Web request from 192.168.23.107 to web server at 173.254.28.104 for 'hello.txt' file. ************* client sends SYN. First step of 3-way handshake to establish TCP connection **** Frame 1: 62 bytes Ethernet: Src: e8:39:df:68:b7:f3 Dst: 20:4e:7f:6e:b9:74 Internet Protocol: Src: 192.168.23.107 Dst: 173.254.28.104 Transmission Control Protocol: Source port: 62005 Destination port: http (80) Sequence number: 0 (relative sequence number) {relative: not the actual random #} Header length: 28 bytes * Flags: 0x02 (SYN) Window size: 8192 Checksum: 0xdb72 [validation disabled] Options: (8 bytes) ************* server replies with SYN ACK. 2nd step ******************************* Frame 2: 62 bytes Ethernet: Src: 20:4e:7f:6e:b9:74 Dst: e8:39:df:68:b7:f3) Internet Protocol, Src: 173.254.28.104 , Dst: 192.168.23.107 Transmission Control Protocol Source port: http (80) Destination port: 62005 Sequence number: 0 (relative sequence number) Acknowledgement number: 1 (relative ack number) {server has received 1B from client} Header length: 28 bytes * Flags: 0x12 (SYN, ACK) Window size: 5840 Checksum: 0x356c [validation disabled] Options: (8 bytes) ************* client sends ACK. 3rd step **** Frame 3: 54 bytes Ethernet: Src: e8:39:df:68:b7:f3), Dst: 20:4e:7f:6e:b9:74 Internet Protocol, Src: 192.168.23.107 , Dst: 173.254.28.104 Transmission Control Protocol: Source port: 62005 Destination port: http (80) Sequence number: 1 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 20 bytes * Flags: 0x10 (ACK) Window size: 64240 Checksum: 0x7e0f [validation disabled] ************* TCP connection is now established, client sends HTTP GET of 647B in size ********* Frame 4: 701 bytes Ethernet: Src: e8:39:df:68:b7:f3, Dst: 20:4e:7f:6e:b9:74 Internet Protocol, Src: 192.168.23.107 , Dst: 173.254.28.104 Transmission Control Protocol: Source port: 62005 Destination port: http (80) Sequence number: 1 (relative sequence number) [Next sequence number: 648 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 20 bytes Flags: 0x18 (PSH, ACK) Window size: 64240 Checksum: 0x3b0a [validation disabled] Hypertext Transfer Protocol {in Data field of TCP segment. 647B } * GET /cmit265/hello.txt HTTP/1.1\r\n Host: davidwills.net\r\n {HTTP headers sent by client} User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.11) Gecko/20101012 Firefox/3.6.11\r\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n Accept-Language: en-us,en;q=0.5\r\n Accept-Encoding: gzip,deflate\r\n Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n Keep-Alive: 115\r\n Connection: keep-alive\r\n Referer: http://davidwills.net/cmit265/\r\n Cookie: cprelogin=no; cpsession=%3a7eKAas6cylmxfnQyABcBQxUaaaBP1WSMXZJ9nU0KRlSsCDtEECJZNNqHg48YH7WV\r\n If-Modified-Since: Wed, 19 Sep 2012 13:35:03 GMT\r\n If-None-Match: "18800d2-5-4ca0e13004af3"\r\n Cache-Control: max-age=0\r\n \r\n {blank line} **************** server ACKs that it recieved previous TCP Data field(s) of 647B **************** Frame 5: 54 bytes Ethernet: Src: 20:4e:7f:6e:b9:74 , Dst: e8:39:df:68:b7:f3 Internet Protocol, Src: 173.254.28.104 , Dst: 192.168.23.107 Transmission Control Protocol: Source port: http (80) Destination port: 62005 Sequence number: 1 (relative sequence number) * Acknowledgement number: 648 (relative ack number) {"naked" ACK, i.e. no data sent in this segment} Header length: 20 bytes * Flags: 0x10 (ACK) Window size: 7117 Checksum: 0x5aac [validation disabled] ******** server sends HTTP Reply with contents of requested web page (i.e. hello.txt) ******** Frame 6: 356 bytes Ethernet: Src: 20:4e:7f:6e:b9:74 , Dst: e8:39:df:68:b7:f3 Internet Protocol, Src: 173.254.28.104 , Dst: 192.168.23.107 Transmission Control Protocol: Source port: http (80) Destination port: 62005 Sequence number: 1 (relative sequence number) [Next sequence number: 303 (relative sequence number)] Acknowledgement number: 648 (relative ack number) Header length: 20 bytes Flags: 0x18 (PSH, ACK) Window size: 7117 Checksum: 0x493f [validation disabled] Hypertext Transfer Protocol {in Data field of TCP segment. 