Hi,
As you may have noticed these fields are in square brackets, like so:
[Next sequence number: 17 (relative sequence number)]
This notation is of fields that are not present in the packet themselves, but
can be inferred from them. Other examples are IP header checksum, which can be
good or bad. The packet itself cannot carry this information, but Wireshark can
deduce that from other fields or even other packets.
Thanx,
Jaap
Bo Xu wrote:
I have found one strange rule in the TCP head , the next sequence number
has already been provided .
i have checked the RFC793 , but nothing methioned about this rule .
I dig it for a while , i have found that next sequence number =
sequence number + packet size ( the tcp payload ) in wireshark .
And i have traced the TCP connection for telnet , smpp , i have found it
matches this rule .
Can somebody tell me which document or RFC includes this mechanism ?
Here is one example ,
Host A--> Host B
Sequence number: 1 (relative sequence number)
Next sequence number: 17 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
then next packet of
Host A-> Host B
Sequence number: 17 (relative sequence number)
Next sequence number: 33 (relative sequence number)
Acknowledgement number: 17 (relative ack number)