Original subtitles

So let’s look at a more complete example. 2

In this example, host A initiates a session with the source port of 1024 3

in a destination port of 23, in other words telnet. 4

Host A sends 10 bytes of data and an initial sequence number of 10. 5

Host B acknowledges receipt of the 10 bytes 6

by sending an acknowledgement number back to A of 11. 7

Host B in this example, also sets its initial sequence number to 5. 8

please note also that the port numbers are reversed 8

the source port for traffic going from B to A is 23 and the destination port is 1024. 9

In this example because we’re using a sliding window 10

A may send 250 bytes of data for example. 11

So notice the sequence number is incremented to 260. 12

In previous examples, we’ve use easy numbers 13

the window size of 1 or window size of 3 but please note in reality 14

window sizes are set to the amount of data that can be transmitted in bytes. 15

So this may not be as easy to read as sequences of 1, 2, and 3. 16

receipt of data up to sequence 5 and thus acknowledging sequence number 6. 17

The source ports are swap round again 18

so the source port is 1024 and the destination port is 23. 19

Now host B is acknowledging for sequence number 261 20

remember A send 10 bytes and the 250 bytes 21

so in other words 260 bytes of data. 22

B is sending sequence number 6 and once again the port numbers are reversed. 23

It’s a very important that you understand, how source and destination ports work 24

So on that note there is nothing better than showing you real world example using Wireshark. 25

So I’m going to capture traffic on my network 26

and then I’m going to go to for instance google.com with my web browser. 27

I’ll go back to Wireshark and stop the capture, here's an example is the DNS query. 28

So we’ve got host 10.0.0.1 which is my machine 29

a Dell laptop, querying the DNS server. 30

At layer 2, you can see the source is my Dell machine going to my Cisco router. 31

This is an Ethernet 2 frame and please note the type field. 32

At layer 2 as mentioned, the type field specifies the protocol at layer 3. 33

In this case 0x0800 in hexadecimal specifies that the layer 3 protocol is IPv4. 34

At layer 3 you can see the source IP address and the destination IP address. 35

My PC and the DNS server, you can see that this is IPv4 36

you can see the header length is 20 bytes. 37

DSCP or Differentiated Services Code Points is not used in this example 38

notice ECN which is to do with explicit congestion notification 39

I mentioned that briefly when talking about the TCP header. 42

What I’d like you to see here is notice the protocol at layer 4 is UDP 40

that values in hexadecimal, so 11 in hexadecimal is equal to 17 41

the protocol number once again for UDP is 17. 42

So at layer 4, we can see that User Datagram Protocol or UDP is being used. 43

The source port is 62249, in other words, a dynamic or ephemeral port 44

going to a destination port of 53 in other words DNS. 45

We can see the port numbers once again, and opening up the DNS query 46

we can see that it was a query, looking for specific host address. 47

Here we have a DNS response from the DNS server to my host. 48

So once again, very quickly at layer 2 49

you can see the type field denotes the protocol at layer 3. 50

At layer 3, the protocol field, tells us which protocol is used at layer 4 51

Here’s another DNS query from my host to the DNS server. 52

And if we open up the DNS query information 53

you can see that it’s a query for google.com 54

and it's a host query, notice type A, the DNS server replies 55

and notice in the answer, it give us the IP address of google.com 56

Now here’s the three-way handshake between my machine and Google. 57

Notice the source is 10.0.0.1 58

and the destination is this IP address which is Google. 59

Notice the source port is 58313 destinations is 80 64

in other words I’m opening up a web connection to a web server. 60

Opening that up, you can see once again the source and destination port numbers 61

but notice here the flag that are set is SYN. 62

So opening that up you can see that 63

all the other flags or bit set to 0 except for the SYN bit 64

and opening that up you can see, we are trying to set up a connection to the server 65

so we’ve got a connection establish request message to the server. 66

No other flags are set. Notice the initial window size is 8192 67

and opening up the options, you can see that the MSS or Maximum Segment Size is set to 1460 bytes. 68

The reply from Google to my machine at layer 4 shows that the source port is 80 69

and the destination port is 58313. 70

Opening that up, notice the flags that are set are SYN ACK 71

so it’s a second part of the three-way handshake. 72

Notice the acknowledgement bit is set and the synchronization bit is set 73

opening that up, you can see that it's a connection establish acknowledgment from Google. 74

Notice the window size request is 5720 and if we open up the options 75

notice here the maximum segment size is 1430. 76

Looking at the last part of three-way handshake 77

notice my machine talking to Google 78

opening up TCP, you can see that the flags that are set is just the acknowledgement bit 79

and the window size requested 64350 85

and looking at the sequence acknowledgment analysis 80

notice that this is an acknowledgement. 81

Going back to the first step of the three-way hand shake 82

notice that the initial sequence number from my machine to Google is set to 0. 83

Going to the actual TCP header, notice the sequence number 0. 84

Googles reply as a sequence number 0 and the acknowledgement of 1. 85

As you can see here as well. 86

So they are letting us know, the next segment that they expect to receive is segment 1. 87

Our acknowledgement to them, is we are sending sequence number 1 88

and we are acknowledging the sequence number 1. 89

This is as per what we discussed. 90

Later on, when HTTP is being received 91

notice, we are receiving information from Google to our machine its TCP 92

and notice here, this is a TCP segment of the re-assembled Protocol Data Unit. 93

In other words this is a fragment. 94

Looking at TCP, we can see the sources HTTP and the destination is our port number. 95

In other words Google is sending traffic to us 96

notice here that the sequence number is 2861 97

the next sequence number is 3798 98

and the acknowledgement number is 944. 99

so the next sequence number remember is 3798 100

going to the very next part of the capture 101

notice the sequence number here is 3798 and the next sequence number is 5228. 102

And notice there’s an acknowledgement from our machine to Google 103

saying that we expect to receive 5228. 104

And then the very next capture you can see 105

that sequence number 5228, were sent from Google to us. 106

The next sequence number is 6658, which is the next piece received. 107

Notice 6658 is the sequence number received. 114

Our host is acknowledging receipt of that 108

and saying that the next bit of data to receive is 7894 109

going to the next capture, you can see that the sequence number is what Google sent to us. 110

Now without boring you any longer 111

I’m hoping that this capture gives you a little bit of insight 112

into what's actually happening on the wire. 113

wirehark remembers a free application that you can download 114

just search for it on the internet 115

now I suggest that you captures some traffic on your machine 116

so that you can actually see what's going on in the back ground. 117

So what have we covered? 118

In this section we look at the 2 main protocols residing at layer 4. 119

UDP or User Datagram Protocol and TCP or Transmission Control Protocol. 120

I explained port numbers and which port numbers would be used in which scenarios. 121

I explained the TCP three-way handshake 122

I explained windowing and I explained sequence numbers. 123

Thank you for watching!