TCPIP Trace readings, Can anyone help me understand.

[Robert DJ]

Hi All,

Ive got a query on how to understand the TCPIP Trace for Ports.

sport: 46584 --> dport: 4747 flags: SYN

sport: 4747 --> dport: 46584 flags: SYN ACK

sport: 46584 --> dport: 4747 flags: ACK

sport: 46584 --> dport: 4747 flags: PUSH ACK

sport: 4747 --> dport: 46584 flags: ACK

sport: 46584 --> dport: 4747 flags: PUSH ACK



seq: 0x41df2f1e urp: 0x0 chksum: 0xcbe1 data len: 15

ack: 0xb5abce91 win: 0x16d0 optlen: 12

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ TCP Options ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

0: 01 01 08 0a 0b 36 09 16 07 42 95 07 -- -- -- -- .....6...B......

-------------------------------- User Data -----------------------------------

0: 01 03 01 09 00 04 10 c7 e0 5d a3 62 00 00 7e -- .........].b..~.



sport: 4747 --> dport: 46584 flags: FIN ACK

sport: 46584 --> dport: 4747 flags: FIN ACK

sport: 4747 --> dport: 46584 flags: ACK


Can someone help me understand this please.

Thank you for your help.

Regards,
Robs

[Peter Godron · Accepted solution]

Robs,
what part?
The first part is the handshaking to set up connection, then follows the data transfer and finally the connection termination.

For a background read : http://en.wikipedia.org/wiki/Transmission_Control_Protocol

[Paul Thomson_2]

Rob

This attachement may also be of use, but as Peter mentioned its the connection setup / data transfer and finally the connection end.

Thanks
Paul

[Sung Oh]

Hi Robs,

Here is basic understanding of TCP/IP transmission trace.

http://support.microsoft.com/?kbid=169292

Regards,

Sung