10

I know that in Internet Protocol Stack there are actually three layer. They are Application, Internet and Transport. Let's say HTTP in Application layer will be converted to TCP in Transport layer and TCP will be converted to IP in Internet layer.

But practically when I tried to capture a network traffic from internet, I can only understand the HTTP layer and I can't understand what is in TCP and IP.

I am using wireshark for capturing network traffic.

Please explain the process or provide a simple example for this.

Improve this question
2
  • 3
    Please clarify exactly what's confusing about TCP and IP. Right now the question is a little unclear.
    – Mike Pennington
    Jan 24, 2014 at 19:08
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Dec 20, 2020 at 2:33

3 Answers 3

Reset to default
13

There is no conversion, what you have is Encapsulation

Ex: you use wireshark on your local PC to capture your HTTP session. Basically, what you end up with looks like:

[Ethernet Frame [IP Packet [TCP Segment [HTTP Request]]]]

  • The Ethernet frame has the EtherType field of 0x0800 that gives us the encapsulated protocols as IP
  • The IP Packet has the Protocol Field of "6" that tells us the next level is TCP (ICMP is Protocol "1")
  • TCP has the Destination port of 80, on which normally a Web Server is listening to
  • HTTP is what is actually understood by a Web Server
Improve this answer
1
  • If the HTTP request is larger than max TCP segments or IP packet sizes (a file being uploaded), how does the HTTP request get chunked up?
    – Unconventional Wisdom
    Jul 16, 2021 at 18:18
10

I think your confusion starts with thinking about 'converting'. No such things happens...

IP packets are basic transport units. They have things like a source address and a destination address, and some other bookkeeping stuff, but not much else. And a packet payload of course.

UDP or TCP is the next layer. It is in the IP payload. Both UDP and TCP contain a source port and destination port. TCP also contains sequence numbers, acknowledgements etc. And again a payload.

Let's take HTTP as an example. HTTP is transmitted as payload of TCP. A client sends a request to a server, the server answers etc.

So: no conversion anywhere. Just HTTP as payload of TCP, as payload of IP.

Improve this answer
6

There's no "conversion". It's a protocol stack; or better word would be "encapsulation". Starting with an IP packet, it's payload is a TCP packet, who's payload is an HTTP transaction, which is usually more than one packet.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.