The Client acknowledge (ACK) the SYN packet (from the Server).The Server acknowledge (ACK) the SYN packet (from the Client) and send its own SYN packet with its Initial Sequence Number.

The Client sends a SYN packet with its Initial Sequence Number to the Server.

Here a short recap of how the handshake looks like: The 3-Way-Handshake is the most important step in TCP to establish a communication between client and server. Get first Information from the 3-Way-Handshake

Bytes in Flight => Data which has been sent but not yet acknowledgedĪdding those columns helped me to save time in analyzing!Ģ.

Delta Time => It shows the delta time to the previous captured packet.

Over the time I understood that having more columns available from the beginning it will save time and helps also in troubleshooting.Īs you can see in the screenshot, I’ve added several columns. Tip: you can always use filter in Wireshark to just display the packets you want to see.Wireshark opens your file with the “Default” profile which has the basic columns Packet Number, Time, Source, Destination, Protocol, Length, Info. You should use your own screenshot.ĭo you see any parallel connections your browser makes? If so, how many can you see in your screenshot? Again, use Wireshark to capture the traffic while you open up the page.Įxample screenshot below. Now, we will open a webpage with embeded objects (e.g., cnn.com which has a lot of images/videos embeded) in a browser. Example screenshot below.ĭescribe the TCP packets that you see, i.e., how each packet corresponds to TCP handshake, data transfer and closing connection steps. After the curl/wget is done, stop the capture in Wireshark. Warning: keep your other network activities to the minimum for a better experience, e.g., avoid streaming Netflix when capturing in Wireshark. Then you should be able to see packets flowing! Click the red square button on top to stop the capture.

On the left side, select one (or more) interfaces that you want to capture from, then click “Start”. If you run into any problems, you can refer to for more detailed help. On Mac and Linux, you can also install from command line (homebrew/macports, yum install, apt-get install). You can find installation instructions here: We will use Wireshark, a network packet capture tool, to look at TCP packets when grabbing a webpage.

Wireshark packet capture to and from