TCP – How to Refer Packets That Belong to Specific TCP Session

cisconetwork-coretcpwireshark

How can I know which packet belongs to a specific TCP session? In my experiment, a client establishes a TCP session with the web server every 5 seconds using wget command (I also noticed it uses different port number each time). When I trace the packets in Wireshark, I use port number of the client side to filter the packets that belong to each session. Is that practical? I thought I can use sequence numbers but this will be tedious !!!

Best Answer

TCP creates connections between the TCP peers. Each TCP peer creates a socket, which is identified by the TCP address (port) and IP address. The pair of sockets (one in each TCP peer) uniquely identifies the connection. To identify which TCP segments belong to which TCP connection, you need to identify the source and destination IP addresses and source and destination TCP addresses (ports).

RFC 793, TRANSMISSION CONTROL PROTOCOL explains this:

Multiplexing:

To allow for many processes within a single Host to use TCP communication facilities simultaneously, the TCP provides a set of addresses or ports within each host. Concatenated with the network and host addresses from the internet communication layer, this forms a socket. A pair of sockets uniquely identifies each connection. That is, a socket may be simultaneously used in multiple connections.

The binding of ports to processes is handled independently by each Host. However, it proves useful to attach frequently used processes (e.g., a "logger" or timesharing service) to fixed sockets which are made known to the public. These services can then be accessed through the known addresses. Establishing and learning the port addresses of other processes may involve more dynamic mechanisms.

Connections:

The reliability and flow control mechanisms described above require that TCPs initialize and maintain certain status information for each data stream. The combination of this information, including sockets, sequence numbers, and window sizes, is called a connection. Each connection is uniquely specified by a pair of sockets identifying its two sides.

When two processes wish to communicate, their TCP's must first establish a connection (initialize the status information on each side). When their communication is complete, the connection is terminated or closed to free the resources for other uses.

Since connections must be established between unreliable hosts and over the unreliable internet communication system, a handshake mechanism with clock-based sequence numbers is used to avoid erroneous initialization of connections.

Your question says that you are only using one criterion of the four criteria that identify a unique TCP connection.

As you discovered, each time an HTTP client requests a connection to an HTTP server, it will use a different, random TCP address, know as an ephemeral port. There is a port range in your OS (varies by OS) for these ephemeral ports. The IANA recommendation for ephemeral ports is to use ports 49152 to 65535, but different OSes use different ranges.

FYI:

The TCP datagrams are usually referred to a segments because TCP segments the data stream. Packet is used to refer to a layer-3 datagram, e.g. an IP packet, but TCP is a layer-4 protocol.

Related Topic