How to understand the output of tcpdump?

Question

15:24:27.156744 IP 192.168.1.106.ssh > 192.168.1.105.1128: P 2327968:2328112(144) ack 30721 win 182
15:24:27.156827 IP 192.168.1.106.ssh > 192.168.1.105.1128: P 2328112:2328256(144) ack 30721 win 182

What is 1128 30721 182 and so on?

Answer 1

http://www.tcpdump.org/tcpdump_man.html

The general format of a tcp protocol line is:

src > dst: flags data-seqno ack window urgent options

Src and dst are the source and destination IP addresses and ports. Flags are some combination of S (SYN), F (FIN), P (PUSH), R (RST), W (ECN CWR) or E (ECN-Echo), or a single .' (no flags). Data-seqno describes the portion of sequence space covered by the data in this packet (see example below). Ack is sequence number of the next data expected the other direction on this connection. Window is the number of bytes of receive buffer space available the other direction on this connection. Urg indicates there isurgent' data in the packet. Options are tcp options enclosed in angle brackets (e.g., ).

Answer 2

It's been a while since I've used TCP dump, but this should be correct:

• .1128: Port number
• 30721: TCP Sequence Number
• 182: TCP Window Size