2

In wireshark, you have this field:

[TCP Segment Len: 1380] # How is this calculated?

My assumption is using the IP headers plus TCP's.

TCP Segment Len = IP Total Length - IHL - TCP Header Length

In the packet trace, the values filled in would look like

[TCP Segment Len: 1380] = 1420 - 20 (5 bytes) - 20 (5 bytes)

1 Answer 1

3

The TCP segment length isn't specified in the header because it's redundant. All packet data following the TCP header (and options) is TCP segment data.

It's length can be calculated by taking the IP packet length and substracting the lengths of IP header + options and TCP header + options.

When a frame is received, each layer extracts its header and passes the remainder as payload up the stack. The TCP handler is passed its header with the payload attached. After removing its header what's left is the segment data - which it then passes to the application.

2
  • Why is the TCP segment length redundant?
    – jerry
    Commented May 26, 2022 at 5:29
  • Because it can be calculated from other header fields or by simply counting the bytes that follow the TCP header.
    – Zac67
    Commented May 26, 2022 at 6:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.