I am using Scapy to try and read the seq and ack numbers of tcp packets using the following sample code:
packet = sniff(iface=argv[1], prn=scan, filter="", count=1)[0]
print "Found SEQ " + str(packet.getlayer(TCP).seq) +" ACK " + str(packet.getlayer(TCP).ack)
However,I found the numbers to be extremely large like 3786938882 and 298237083. When I view the packets in wireshark, their values were only like 65 and 150 for example. Am I supposed to put the values into some sort of formatting?
TCP actually starts with a large, random, 32-bit sequence number. Scapy appears to be showing you what the sequence numbers actually are. Wireshark is converting the TCP sequence numbers into relative sequence numbers. see TCP_Relative_Sequence_Numbers:
TCP Relative Sequence Numbers & TCP Window Scaling
By default Wireshark and TShark will keep track of all TCP sessions and convert all Sequence Numbers (SEQ numbers) and Acknowledge Numbers (ACK Numbers) into relative numbers. This means that instead of displaying the real/absolute SEQ and ACK numbers in the display, Wireshark will display a SEQ and ACK number relative to the first seen segment for that conversation.
This means that all SEQ and ACK numbers always start at 0 for the first packet seen in each conversation.
This makes the numbers much smaller and easier to read and compare than the real numbers which normally are initialized to randomly selected numbers in the range 0 - (2^32)-1 during the SYN phase.
This usability feature relies on features from TCP_Analyze_Sequence_Numbers so in order to use this feature you must also enable TCP_Analyze_Sequence_Numbers.
Using relative sequence numbers is a usability enhancement, making the numbers easier to read and compare. In order to compare a dissection with data from a less advanced analyzer that can not handle relative sequence numbers it might be required to temporarily disable this feature in Wireshark.
For Wireshark versions prior to 1.5: When the Relative Sequence Numbers preference is enabled Wireshark will also enable "Window Scaling".
For Wireshark 1.5 & newer: "Window Scaling" is a separate TCP preference enabled by default.
If "Window Scaling" is enabled, Wireshark will try to monitor the TCP Window Scaling option negotiated during the SYN phase and if such TCP Window Scaling has been detected, Wireshark will also scale the window field and translate it to the effective window size. This may affect what the dissected and reported window is and may make Wireshark to decode packets differently, but more accurately, than other tools.
To disable relative sequence numbers and instead display them as the real absolute numbers, go to the TCP preferences and untick the box for
relative sequence numbers.
