Unit 4: TCP, UDP and ports · Lesson 3 of 6 · 15 min
Sequence numbers
See how both sides count every byte and why tshark shows small relative numbers.
mission
- You are
- The analyst checking a capture for tampering.
- Situation
- Someone claims a capture was edited. Sequence numbers make that hard to hide, because every byte is counted on both sides.
- Goal
- Read raw and relative sequence numbers and the size of the data each packet carries.
- Hand in
- The payload size of the login request in http.pcap.
Counting bytes in both directions
Press play or step through.
Relative and raw numbers
Each side starts at a random number. tshark subtracts it so you see 0 and 1; the raw fields show what was on the wire.
tshark -r handshake.pcap -Y frame.number==2 -T fields -e tcp.seq -e tcp.ack -e tcp.seq_raw -e tcp.ack_raw
0 1 3656664648 3717026330
you should see The server's ACK is the client's starting number plus one.
tshark- The command-line version of Wireshark. Reads captures and filters packets by protocol fields. Install with sudo apt install tshark, or brew install wireshark on a Mac.
Read all flags at once
tcp.flags.str prints one character per flag, with dots for the ones not set.
tshark -r handshake.pcap -T fields -e frame.number -e tcp.flags.str
1 ··········S·
2 ·······A··S·
3 ·······A····
4 ·······A···F
5 ·······A···F
6 ·······A····
Find how much data a packet carries
tcp.len is the payload size. The next sequence number from the same side will be larger by exactly that much.
tshark -r http.pcap -Y 'http.request' -T fields -e frame.number -e http.request.method -e tcp.len
4 GET 155
14 POST 246
24 GET 185
you should see The POST carries 246 bytes.
defender tip Gaps in sequence numbers inside a capture usually mean packets were dropped by the capture, not that someone tampered with it. Check tcp.analysis.lost_segment before drawing conclusions.
Fields for this lesson
| Command | What it does |
|---|---|
tcp.seq / tcp.ack | Relative sequence and acknowledgement numbers |
tcp.seq_raw / tcp.ack_raw | The real 32-bit numbers on the wire |
tcp.len | Bytes of data in this segment |
tcp.flags.str | All flags at once, one character each |
Count retransmissions
tshark tracks sequence numbers and flags any segment sent twice.
tshark -r incident.pcap -Y tcp.analysis.retransmission | wc -l
2
you should see Two retransmissions in the whole incident capture.
wc- Counts lines, words and bytes. Built into Linux and macOS.
What a defender takes away
- 1Both sides count bytes from a random start.
- 2The acknowledgement names the next byte expected.
- 3tcp.len tells you how much data moved, packet by packet.
Questions
0 of 1 solved
Answer each one from what you find on your lab machine.