Sample Header Ad - 728x90

Understanding ACK numbers

0 votes
1 answer
664 views
I try to understand the reason of unordered ACK numbers. I have the following logs in wireshark:
34936 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=3595656117 TSecr=0 WS=128
    2	0.003662105	192.168.1.1	192.168.1.2	TCP	66	80 → 34936 [SYN, ACK] Seq=0 Ack=1 Win=29200 Len=0 MSS=1460 SACK_PERM=1 WS=32
    3	0.003691751	192.168.1.2	192.168.1.1	TCP	54	34936 → 80 [ACK] Seq=1 Ack=1 Win=64256 Len=0
    4	0.003803721	192.168.1.2	192.168.1.1	HTTP	767	POST /jrd/webapi?api=GetSystemStatus HTTP/1.1* (application/x-www-form-urlencoded)
    5	0.024447941	192.168.1.1	192.168.1.2	TCP	54	80 → 34936 [ACK] Seq=1 Ack=714 Win=32128 Len=0
    6	0.052296708	192.168.1.1	192.168.1.2	TCP	70	80 → 34936 [PSH, ACK] Seq=1 Ack=714 Win=32128 Len=16 [TCP segment of a reassembled PDU]
    7	0.052296845	192.168.1.1	192.168.1.2	HTTP/JSON	528	HTTP/1.1 200 OK , JavaScript Object Notation (application/json)
    8	0.052364039	192.168.1.2	192.168.1.1	TCP	54	34936 → 80 [ACK] Seq=714 Ack=17 Win=64256 Len=0
    9	0.052930703	192.168.1.2	192.168.1.1	TCP	54	34936 → 80 [FIN, ACK] Seq=714 Ack=492 Win=64128 Len=0
    10	0.061251843	192.168.1.2	192.168.1.1	TCP	74	34938 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=3595656179 TSecr=0 WS=128
    11	0.064187519	192.168.1.1	192.168.1.2	TCP	54	80 → 34936 [ACK] Seq=492 Ack=715 Win=32128 Len=0
    12	0.064187779	192.168.1.1	192.168.1.2	TCP	66	80 → 34938 [SYN, ACK] Seq=0 Ack=1 Win=29200 Len=0 MSS=1460 SACK_PERM=1 WS=32
    13	0.064330872	192.168.1.2	192.168.1.1	TCP	54	34938 → 80 [ACK] Seq=1 Ack=1 Win=64256 Len=0
    14	0.065632767	192.168.1.2	192.168.1.1	HTTP	772	POST /jrd/webapi?api=GetSMSStorageState HTTP/1.1* (application/x-www-form-urlencoded)
    15	0.066381036	192.168.1.2	192.168.1.1	TCP	74	34940 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=3595656184 TSecr=0 WS=128
    16	0.074954073	192.168.1.1	192.168.1.2	TCP	66	80 → 34940 [SYN, ACK] Seq=0 Ack=1 Win=29200 Len=0 MSS=1460 SACK_PERM=1 WS=32
    17	0.075028197	192.168.1.2	192.168.1.1	TCP	54	34940 → 80 [ACK] Seq=1 Ack=1 Win=64256 Len=0
    18	0.075349695	192.168.1.2	192.168.1.1	HTTP	772	POST /jrd/webapi?api=GetConnectionState HTTP/1.1* (application/x-www-form-urlencoded)
    19	0.080664337	192.168.1.1	192.168.1.2	TCP	70	80 → 34938 [PSH, ACK] Seq=1 Ack=719 Win=32128 Len=16 [TCP segment of a reassembled PDU]
    20	0.080664489	192.168.1.1	192.168.1.2	HTTP/JSON	304	HTTP/1.1 200 OK , JavaScript Object Notation (application/json)
    21	0.080744236	192.168.1.2	192.168.1.1	TCP	54	34938 → 80 [ACK] Seq=719 Ack=17 Win=64256 Len=0
    22	0.081363475	192.168.1.2	192.168.1.1	TCP	54	34938 → 80 [FIN, ACK] Seq=719 Ack=268 Win=64128 Len=0
    23	0.084534363	192.168.1.1	192.168.1.2	TCP	54	80 → 34938 [ACK] Seq=1 Ack=719 Win=32128 Len=0
    24	0.084606985	192.168.1.2	192.168.1.1	TCP	54	[TCP Dup ACK 22#1] 34938 → 80 [ACK] Seq=720 Ack=268 Win=64128 Len=0
    25	0.084649572	192.168.1.1	192.168.1.2	TCP	54	80 → 34940 [ACK] Seq=1 Ack=719 Win=32128 Len=0
    26	0.084649729	192.168.1.1	192.168.1.2	TCP	54	80 → 34938 [ACK] Seq=268 Ack=720 Win=321
    27	0.086781498	192.168.1.1	192.168.1.2	TCP	70	80 → 34940 [PSH, ACK] Seq=1 Ack=719 Win=32128 Len=16 [TCP segment of a reassembled PDU]
1. In string number 8 Seq=714 Ack=17. But in string number 9 Seq=714 Ack=492. I thought that Ack here 714+17=731. How Ack is calculate here and why it is 492? The same question about calculation Ack number in string 22 where Ack=268, not 736 as i expected. 2. In string number 9 there is FIN ASK flag following by SYN flag. But in string number 13 i see ASK flag following by SYN flag. I don't see FIN flag. Thank you a lot for any answers. I need to understand low-lewel TCP basis.
Asked by Tina (104 rep)
Oct 13, 2021, 02:20 AM
Last activity: Oct 13, 2021, 03:40 AM