So let’s look at a more complete example.
In this example, host A initiates a session with the source port of 1024
in a destination port of 23, in other words telnet.
Host A sends 10 bytes of data and an initial sequence number of 10.
Host B acknowledges receipt of the 10 bytes
by sending an acknowledgement number back to A of 11.
Host B in this example, also sets its initial sequence number to 5.
please note also that the port numbers are reversed
the source port for traffic going from B to A is 23 and the destination port is 1024.
In this example because we’re using a sliding window
A may send 250 bytes of data for example.
So notice the sequence number is incremented to 260.
In previous examples, we’ve use easy numbers
the window size of 1 or window size of 3 but please note in reality
window sizes are set to the amount of data that can be transmitted in bytes.
So this may not be as easy to read as sequences of 1, 2, and 3.
receipt of data up to sequence 5 and thus acknowledging sequence number 6.
The source ports are swap round again
so the source port is 1024 and the destination port is 23.
Now host B is acknowledging for sequence number 261
remember A send 10 bytes and the 250 bytes
so in other words 260 bytes of data.
B is sending sequence number 6 and once again the port numbers are reversed.
It’s a very important that you understand, how source and destination ports work
So on that note there is nothing better than showing you real world example using Wireshark.
So I’m going to capture traffic on my network
and then I’m going to go to for instance google.com with my web browser.
I’ll go back to Wireshark and stop the capture, here's an example is the DNS query.
So we’ve got host 10.0.0.1 which is my machine
a Dell laptop, querying the DNS server.
At layer 2, you can see the source is my Dell machine going to my Cisco router.
This is an Ethernet 2 frame and please note the type field.
At layer 2 as mentioned, the type field specifies the protocol at layer 3.
In this case 0x0800 in hexadecimal specifies that the layer 3 protocol is IPv4.
At layer 3 you can see the source IP address and the destination IP address.
My PC and the DNS server, you can see that this is IPv4
you can see the header length is 20 bytes.
DSCP or Differentiated Services Code Points is not used in this example
notice ECN which is to do with explicit congestion notification
I mentioned that briefly when talking about the TCP header.
What I’d like you to see here is notice the protocol at layer 4 is UDP
that values in hexadecimal, so 11 in hexadecimal is equal to 17
the protocol number once again for UDP is 17.
So at layer 4, we can see that User Datagram Protocol or UDP is being used.
The source port is 62249, in other words, a dynamic or ephemeral port
going to a destination port of 53 in other words DNS.
We can see the port numbers once again, and opening up the DNS query
we can see that it was a query, looking for specific host address.
Here we have a DNS response from the DNS server to my host.
So once again, very quickly at layer 2
you can see the type field denotes the protocol at layer 3.
At layer 3, the protocol field, tells us which protocol is used at layer 4
Here’s another DNS query from my host to the DNS server.
And if we open up the DNS query information
you can see that it’s a query for google.com
and it's a host query, notice type A, the DNS server replies
and notice in the answer, it give us the IP address of google.com
Now here’s the three-way handshake between my machine and Google.
Notice the source is 10.0.0.1
and the destination is this IP address which is Google.
Notice the source port is 58313 destinations is 80
in other words I’m opening up a web connection to a web server.
Opening that up, you can see once again the source and destination port numbers
but notice here the flag that are set is SYN.
So opening that up you can see that
all the other flags or bit set to 0 except for the SYN bit
and opening that up you can see, we are trying to set up a connection to the server
so we’ve got a connection establish request message to the server.
No other flags are set. Notice the initial window size is 8192
and opening up the options, you can see that the MSS or Maximum Segment Size is set to 1460 bytes.
The reply from Google to my machine at layer 4 shows that the source port is 80
and the destination port is 58313.
Opening that up, notice the flags that are set are SYN ACK
so it’s a second part of the three-way handshake.
Notice the acknowledgement bit is set and the synchronization bit is set
opening that up, you can see that it's a connection establish acknowledgment from Google.
Notice the window size request is 5720 and if we open up the options
notice here the maximum segment size is 1430.
Looking at the last part of three-way handshake
notice my machine talking to Google
opening up TCP, you can see that the flags that are set is just the acknowledgement bit
and the window size requested 64350
and looking at the sequence acknowledgment analysis
notice that this is an acknowledgement.
Going back to the first step of the three-way hand shake
notice that the initial sequence number from my machine to Google is set to 0.
Going to the actual TCP header, notice the sequence number 0.
Googles reply as a sequence number 0 and the acknowledgement of 1.
As you can see here as well.
So they are letting us know, the next segment that they expect to receive is segment 1.
Our acknowledgement to them, is we are sending sequence number 1
and we are acknowledging the sequence number 1.
This is as per what we discussed.
Later on, when HTTP is being received
notice, we are receiving information from Google to our machine its TCP
and notice here, this is a TCP segment of the re-assembled Protocol Data Unit.
In other words this is a fragment.
Looking at TCP, we can see the sources HTTP and the destination is our port number.
In other words Google is sending traffic to us
notice here that the sequence number is 2861
the next sequence number is 3798
and the acknowledgement number is 944.
so the next sequence number remember is 3798
going to the very next part of the capture
notice the sequence number here is 3798 and the next sequence number is 5228.
And notice there’s an acknowledgement from our machine to Google
saying that we expect to receive 5228.
And then the very next capture you can see
that sequence number 5228, were sent from Google to us.
The next sequence number is 6658, which is the next piece received.
Notice 6658 is the sequence number received.
Our host is acknowledging receipt of that
and saying that the next bit of data to receive is 7894
going to the next capture, you can see that the sequence number is what Google sent to us.
Now without boring you any longer
I’m hoping that this capture gives you a little bit of insight
into what's actually happening on the wire.
wirehark remembers a free application that you can download
just search for it on the internet
now I suggest that you captures some traffic on your machine
so that you can actually see what's going on in the back ground.
So what have we covered?
In this section we look at the 2 main protocols residing at layer 4.
UDP or User Datagram Protocol and TCP or Transmission Control Protocol.
I explained port numbers and which port numbers would be used in which scenarios.
I explained the TCP three-way handshake
I explained windowing and I explained sequence numbers.
Thank you for watching!