CloudLabBox
Try the free demo

Packet analysis lab 6 of 12

TCP mechanics: handshake options and sequence numbers

Take one TCP connection apart from SYN to FIN across a link with a known delay. You read the handshake's options, work out the MSS and the real segment size, measure the initial round-trip time, follow sequence and acknowledgement numbers through a 100 kB download, read the stream graph, and compare an orderly FIN close with a reset.

Run this lab

It needs Lite: its 3 nodes are set to 3 vCPU and 2,048 MB in total. That fits the free demo too.

In your workspace: Shared, then Packet analysis with Wireshark and tcpdump guided labs, then 06 - TCP mechanics - handshake options and sequence numbers

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 70 minutes
Nodes need
3 vCPU, 2,048 MB
Smallest plan
Lite

The scenario

Fellside Outdoor's warehouse report server SRV sits at the end of a leased line with about 20 ms of delay each way, played here by a WAN emulator. Its network card was set to a 1400-byte MTU by a previous administrator, for a VPN that no longer exists. Before you look at TCP problems in the next labs, you'll take one healthy connection apart, field by field, so you know exactly what normal looks like.

DeviceInterfaceAddressNotes
WSeth010.70.0.10/24your workstation and the client
WANeth0 ↔ eth1bridge, no addressadds 20 ms in each direction
SRVeth010.70.0.20/24, MTU 1400web server with a 100,000-byte report

Your workstation, WS. Open WS's console (a remote desktop, root / eve), start Wireshark from Applications > Internet > Wireshark, and open a terminal (Applications > System Tools > MATE Terminal). Write answers in /root/answers.txt (pluma /root/answers.txt &).

What you’ll practise

  • Describe the three-way handshake, the TCP flags and the two ways a connection ends
  • Read the TCP options: MSS, window scaling, SACK permitted, timestamps, NOP and EOL
  • Calculate the MSS from the MTU and explain why data segments can be smaller still
  • Explain how Wireshark measures the initial RTT and read it
  • Use relative sequence and acknowledgement numbers to count the bytes a host sent
  • Read a TCP stream graph and explain TCP reassembly, stream index and conversation timestamps

The tasks

  1. Prepare the line and the server
  2. Capture one download
  3. The handshake and its options
  4. The initial round-trip time
  5. Data, sequence numbers and the stream graph
  6. Closing: FIN and reset

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of TCP mechanics - handshake options and sequence numbers3 nodes, 2 links. Every link is listed as text below the diagram.WSWANSRVeth0eth0eth1eth0
3 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • WS eth0 to WAN eth0
  • WAN eth1 to SRV eth0
Nodes in TCP mechanics: handshake options and sequence numbers, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
WSEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
WANAlpine WAN emulatorclbalpinewanem-alpine-wanem-3-20-31 vCPU, 512 MB
SRVAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Packet analysis with Wireshark and tcpdump guided labs.

  3. Open 06 - TCP mechanics - handshake options and sequence numbers and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Packet analysis labs

All Packet analysis labs

Related labs in other courses

CloudLabBox is independent of the Wireshark Foundation, CompTIA and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.