1

The snapshot capture below contains a single HTTP request to a web server, in which the client web browser requests some files from server, and the server returns an HTTP/1.1 200 (OK) response which includes the file requested:

enter image description here

Here is what I understood!!

Packet# 4 After the connection is established,the client initiates the push function and sends the payload(HTTP request) containing the client request for the files from server!!!

On server side, receiving the payload it increment the ACK (payload size is 207) thereby it will become 208.

After that, on packet#7 server responds to client for what was requested for.It sends the payload with 1368 bytes. This happened two times as we could see the seq number as 2737.

please correct me if I'm wrong up to this point.

From packet#9

How come the sequence number changed to 208 and ACK=3680 on packet#9. Is there any transfer from the client side?

on packet#11 how come again sequence number change to 3680 and ack=343.

Can some one help me in explaining after the packet#9

Improve this question

1 Answer 1

Reset to default
1

I think you just need to remember these two key ideas:

  1. The Sequence Number is the first Byte of the packet, not the length.
  2. The Acknowledge Number is basically saying, "The next sequence number I'm expecting to see from the other side is X"

So to answer your questions:

How come the sequence number changed to 208 and ACK=3680 on packet#9. Is there any transfer from the client side?

The Sequence number of packet 9 is 208 because in packet 4, the client sent to webserver the HTTP GET request. The sequence number of packet 4 was 1, so when you add on the payload of 207, the next sequence number that the client should use is 208. You can see that in packet 5, the ACK from the server is 208. In other words, the server acknowledges all data upto and including 207 and expects the next sequence number from the client to be 208.

The Acknowledgement number of packet 9 is 3680 because the server has sent 3 packets with a payload. Packet 6 had a payload of 1368, packet 7 has a payload of 1368 and packet 8 has a payload of 943. Again, this makes sense when you consider that the sequence number is the first byte in the packet. If you look at packet 6 for example, the sequence number is 1, however you can see from packet 7 that the sequence number has jumped to 1369 so you can figure out that packet 6 must have had a payload of 1368.

on packet#11 how come again sequence number change to 3680 and ack=343.

The same principles apply here. For packet 11, the sequence number is 3680 because the last packet that the server sent (packet 8) had a sequence number of 2737 plus a payload of 943, so the next sequence number it should use is 3680.

The Acknowledgement Number is 342 because the client sent a payload in packet 10. Packet 10 had a sequence number of 208 so we can calculate that the payload in the PSH/ACK must have been 134. Again, the server is saying "I acknowledge all of your data upto and including Byte 341. The next Sequence number I expect to see from you is 342."

Hope that helps, let me know if you need anything clarified.

Friendly advice: Don't use the snipping tool and then take a picture on your phone, just post a screenshot. :)

Improve this answer

Not the answer you're looking for? Browse other questions tagged .