 | 1 | initial version |
As Sake noted, having a capture file allows us to use Wireshark to analyze the data, however here's what I can see:
#1 Client --> Server [SYN] seq=0
#2 Server --> Client [SYN, ACK] seq=0 ack=1
#3 Client --> Server [ACK] seq=1 ack =1
#4 Client --> Server [PSH] seq=1 ack =1 len=488
#5 Client --> Server [FIN, ACK] seq =489 ack =1
The above is a normal TCP connection, and the client sending some data, immediately followed by a FIN. Not sure why the client is sending ACK in #5 though.
#6 Server --> Client [SYN, ACK] seq=0 ack=1 retransmission
This is a retransmission. The server didn't get the client data from packets #3 to #5
#7 Client --> Server [ACK] seq=490 ack=1( I don't know why the seq is 490,because I think it should be seq =1 ack=1)
The client is now acking the server retransmission. The client seq. is 490 as that's how far it has got after #5.
#8 Client --> Server [FIN,PSH,ACK] seq=1 ack=1 len=488
The client is retransmitting the data and the FIN
#9 Server --> Client [ACK] seq=1 ack=490
The server is acking the data from the client.