Unit 4: TCP, UDP and ports · Lesson 3 of 6 · 15 min
Sequence numbers
See how both sides count every byte and why tshark shows small relative numbers.
mission
- You are
- The analyst checking a capture for tampering.
- Situation
- Someone claims a capture was edited. Sequence numbers make that hard to hide, because every byte is counted on both sides.
- Goal
- Read raw and relative sequence numbers and the size of the data each packet carries.
- Hand in
- The payload size of the login request in http.pcap.
Counting bytes in both directions
Press play or step through.
Relative and raw numbers
Each side starts at a random number. tshark subtracts it so you see 0 and 1; the raw fields show what was on the wire.
tshark -r handshake.pcap -Y frame.number==2 -T fields -e tcp.seq -e tcp.ack -e tcp.seq_raw -e tcp.ack_raw
0 1 3656664648 3717026330
you should see The server's ACK is the client's starting number plus one.
Read all flags at once
tcp.flags.str prints one character per flag, with dots for the ones not set.
tshark -r handshake.pcap -T fields -e frame.number -e tcp.flags.str
1 ··········S·
2 ·······A··S·
3 ·······A····
4 ·······A···F
5 ·······A···F
6 ·······A····
Find how much data a packet carries
tcp.len is the payload size. The next sequence number from the same side will be larger by exactly that much.
tshark -r http.pcap -Y 'http.request' -T fields -e frame.number -e http.request.method -e tcp.len
4 GET 155
14 POST 246
24 GET 185
you should see The POST carries 246 bytes.
defender tip Gaps in sequence numbers inside a capture usually mean packets were dropped by the capture, not that someone tampered with it. Check tcp.analysis.lost_segment before drawing conclusions.
Fields for this lesson
| Command | What it does |
|---|---|
tcp.seq / tcp.ack | Relative sequence and acknowledgement numbers |
tcp.seq_raw / tcp.ack_raw | The real 32-bit numbers on the wire |
tcp.len | Bytes of data in this segment |
tcp.flags.str | All flags at once, one character each |
Count retransmissions
tshark tracks sequence numbers and flags any segment sent twice.
tshark -r incident.pcap -Y tcp.analysis.retransmission | wc -l
2
you should see Two retransmissions in the whole incident capture.
What a defender takes away
- 1Both sides count bytes from a random start.
- 2The acknowledgement names the next byte expected.
- 3tcp.len tells you how much data moved, packet by packet.
Questions
0 of 1 solved
Answer each one from what you find on your lab machine.