The TCP capture is open to everyone. Sign up free to keep exploring, and see plans to unlock every other protocol.
Packet Studio
Pick a conversation, replay it, then click any packet and any field. The ladder shows who talks to whom, the anatomy strip shows how the headers are stacked, and the theory below explains why each packet exists.
Try filters: tcp.flags.syn==1 · udp.port==53 · icmp.type==11 · ip.ttl<64 · tcp.analysis.flags · !tcp
TCP 3-way handshake + HTTP
SYN, SYN-ACK, ACK opens the connection. Watch sequence and acknowledgment numbers grow by exactly the bytes sent, then FIN closes it gracefully.
Click an arrow in the ladder or a row in the list to see what that packet is doing.
| No. | Time | Source | Destination | Protocol | Length | Info |
|---|---|---|---|---|---|---|
| 1 | 0.000000 | 192.168.10.10 | 203.0.113.80 | TCP | 62 | 50122 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM |
What it is and why it exists
TCP gives applications a reliable, ordered byte stream over an unreliable network. Before any data, it opens a connection with the three-way handshake, agreeing on starting sequence numbers and options such as MSS. Every byte is numbered; the receiver's ACK says "I have everything up to here, send this byte next". Lost data is sent again, and the window tells the sender how much it may send before it has to wait.
HTTP here runs on top: a text request (GET / HTTP/1.1) and a text response (HTTP/1.1 200 OK) travel as TCP payload. On port 80 anyone on the path can read them, which is why sites use HTTPS.
Packet by packet
Key points
- Handshake: SYN, SYN-ACK, ACK. SYN and FIN each use one sequence number.
- ACK number = next byte expected = the other side's sequence + payload length.
- Flags: SYN open, ACK acknowledge, PSH deliver now, FIN graceful close, RST abort.
- MSS = largest segment the receiver accepts. On Ethernet 1460 = 1500 MTU − 20 IP − 20 TCP.
- Window = free receive buffer. With the window-scale option it can grow far beyond 64 KB.
- Closing takes a FIN from each side; often three packets because FIN and ACK share one.
Where it breaks
- SYN gets no answer: a firewall or ACL drops it, or the host is down. The client retries after about 1, 2 and 4 seconds, then "connection timed out".
- SYN answered with RST: nothing listens on that port (see "Closed port: TCP reset").
- Retransmissions and duplicate ACKs: packet loss on the path (see Troubleshooting).
- Zero window: the receiving application is not reading its buffer fast enough.
- Handshake works but big transfers hang: usually an MTU problem (see Troubleshooting).
See it on a real device
netstat -anss -tanshow tcp brieftelnet 203.0.113.80 80Interview questions
The client sends SYN with its ISN. The server replies SYN, ACK with its own ISN and Ack = client ISN + 1. The client sends ACK = server ISN + 1. Both now know each other's sequence numbers and options.