Name: Farzan Mahmood Chowdhury

Student ID: 999900559

Instructor: Dr. Mohamed Shaban
Course: MCIS6163_001182S: Computer Networking
Title: Lab 4 Wireshark TCP_v7.0

1. What is the IP address and TCP port number used by the client computer (source) that is
transferring the file to gaia.cs.umass.edu? To answer this question, it’s probably easiest to
select an HTTP message and explore the details of the TCP packet used to carry this HTTP
message, using the “details of the selected packet header window” (refer to Figure 2 in the
“Getting Started with Wireshark” Lab if you’re uncertain about the Wireshark windows.

Answer: The IP address is 10.11.5.158 and the TCP port number is 63346

Figure 1: IP address and TCP port number used by the client computer

1|Page
2. What is the IP address of gaia.cs.umass.edu? On what port number is it sending and
receiving TCP segments for this connection?

Answer: The IP address of gaia.cs.umass.edu is 128.119.245.12 and the TCP port number is 80

Figure 2: IP address and TCP port number of gaia.cs.umass.edu

3. What is the IP address and TCP port number used by your client computer (source) to
transfer the file to gaia.cs.umass.edu?

Answer: The IP address is 10.11.5.158 and the TCP port number is 63346 (from Figure 1)

4. What is the sequence number of the TCP SYN segment that is used to initiate the TCP
connection between the client computer and gaia.cs.umass.edu? What is it in the segment
that identifies the segment as a SYN segment?

Answer: The sequence number of the TCP SYN segment is 0 that is used to initiate the TCP
connection between the client computer and gaia.cs.umass.edu.
In the Flags section, the SYN flag is set to 1 which indicates that this segment is a SYN segment.

2|Page
 Figure 3: SYN seq num + flag

5. What is the sequence number of the SYNACK segment sent by gaia.cs.umass.edu to the
client computer in reply to the SYN? What is the value of the Acknowledgement field in the
SYNACK segment? How did gaia.cs.umass.edu determine that value? What is it in the
segment that identifies the segment as a SYNACK segment?

Answer: The sequence number of the SYNACK segment from gaia.cs.umass.edu to the client
computer in reply to the SYN has the value of 0 in this trace. The value of the Acknowledgement
field in the SYNACK segment is 1. The value of the Acknowledgement field in the SYNACK
segment is determined by gaia.cs.umass.edu by adding 1 to the initial sequence number of SYN
segment from the client computer (i.e. the sequence number of the SYN segment initiated by
the client computer is 0).
The SYN flag and Acknowledgement flag in the segment are set to 1 and they indicate that this
segment is a SYNACK segment.

3|Page
 Figure 4: SYNACK segment sent by gaia.cs.umass.edu

6. What is the sequence number of the TCP segment containing the HTTP POST command?
Note that in order to find the POST command, you’ll need to dig into the packet content
field at the bottom of the Wireshark window, looking for a segment with a “POST” within
its DATA field.

Answer: The sequence number of the TCP segment containing the HTTP post command is 1

Figure 5: TCP segment containing the HTTP POST command

4|Page
 7. Consider the TCP segment containing the HTTP POST as the first segment in the TCP
connection. What are the sequence numbers of the first six segments in the TCP connection
(including the segment containing the HTTP POST)? At what time was each segment sent?
When was the ACK for each segment received? Given the difference between when each
TCP segment was sent, and when its acknowledgement was received, what is the RTT value
for each of the six segments? What is the EstimatedRTT value (see Section 3.5.3, page 242
in text) after the receipt of each ACK? Assume that the value of the EstimatedRTT is equal
to the measured RTT for the first segment, and then is computed using the EstimatedRTT
equation on page 242 for all subsequent segments.
Note: Wireshark has a nice feature that allows you to plot the RTT for each of the
TCP segments sent. Select a TCP segment in the “listing of captured packets”
window that is being sent from the client to the gaia.cs.umass.edu server. Then
select: Statistics->TCP Stream Graph->Round Trip Time Graph.

Answer: The HTTP POST segment is considered as the first segment. Segment 1 – 6 are no.
571, 572, 573, 574, 575 and 576 in this trace respectively. The ACKs of segments 1 – 6 are
no. 581, 583, 590, 595, 602 and 605 in this trace.

Segment 1 sequence number: 1

Segment 2: sequence number: 694
Segment 3: sequence number: 2154
Segment 4: sequence number: 3614
Segment 5: sequence number: 5074
Segment 6: sequence number: 6534

The sending time and the received time of ACKs are tabulated in the following table.

