Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Looking at the image below, taken from the book of Ilya Grigorik - High Performance Browser Networking, I can understand that the SYN packet picks a random sequence number which is incremented in SYN ACK packet (N+1). Finally, in the ACK packet both sequence (N+1) and acknowledge (N+1) numbers are incremented.

When testing with Wireshark I got the ACK packet to have Acknowledgment number = N+1 but the Sequence number = N. Is this a mistake by the author when he says that in ACK packet both Sequence and Acknowledgment numbers are incremented?

enter image description here

share|improve this question
up vote 5 down vote accepted

RFC 793 states repeatedly that the acknowledgement number is the sequence number of the next packet that end expects to receive. Thus it will always be higher than the sequence number.

For instance, in section 2.6:

Segments also carry an acknowledgment number which is the sequence number of the next expected data octet of transmissions in the reverse direction.

In section 3.1:

Acknowledgment Number: 32 bits

If the ACK control bit is set this field contains the value of the next sequence number the sender of the segment is expecting to receive. Once a connection is established this is always sent.

Section 3.3 explains in detail how the sequence numbers work, and why they work the way they do. You will probably find it much more enlightening than your book.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.