Search code examples
tcpnumberssequenceseq

How is TCP sequence number stored?


As we can see in the image the seq number of the TCP layer of a packet captured by wireshark is 45943 in decimal, and it's represented by the hex digits 61a08950. Obviously the direct translation of that hex number to decimal is not equivalen to 45943, so how is this number stored?, it is encoded or something like that?

TCP Sequence number


Solution

    1. They stored in big endian format.
    2. Wireshark shows relative sequence numbers, not the absolute numbers.

    Here is how to configure Wireshark to show the absolute numbers:

    https://wiki.wireshark.org/TCP_Relative_Sequence_Numbers