Re: [Ethereal-users] Trying to understand ACK and SEQ numbers

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Jack Jackson <jack@xxxxxxxxxxxxxxx>
Date: Tue, 20 Sep 2005 10:19:15 -0700
At 08:30 AM 9/20/2005, JS wrote:
I have this print from a part of a session where a
client is uploading some text to a server. The client
is: 192.168.1.102 and the server is: 128.119.245.12.

In the part below the client starts sending seq 1 and
seq 565. Then the server responds with an ACK segment,
but how do I know which of the client segments this
ACK applies to?

In the last line I get another ACK from the server,
but again how do I find out which klient segment this
ACK applies to?? There are 4 klient segments but only
2 server segments.



192.168.1.102 / 128.119.245.12 TCP 1161 > www [PSH,
ACK] Seq=1 Ack=1 Win=17520 Len=565

This is a 565 byte segment starting at sequence 1 (1-565). Call this segment 1.

192.168.1.102 / 128.119.245.12 TCP 1161 > www [PSH,
ACK] Seq=566 Ack=1 Win=17520 Len=1460

This is a 1460 byte segment starting at sequence 566 (566-2025).  Segment 2.

128.119.245.12 / 192.168.1.102 TCP www > 1161 [ACK]
Seq=1 Ack=566 Win=6780 Len=0

This is a zero length segment that ACKs everything up to but not including sequence 566, so it ACKs everything in segment 1.

192.168.1.102 / 128.119.245.12 TCP 1161 > www [ACK]
Seq=2026 Ack=1 Win=17520 Len=1460

This is a 1460 byte segment starting at sequence 2026 (2026-3485).  Segment 3.

192.168.1.102 / 128.119.245.12 TCP 1161 > www [ACK]
Seq=3486 Ack=1 Win=17520 Len=1460

1460 byte segment starting at sequence 3486 (3486-4945).  Segment 4.

128.119.245.12 / 192.168.1.102 TCP www > 1161 [ACK]
Seq=1 Ack=2026 Win=8760 Len=0

This ACKs everything up to but not including sequence 2026, which ACKs segment 2.

TCP sequence numbers and ACK numbers refer to bytes in the TCP stream, not to segments that are transmitted.