TCP Handshake Process with Wireshark Packet Capture

-

 

The TCP (Transmission Control Protocol- connection oriented) handshake is a three-step process used to establish a connection between a client and a server in a TCP/IP network.

Three- Way Handshake Process:

  1. SYN (Synchronize): The client initiates the connection with the server by sending SYN Packet
  2. SYN-ACK (Synchronize-Acknowledge): The server responds with a ACK packet and sends it's own SYN packet to client
  3. ACK (Acknowledge): The client responds with ACK packet to server, resulting the connection is established
Fig: TCP 3-way Handshake Process 


Here I opened the browser and searched www.google.com, the respective TCP connection is highlighted here

SYN Packet Analysis: Packet from Client to Server. Covering major fields to be checked here. Note: All the fields here related to Client Machine

Fig: SYN packet analysis


  • Destination port: Client requesting https (443) services from the server
  • TCP Segment Length: Payload of the packet. In the all 3 -way handshake processes this field is zero, because data transfer will happen only the connection established between the parties.
  • Sequence Number: 2 types can be seen here raw and relative sequence number. both are same. Raw is a random number chosen by the system while relative sequence number is for human easy understanding placed here (raw sequence: 143724499 and relative sequence: 1)
  • Acknowledgement Number: this field corresponds to the info from the server, so until the server responds to the SYN packet this field is 0
  • Flags: this field will show the current Handshake Process in the Packet
SYN-ACK Packet Analysis: Packet from Server to Client. Covering major fields to be checked here. Note: All the fields here related to Server Machine acknowledging client machine

Fig: SYN-ACK packet analysis


  • Source Port: reply coming from the server machine 
  • TCP Segment Length: Payload of the packet. In the all 3 -way handshake processes this field is zero, because data transfer will happen only the connection established between the parties.
  • Sequence Number: 2 types can be seen here raw and relative sequence number. both are same. Raw is a random number chosen by the system while relative sequence number is for human easy understanding placed here
  • Acknowledgement Number: here we can confirm the SYN packet from client acknowledged by the Server. because the relative acknowledgement is increased by 1 (as Next sequence Num in SYN Packet from Client) and raw acknowledgement is sum of raw sequence number from client +1 . which means in SYN-ACK packet the server acknowledging client sequence numbers
    relative acknowledgement = relative sequence +1 0+1=1
    raw acknowledgement = raw sequence from client machine +1 143724499+1=143724500
  • Flags: this field will show the current Handshake Process in the Packet
ACK Packet Analysis: Packet from Client to Server. Covering major fields to be checked here. Note: All the fields here related to Client Machine acknowledging Server machine

Fig: ACK packet analysis

  • Destination port: Client replying to the server regarding SYN-ACK packet
  • TCP Segment Length: Payload of the packet. In the all 3 -way handshake processes this field is zero, because data transfer will happen only the connection established between the parties.
  • Sequence Number: The Client also acknowledging the SYN-ACK packet from the Server. because the raw and relative sequence number are identical with the raw and relative acknowledgment number of the server. 
    relative sequence number:      relative acknowledgement from the server 1
    raw sequence number:     raw acknowledgement from the server 143724500
  • Acknowledgement Number: here we can confirm the SYN-ACK packet from Server acknowledged by the Client. because the relative acknowledgement is increased by 1 (as Next sequence Num in SYN-ACK Packet from Server) and raw acknowledgement is sum of raw sequence number from Server+1 . which means in ACK packet the Client acknowledging Server sequence numbers
    relative acknowledgement = relative sequence +1 0+1=1
    raw acknowledgement = raw sequence from Server machine +1 2860791319+1=2860791320
  • Flags: this field will show the current Handshake Process in the Packet
In ACK packet we can confirm both parties have agreed/acknowledged other machine proven by the sequence and acknowledgment numbers
--------------------------------------------------------------------------------------------------------------------------
+ After completing of the handshake means all the three steps, the actual payload transfer will takes place

Comments

Post a Comment

Popular posts from this blog

Understanding Titanic Survival Predictions with Decision Trees

-
Image
  Decision Tree: Supervised learning Algorithm Can do both Regression and Classification capabilities Inverted tree like structure with bunch of if-else statements The Titanic dataset is one of the most famous case studies in data science. It captures passenger details such as age, sex, class, fare, and family aboard, along with whether they survived or not. In this post, we’ll walk through how a decision tree model uses these features to predict survival, and what the visualization reveals. How the Decision Tree Works Note: These features are based on the importance table at the right side Root node: “Was the passenger male?” If female , survival chances are much higher. The tree then considers passenger class and fare to refine predictions. If male , survival chances drop significantly, but age and family aboard (siblings/spouses) still play a role. Each node in the tree shows: Gini impurity: How mixed the group is (lower / purer). Samples: Number of passengers in that group. ...
Read more

From Raw Logistics Data to Business Insights: An Excel Analytics Project (RFM Analysis)

-
Image
Analyzed logistics shipment data in Excel to evaluate delivery performance, cost, transit time, distance trends. Extended the analysis with RFM-based carrier segmentation to understand carrier utilization and spending patterns, supporting more data-driven operational decisions. My objective was to explore two practical business questions: How are delivery delays and shipment outcomes behaving across time and distance? How can carrier performance be evaluated using cost, transit time, shipment activity, and delivery performance? Starting with data quality I first reviewed the dataset for completeness and consistency. The initial cleaning process included identifying missing delivery dates and transportation costs, checking transit-day inconsistencies, and investigating numerical outliers. One thing I wanted to avoid was treating every unusual value as bad data. After null-value treatment, the working dataset contained 1,928 shipment records , while the dataset used after the selected ...
Read more

Unable to access the PaloAlto VM image via HTTPS

-
Image
Recently, I encountered an Issue of "Unable to access the PaloAlto VM image via HTTPS". Here's how I applied troubleshooting steps to resolve it: Configuration Changes done before: Configured static management IP & default gateway and rebooted the PA VM, then faced the issue. Observed: Unable to access the PaloAlto VM image via HTTPS. Unable to ping to the default Gateway from the PA and viceversa. Error- getting Destination Host Unreachable in both cases. Analyzed: + Checked the Management IP address and netmask, both are same as bridged network (physical) + Checked the default route "show routing route" - no route configured + While pinging from the base machine to PA and vice versa getting error as "Destination is Unreachable". Hypothesized: + As per the Error message, primarily issue is Network related, that the PA VM is unable to reach physical NIC IP. Tested: + Tried with changing the management IP address within the same subnet (as physic...
Read more