Ask Your Question
0

Why am I not seeing any zero-length TCP segments in one capture file?

asked 2020-07-10 16:56:43 +0000

salwa1215 gravatar image

updated 2020-07-11 19:50:57 +0000

Guy Harris gravatar image

Is there any reason to get the NULL length payload from a pcap file and dont get them from another please ?

I tried to extract them using python whith: len (packet [TCP].paylaod)

It works for a file bu not for another one. Any idea ?

edit retag flag offensive close merge delete

Comments

Not all TCP packets have a payload, what's the length from the TCP header? A TCP ACK usually has a zero length payload.

grahamb gravatar imagegrahamb ( 2020-07-10 17:09:33 +0000 )edit

TCP segment len There are some packets with TCP segment len which is different to zero and other is equal to zero like for DUP ACK packets

salwa1215 gravatar imagesalwa1215 ( 2020-07-10 17:43:48 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2020-07-11 19:50:16 +0000

Guy Harris gravatar image

Is there any reason to get the NULL length payload from a pcap file and dont get them from another please ?

Perhaps one capture file has zero-length TCP segments and another doesn't.

The initial SYN is probably zero-length, but isn't guaranteed to be zero-length; the same applies to the SYN+ACK response and the ACK response to that in a 3-way handshake - and if your capture doesn't include the initial handshake, you won't see them regardless of whether they are zero-length or not.

If there's sufficient traffic running in both directions, each side's ACK may itself contain data, in which case there won't be zero-length segments during most of the life of the connection.

A FIN segment can also contain data, as can the ACK responding to that FIN, so when one side of the connection is being closed, there might again be no zero-length segments. When the other side of the connection sends its FIN, the ACK to that FIN will be zero-length, because the side sending that ACK has already sent its own FIN, indicating that it has no more data to send. If your capture doesn't include the close of either connection, it won't see that zero-length segment, however.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2020-07-10 16:56:43 +0000

Seen: 1,487 times

Last updated: Jul 11 '20