2

Could anyone explain the main principe of tcp flow when making a session ?

I have take a tcp dump when i'm trying to browse a site. when I analyse the packet by wireshark, i have found many Three way handshake process for one site browse. is that considere as normal ? below the flow :

1-[SYN], 2-[SYN,ACK],3-[ACK], 4-GET/HTTP/1.1 , 5-HTTP/1.1 301 Moved Permanently (text/html), 6-[ACK],7-[ACK],8-[TCP DUP ACK6#1], 9-[SYN],10-[SYN,ACK], 11-[ACK], 12-Client Hello, 13-[ACK]

Improve this question
3
  • 2
    The fact the the second TCP handshake then moves on to "Client Hello" makes me thing that you actually switched to a different protocol. The first HTTP request (and TCP connection) resulted in an HTTP redirect, which was probably an HTTP to HTTPS redirect, and then a new connection (HTTP over TLS over TCP) was opened on a different port, am I correct?
    – jcaron
    Commented Dec 11, 2018 at 22:51
  • @jcaron, In this case yes, i think so too,the second TCP handshake here is a process for the switching to a different protocol (HTTP to TLSv1.2) but for the third,... there 're multiple TCP connection open to load other TCP stream content
    – Mamitiana Ra
    Commented Dec 13, 2018 at 13:08
  • 1
    There are only 2 TCP connections in the data you provided above. Without more detailed logs, difficult to tell you more.
    – jcaron
    Commented Dec 13, 2018 at 14:20

2 Answers 2

Reset to default
3

The answer to your question is yes, it's normal. Modern web sites use multiple TCP streams to build the web page you see in your browser. Text and images can be downloaded concurrently, making the page load faster. Also, as you may notice, a single "page" may have components download from many different servers.

Improve this answer
0
3

A browser may open multiple TCP connections in order to simultaneously load different parts of a web page. Each TCP connection will need to run through the full TCP handshake process because it is a separate connection.

If you look closely, you will see different source ports on each connection. A connection is identified by a pair of sockets (source and destination), each socket consisting of the IP and TCP addresses. If you change even one of the four values (source or destination IP or TCP addresses), then it is a different TCP connection, and the connection must be initialized.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.