2

If the packets captured by wireshark is

28.263227 193.54.236.133 193.54.236.132 66 55555 > 19745 [ACK] Seq=1 Ack=2897 Win=2880 Len=0

28.263228 193.54.236.132 193.54.236.133 1514 19745 > 55555 [PSH, ACK] Seq=2897 Ack=1 Win=5760 Len=1448

What is the last byte received on the machine having IP 193.54.236.133 ? Is it 2897+1448 or 2897+1448-1 ? And why is there a PSH flag in the second packet ?

  • is this an exam question? ...if it is, we don't do homework/exam questions. – Craig Constantine Dec 19 '14 at 1:33
4

Because 2897 is the sequence number of the first byte in the received segment, the sequence number of the last byte is 2897+1448-1. When this segment is acked, the ACK field will contain 2897+1448 since that is the sequence number of the next byte expected to arrive.

The PSH or push flag indicates that TCP should not buffer this data. In other words, TCP should not wait for more data before transmitting it (sender) or before handing it over to the application (receiver). As to why the flag is there in this case, that is a question for whoever wrote the application or protocol being used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.