Ask Your Question

Why did Sequence number reduce

asked 2018-01-24 16:46:49 +0000

Vindra gravatar image

I am new to packet analysis and Wireshark. I need help in understanding. I will appreciate if someone please enlighten me on what is happening in captured file.

Q. Please refer to packet 64 and 101. They belong to the same TCP stream. Why does Seq # in packet #101 reduce by 1 from packet # 64?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2018-01-24 17:28:38 +0000

updated 2018-01-24 17:38:05 +0000

This is because packet 101 is a special type of packet called (as Wireshark tells you) Keep-alive probe.

It's used for testing whether TCP connection is still active and it has Seq N reduced by 1. You've received packet 102 "Keep-alive ACK" successfully, that means indeed TCP-connection is still active. Do not consider it as usual data exchange packet.

See also this question

edit flag offensive delete link more


Thank you for explanation. It cleared my doubt. I was little surprised. I was expecting next sequence number for the 2nd keep-alive request from Client to the Server.

T Srinivas gravatar imageT Srinivas ( 2019-01-02 05:45:22 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-01-24 16:46:49 +0000

Seen: 505 times

Last updated: Jan 24 '18