302B } HTTP/1.1 200 OK\r\n {HTTP headers sent by server} Date: Wed, 19 Sep 2012 13:41:18 GMT\r\n Server: Apache\r\n Last-Modified: Wed, 19 Sep 2012 13:41:03 GMT\r\n ETag: "18800d3-5-4ca0e28752ea4"\r\n Accept-Ranges: bytes\r\n Content-Length: 5\r\n Vary: Accept-Encoding\r\n Keep-Alive: timeout=10, max=30\r\n Connection: Keep-Alive\r\n Content-Type: text/plain\r\n \r\n {blank line} Line-based text data: text/plain {contents of the "web page"} hello ******** client send ACK that it received previous TCP Data field(s) of 302B **************** Frame 7: 54 bytes Ethernet: Src: e8:39:df:68:b7:f3), Dst: 20:4e:7f:6e:b9:74 Internet Protocol, Src: 192.168.23.107 , Dst: 173.254.28.104 Transmission Control Protocol: Source port: 62005 Destination port: http (80) Sequence number: 648 (relative sequence number) {how much it's sent so far} * Acknowledgement number: 303 (relative ack number) {how much it's received so far} {naked ACK} Header length: 20 bytes * Flags: 0x10 (ACK) Window size: 63938 Checksum: 0x7b88 [validation disabled] ******************* Later...server tearing down its connection. FIN ACK ************** Frame 8: 54 bytes Ethernet: Src: 20:4e:7f:6e:b9:74 , Dst: e8:39:df:68:b7:f3 Internet Protocol, Src: 173.254.28.104 , Dst: 192.168.23.107 Transmission Control Protocol: Source port: http (80) Destination port: 62005 Sequence number: 303 (relative sequence number) Acknowledgement number: 648 (relative ack number) Header length: 20 bytes * Flags: 0x11 (FIN, ACK) Window size: 7117 Checksum: 0x597d [validation disabled] ******************* client ACKing the teardown **************************** Frame 9: 54 bytes Ethernet: Src: e8:39:df:68:b7:f3, Dst: 20:4e:7f:6e:b9:74 Internet Protocol, Src: 192.168.23.107 , Dst: 173.254.28.104 Transmission Control Protocol: Source port: 62005 Destination port: http (80) Sequence number: 648 (relative sequence number) Acknowledgement number: 304 (relative ack number) Header length: 20 bytes * Flags: 0x10 (ACK) Window size: 63938 Checksum: 0x7b87 [validation disabled] ******************* Later...client tearing down its side of connection. FIN ACK ************** Frame 10: 54 bytes Ethernet II, Src: e8:39:df:68:b7:f3), Dst: 20:4e:7f:6e:b9:74 Internet Protocol, Src: 192.168.23.107, Dst: 173.254.28.104 Transmission Control Protocol: Source port: 62005 Destination port: http (80) Sequence number: 648 (relative sequence number) Acknowledgement number: 304 (relative ack number) Header length: 20 bytes * Flags: 0x11 (FIN, ACK) Window size: 63938 Checksum: 0x7b86 [validation disabled] ******************* server ACKing the teardown **************************** Frame 11: 54 bytes Ethernet II, Src: 20:4e:7f:6e:b9:74 , Dst: e8:39:df:68:b7:f3 Internet Protocol, Src: 173.254.28.104 , Dst: 192.168.23.107 Transmission Control Protocol: Source port: http (80) Destination port: 62005 Sequence number: 304 (relative sequence number) Acknowledgement number: 649 (relative ack number) Header length: 20 bytes * Flags: 0x10 (ACK) Window size: 7117 Checksum: 0x597c [validation disabled]