7

I know that in Internet Protocol Stack there are actually three layer. They are Application, Internet and Transport. Let's say HTTP in Application layer will be converted to TCP in Transport layer and TCP will be converted to IP in Internet layer.

But practically when I tried to capture a network traffic from internet, I can only understand the HTTP layer and I can't understand what is in TCP and IP.

I am using wireshark for capturing network traffic.

Please explain the process or provide a simple example for this.

  • 3
    Please clarify exactly what's confusing about TCP and IP. Right now the question is a little unclear. – Mike Pennington Jan 24 '14 at 19:08
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 8 '17 at 16:01
12

There is no conversion, what you have is Encapsulation

Ex: you use wireshark on your local PC to capture your HTTP session. Basically, what you end up with looks like:

[Ethernet Frame [IP Packet [TCP Segment [HTTP Request]]]]

  • The Ethernet frame has the EtherType field of 0x0800 that gives us the encapsulated protocols as IP
  • The IP Packet has the Protocol Field of "6" that tells us the next level is TCP (ICMP is Protocol "1")
  • TCP has the Destination port of 80, on which normally a Web Server is listening to
  • HTTP is what is actually understood by a Web Server
| improve this answer | |
8

I think your confusion starts with thinking about 'converting'. No such things happens...

IP packets are basic transport units. They have things like a source address and a destination address, and some other bookkeeping stuff, but not much else. And a packet payload of course.

UDP or TCP is the next layer. It is in the IP payload. Both UDP and TCP contain a source port and destination port. TCP also contains sequence numbers, acknowledgements etc. And again a payload.

Let's take HTTP as an example. HTTP is transmitted as payload of TCP. A client sends a request to a server, the server answers etc.

So: no conversion anywhere. Just HTTP as payload of TCP, as payload of IP.

| improve this answer | |
5

There's no "conversion". It's a protocol stack; or better word would be "encapsulation". Starting with an IP packet, it's payload is a TCP packet, who's payload is an HTTP transaction, which is usually more than one packet.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.