Search code examples
tcpwiresharkpacketpacket-capture

What are different between these?(TCP packet)


enter image description here

These have a two different. if you need more information Plz leave an answer. Thanks.


Solution

  • I assume you're referring to the two highlighted TCP flags in the bottom pane. The one on the left is a SYN packet used to start a TCP session and the one on the right is a FIN/ACK packet used in closing a TCP session.

    TCP starts with what's known as the "Three-way handshake" or "TCP handshake". This includes (but has a lot more):

    SYN: First packet with an Initial Sequence Number (ISN). SYN is from a random (ephemeral) high port (1024~65535 [TCP/49805 in this case]) to a specific destination (in this case TCP/8080)

    SYN/ACK: A second SYN from 8080 (from the server [TCP/8080]) and to the client (TCP/49805) as well as an ACK (acknowledgement) flag for the first SYN packet which corresponds with the ISN+1.

    ACK: The acknowledgement from the client to the server ACK'ing the SYN in packet 2 with a sequence and acknowledgement value of 1 each.

    At this point, there will be a bunch of PSH/ACK packets while data goes between the source and destination.

    The packet on the right, as we mentioned, shows a FIN/ACK. This is used to gracefully close a TCP session which has already been established by two devices. Additionally, although you didn't ask about it, an RST (reset) packet will un-gracefully close a TCP session.