0

I was watching the TCP Stream out of pure curiosity of my FTP Server and saw that the ACK and SEQ number increases by one with each sequence being transmitted successfully. I am not sure, but Wireshark won't show it, isn't there a random number before and increased by one after the 3-Way-Handshake between both communicating parties to declare if a sequence was sent/received correctly?

May I ask what happens if you have a HUGE file which you want to transmit and which is cut into billions of sequences and you reach the border of 32 or even 64 Bits of this ACK and SEQ counter? Does the transmission stop and would it crash the NIC?

(I could maliciously imagine to send a SEQ number starting at the very last number of the 64 Bit range...)

Improve this question

1 Answer 1

Reset to default
3

of the 64 Bit range...

Sequence numbers are 32 bit only.
And they simply wrap around.

Improve this answer
6
  • Good to know. I didn't know. What happens then, after wrapping around? If they overlap? Could you please give me any reference?
    – Semo
    Commented Jan 3, 2019 at 12:05
  • 1
    @Semo: see this answer or this article for details about "Protection Against Wrapped Sequence".
    – Steffen Ullrich
    Commented Jan 3, 2019 at 12:10
  • So the answer is: No it is impossible to crash the NIC and exceeding is possible due to wrapping around. Thank you for the hints. This is had in mind, what happens if a package overtakes another one because of wrapping?
    – Semo
    Commented Jan 3, 2019 at 12:15
  • 1
    @Semo: There is no such overtaking. The OS kernel is aware of the wrapping and puts the packets in the correct order when reassembling the data stream.
    – Steffen Ullrich
    Commented Jan 3, 2019 at 12:23
  • Ok. I will read the Blogpost soon after work, but how does it track the seq order? The Kernel is aware... This leads me to the assumtion, that it has a kind of time-awareness? So I guess it's perhaps nearly impossible to wrap-around 2x whithout a time-out? But what if someone stupid configured a very small segment size (I know it's possible in a way), so that wrapping will happen faster... Is this total fiction or a possible attack vector?
    – Semo
    Commented Jan 3, 2019 at 12:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.