Wireshark Lab: TCP v7.

0
Hugo Gustavo Valin Oliveira da Cunha, PPGCO 11/04/2020

1 Objective

In this lab, we’ll investigate the behavior of the celebrated TCP protocol in detail. We’ll study
TCP’s use of sequence and acknowledgement numbers for providing reliable data transfer; we’ll
see TCP’s congestion control algorithm – slow start and congestion avoidance – in action; and
we’ll look at TCP’s receiver-advertised flow control mechanism. We’ll also briefly consider TCP
connection setup and we’ll investigate the performance (throughput and round-trip time) of the
TCP connection between your computer and the server.

2 A first look at the captured trace

1. What is the IP address and TCP port number used by the client computer (source) that is
transferring the file to gaia.cs.umass.edu? To answer this question, it’s probably easiest to
select an HTTP message and explore the details of the TCP packet used to carry this HTTP
message, using the “details of the selected packet header window” (refer to Figure 2 in
the “Getting Started with Wireshark” Lab if you’re uncertain about the Wireshark windows.
Answer: As shown in Figure 1, The IP address is 192.168.1.6 and the port number is
44287 used by my client computer for transfering the file to gaia.cs.umass.edu.

Figure 1: The IP address and TCP port number used by the client computer

2. What is the IP address of gaia.cs.umass.edu? On what port number is it sending and

receiving TCP segments for this connection? Answer: As shown in Figure 2, the IP
address used by gaia.cs.umass.edu is 192.168.1.6 and the port number is 80.

3. What is the IP address and TCP port number used by your client computer (source) to
transfer the file to gaia.cs.umass.edu? Answer: As shown in Figure 3, The IP address is
192.168.1.6 and the port number is 44287 used by my client computer for transfering the
file to gaia.cs.umass.edu.

Page 1
 Figure 2: The IP address and TCP port number used gaia.cs.umass.edu

Figure 3: The IP address and TCP port number used gaia.cs.umass.edu

3 TCP Basics

4. What is the sequence number of the TCP SYN segment that is used to initiate the TCP
connection between the client computer and gaia.cs.umass.edu? What is it in the segment
that identifies the segment as a SYN segment? Answer: As shown in Figure 4, The IP
address is 192.168.1.6 and the port number is 44287 used by my client computer for
transfering the file to gaia.cs.umass.edu.

5. What is the sequence number of the SYNACK segment sent by gaia.cs.umass.edu to the
client computer in reply to the SYN? What is the value of the Acknowledgement field in
the SYNACK segment? How did gaia.cs.umass.edu determine that value? What is it in
the segment that identifies the segment as a SYNACK segment? Answer: As shown in
Figure 5, the sequence number of the SYNACK segment sent by gaia.cs.umass.edu to
the client computer in reply to the SYN is 0. For this case, the initial sequence number of
SYN segment from the client computer is 0, thus the value of the ACKnowledgement field
in the SYNACK segment is 1. A segment will be identified as a SYNACK segment if both
SYN flag and Acknowledgement in the segment are set to 1.

6. What is the sequence number of the TCP segment containing the HTTP POST command?
Note that in order to find the POST command, you’ll need to dig into the packet content
field at the bottom of the Wireshark window, looking for a segment with a “POST” within
its DATA field. Answer: As shown in Figure 6, the sequence number of the TCP segment
containing the HTTP POST command is 151726.

7. Consider the TCP segment containing the HTTP POST as the first segment in the TCP

Page 2
 Figure 4: The IP address and TCP port number used gaia.cs.umass.edu

connection. What are the sequence numbers of the first six segments in the TCP connec-
tion (including the segment containing the HTTP POST)? At what time was each segment
sent? When was the ACK for each segment received? Given the difference between
when each TCP segment was sent, and when its acknowledgement was received, what is
the RTT value for each of the six segments? What is the EstimatedRTT value (see Sec-
tion 3.5.3, page 242 in text) after the receipt of each ACK? Assume that the value of the
EstimatedRTT is equal to the measured RTT for the first segment, and then is computed
using the EstimatedRTT equation on page 242 for all subsequent segments. Answer:
Figure 7 shows the time the segment was sent, as well as the sequence number of the
respective segment. Figure 8 shows the time in which the ACK was received from each
segment. The Table 1 summarizes all information.

Table 1: Information on each of the six segments.

Segment Sent time ACK received time RTT Estimate RTT
Segment 1 0.950464 1.246821 0,296357 0.296357
Segment 2 0.950555 1.271260 0.296357 0.296357
Segment 3 0.950556 1.295615 0.3450955 0.299400
Segment 4 0.950563 1.320973 0.37041 0.305108
Segment 5 0.950564 1.344517 0.393953 0.313271
Segment 6 0.950565 1.369550 0.418985 0.323356

8. What is the length of each of the first six TCP segments? Answer: As shown in Figure 9
the first segment is 733 bytes in size, the other packets are 1400 bytes in size.

9. What is the minimum amount of available buffer space advertised at the received for the
entire trace? Does the lack of receiver buffer space ever throttle the sender? Answer:
As shown in Figure 10 the minimum amount of available buffer space advertised at the
received for the entire trace is 787.

Page 3
 Figure 5: The sequence number of the SYNACK segment sent by gaia.cs.umass.edu

Figure 6: The sequence number of the TCP segment containing the HTTP POST command

10. Are there any retransmitted segments in the trace file? What did you check for (in the trace)
in order to answer this question? Answer: As shown in Figure 11 there isn’t retransmitted
segments in the trace file. This can be explained by packets with same sequence number
at different time is not found.

11. How much data does the receiver typically acknowledge in an ACK? Can you identify
cases where the receiver is ACKing every other received segment (see Table 3.2 on page
250 in the text). Answer: As shown in Figure 11 the difference between the acknowledged
sequence numbers of two consecutive ACKs indicates the data received by the server
between these two ACKs. That is, the size is 1400 bytes.

12. What is the throughput (bytes transferred per unit time) for the TCP connection? Explain
how you calculated this value. Answer: The alice.txt is 152,138 bytes, and the time of
first segment and second segment is respectively, is 0.950464 and 1.344563. Therefore,

Page 4
Figure 7: The sequence number of the TCP segment containing the HTTP POST command

Figure 8: The sequence number of the TCP segment containing the HTTP POST command

the throughput for the TCP connection is computed as 152,138/(1.344563 - 0.950464) =

386,04 bytes/second.

4 TCP congestion control in action

13. Use the Time-Sequence-Graph(Stevens) plotting tool to view the sequence number ver-
sus time plot of segments being sent from the client to the gaia.cs.umass.edu server.
Can you identify where TCP’s slowstart phase begins and ends, and where congestion
avoidance takes over? Comment on ways in which the measured data differs from the
idealized behavior of TCP that we’ve studied in the text. Answer: I can’t identify where
TCP’s slowstart phase begins and ends, and where congestion avoidance takes over.

14. Answer each of two questions above for the trace that you have gathered when you trans-
ferred a file from your computer to gaia.cs.umass.edu. Answer: The questions had been
answered.

Page 5
Figure 9: The length of each of the first six TCP segments

Figure 10: The length of each of the first six TCP segments

Figure 11: The length of each of the first six TCP segments

Figure 12: The length of each of the first six TCP segments

Page 6