Sent time ACK received time RTT (seconds)

Segment 1 0.000400 0.051708 0.051308
Segment 2 0.000598 0.000873 0.000275
Segment 3 0.000018 0.000190 0.000172
Segment 4 0.000015 0.001974 0.001959
Segment 5 0.000010 0.000781 0.000771
Segment 6 0.000009 0.048423 0.048414

EstimatedRTT = 0.875 * EstimatedRTT + 0.125 * SampleRTT

EstimatedRTT after the receipt of the ACK of segment 1:

EstimatedRTT = RTT for Segment 1 = 0.051308 second

EstimatedRTT after the receipt of the ACK of segment 2:

EstimatedRTT = 0.875 * 0.051308 + 0.125 * 0.000275 = 0.044928875

EstimatedRTT after the receipt of the ACK of segment 3:

EstimatedRTT = 0.875 * 0.044928875 + 0.125 * 0.000172 = 0.039334266

EstimatedRTT after the receipt of the ACK of segment 4:

EstimatedRTT = 0.875 * 0.039334266 + 0.125 * 0.001959 = 0.034513857

EstimatedRTT after the receipt of the ACK of segment 5:

EstimatedRTT = 0.875 * 0.034513857 + 0.125 * 0.000771 = 0.030296

5|Page
EstimatedRTT after the receipt of the ACK of segment 6:
EstimatedRTT = 0.875 * 0.030296 + 0.125 * 0.048414 = 0.03256075

Figure 6: Segments 1 – 6

Figure 7: ACKs of Segment 1 – 6

6|Page
 Figure 8: Round Trip Time Graph

8. What is the length of each of the first six TCP segments?

Answer: The length of the first TCP segment (containing the HTTP POST): 693 bytes and the
length of each of the other five TCP segments: 1460 bytes

Figure 9: Length of the first TCP segment

7|Page
 Figure 10: Length of each of the five TCP segment

9. What is the minimum amount of available buffer space advertised at the received for the
entire trace? Does the lack of receiver buffer space ever throttle the sender?

Answer: The minimum amount of buffer space advertised at gaia.cs.umass.edu for the entire
trace is 30592 bytes. This receiver window grows steadily until a maximum receiver buffer size of
59904 bytes. The sender is never throttled due to lacking of receiver buffer space by inspecting
the trace.

Figure 11: Minimum receive window advertised at gaia.cs.umass.edu

8|Page
10. Are there any retransmitted segments in the trace file? What did you check for (in the
trace) in order to answer this question?

Answer: There are no retransmitted segments in the trace file. We can verify this by checking
the sequence numbers of the TCP segments in the trace file. In the Time-Sequence Graph
(Stevens) of this trace, all sequence numbers from the (10.11.5.158) to the destination
(128.119.245.12) are increasing monotonically with respect to time. If there is a retransmitted
segment, the sequence number of this retransmitted segment should be smaller than those of
its neighbouring segments.

Figure 12: Sequence numbers of the segments from the source (10.11.5.158) to the destination
(128.119.245.12)

11. How much data does the receiver typically acknowledge in an ACK? Can you identify cases
where the receiver is ACKing every other received segment (see Table 3.2 on page 250 in
the text).

Answer: The acknowledged sequence numbers of the ACKs are listed as follows:

Acknowledged sequence number Acknowledged data

ACK 1 694 694
ACK 2 2154 1460
ACK 3 3614 1460
ACK 4 5074 1460
ACK 5 6534 1460
ACK 6 7994 1460
ACK 7 9454 1460
ACK 8 10914 1460

9|Page
 ACK 9 12374 1460
ACK 10 13834 1460
ACK 11 15294 1460
ACK 12 18214 2920

The difference between the acknowledged sequence number of two consecutive ACKs indicates
the data received by the server between these two ACKs. By inspecting the amount of
acknowledged data by each ACK, there are cases where the receiver is ACKing every other
segment. For example, segment no. 586 acknowledged data with 2920 bytes = 1460 * 2 bytes.

Figure 13: ACK (No. 586) where the receiver is ACKing every other received segment

12. What is the throughput (bytes transferred per unit time) for the TCP connection? Explain
how you calculated this value.

Answer: The throughput for this TCP connection is computed as the ratio between the total
amount of data and the total transmission time. The total amount of data transmitted can be
computed by the difference between the sequence number of the first TCP segment (i.e. 1 byte
for segment no. 571) and the acknowledged sequence number of the last ACK (153013 bytes for
segment no. 727). Therefore, the total data are 153013 – 1 = 153012 bytes. The whole
transmission time is the difference of the time instant of the first TCP segment (i.e. 0.000400
second for segment no, 571) and the time instant of the last ACK (i.e. 19.223809 seconds).
Therefore, the total transmission time is 19.223809 - 0.000400 = 19.223409 second. Hence, the
throughput for the TCP connection is computed as 153012 / 19.223409 = 7959.67 bps.

10 | P a g e
 13. Use the Time-Sequence-Graph(Stevens) plotting tool to view the sequence number versus
time plot of segments being sent from the client to the gaia.cs.umass.edu server. Can you
identify where TCP’s slowstart phase begins and ends, and where congestion avoidance
takes over? Comment on ways in which the measured data differs from the idealized
behavior of TCP that we’ve studied in the text.

Answer: The TCP slowstart phase begins at just above sequence number 12000 and ends just before
sequence number 42000. Congestion avoidance takes over at 40000.

14. Answer each of two questions above for the trace that you have gathered when you
transferred a file from your computer to gaia.cs.umass.edu

Answer: Same as the answer of question 13.

11 | P a g e