TCP Sequence/Acknowledgement numbers

[white-zombie]

Hello everyone,

Please excuse me if this question is somewhat rudimentary, but I was as much looking for reassurance as anything else.

As I understand TCP sequence numbers and Acknowledgments, in a nutshell it's case that:

• A Sequence number is sent from the host and is total number of bytes sent UP to this point, during the conversation, not including the current payload
• The acknowledgement number would be the total number of bytes recevied by the destination, FROM the sender, plus one (i.e. the one being the next byte it expects to get).
  
  Assuming this is right, I am somewhat confused by the following explanation, taken from this article (page 2): 
  https://www.novell.com/connectionmagazine/2001/05/sequence51.pdf
  
  Explanation goes:
  
  Host 1 ———> 
  Sequence number 1 with 9 bytes of data 
  Acknowledgment number field = 100
  <——— Host 2
  Sequence number 100 with no data (ACK)
  Acknowledgment number field = 10 (in 1 + 9 bytes of data)
  Host 1 ———>
  Sequence number 10 with 5 bytes of data 
  Acknowledgment number field = 100
  <——— Host 2
  Sequence number 100 with no data (ACK)
  Acknowledgment number field = 15 (in 10 + 5 bytes of data)
  <——— Host 2
  Sequence number 100 with 20 bytes of data 
  Acknowledgment number field = 15
  Host 1: ———->
  Sequence number 15 with no data (ACK) 
  Acknowledgment number field = 120 (in 100 + 20 bytes of
  data)

If you would be so kind, I'm sort of looking for some confirmation that, in a nutshell, my appraisal as right, and also that the above explanation between Hosts 1 and 2 is a little confusing.

As a side note, I believe only the SYN and FIN flags actually count as payload data, and the article above begins at Byte 1 but makes no mention of SYN.

Thank you for reading.

[white-zombie]

Just to add to this, I would expect the last Acknowledgement number to be 121 because:

Sequence number is 100.

Data is 20 bytes.

So the Acknowledgement would be 121 from Host 1, as the next byte it expects from Host 2 is Byte 2.

[Peter Paluch]

Hi,

I believe the example is correct. Let's take it apart:

Host 1 ———> 
Sequence number 1 with 9 bytes of data 
Acknowledgment number field = 100

Host1 sends 9 bytes, numbering them from 1 (the Seq). The last byte is numbered as 9, and the subsequent byte will be numbered as 10 so this is what Host2 should acknowledge in its own segment. In addition, Host1 asks Host2 to continue sending data starting with the sequence number 100 (the Ack).

<——— Host 2
Sequence number 100 with no data (ACK)
Acknowledgment number field = 10 (in 1 + 9 bytes of data)

As requested by Host1, Host2 sends a segment with Seq=100. Because Host2 received the 9 bytes from Host1, it acknowledges them and tells Host1 to continue sending bytes starting with Seq=10.

Host 1 ———>
Sequence number 10 with 5 bytes of data 
Acknowledgment number field = 100

Host1 continues sending data starting from Seq=10, and with 5 sent bytes, these are numbered 10-14. The next byte would be 15 which is the Ack number expected from Host2. Because Host2 did not send any data itself, Host1 just tells Host2 again to continue sending data, if any, starting with sequence number 100 (the Ack).

<——— Host 2
Sequence number 100 with no data (ACK)
Acknowledgment number field = 15 (in 10 + 5 bytes of data)

Host2 has received additional 5 bytes from Host1 numbered as 10-14, so it sends back a segment with Ack=15 (all up to 14 is received, continue with 15). As there are no data to be sent by Host2 at this point, the Seq=100 and the body is empty.

<——— Host 2
Sequence number 100 with 20 bytes of data 
Acknowledgment number field = 15

Host2 suddenly has a data to send, and the bytes start with the sequence number of 100, so this is the Seq. Because no further bytes arrived from Host1 yet, we simply tell it to continue with byte 15 whenever Host1 has any bytes to send.

Host 1: ———->
Sequence number 15 with no data (ACK) 
Acknowledgment number field = 120 (in 100 + 20 bytes of data)

Host1 has no data to send itself but it needs to acknowledge the received data from Host2. There were 20 bytes in the segment received from Host2, starting from 100 and ending with 119. The upcoming expected byte from Host2 is thus 120, hence the Ack field value. The Seq field value is 15, the upcoming byte number.

As a side note, I believe only the SYN and FIN flags actually count as payload data

This is true.

and the article above begins at Byte 1 but makes no mention of SYN.

In fact, the article above seems to omit the TCP session establishment phase, and simply starts showing the Seq and Ack values in the midst of an already established session.

Please feel welcome to ask further!

Best regards,
Peter

[white-zombie]

Hi Peter, very much appreciate your detailed answer.

I think it is the last section that confuses me, because, as you say Host 2 sends a sequence number of 100, + 20 bytes, which equals 120, so I would expect the Acknowledgement from Host 1 to Host 2 here to be 121, not 120, as the next byte to be sent by Host 2 would be byte 121.

Have I missed something here?
 

Thanks also Rajee for the Packetlife link. I have this link, and find it makes perfect sense.
I was pointed to the Novell link by the Packetlife link, to explain the Phantom Byte (the fact that a SYN/FIN counts as payload, I believe). Based on the above, I found the Novell article somewhat contradictory to the Packetlife one.

Thanks once again :)

[Peter Paluch · Accepted solution]

Hi,

Regarding the last section: Be careful about the numbering :) Host 2 sends 20 bytes, with the first byte having the sequence number of 100, so:

Seq=100 is the 1st.
Seq=101 is the 2nd.
Seq=102 is the 3rd.
Seq=103 is the 4th.
Seq=104 is the 5th.
...
Seq=118 is the 19th.
Seq=119 is the 20th.

So the 20 bytes are sequenced from 100 to 119 inclusive - there are exactly 20 bytes in this sequence number range. The sequence number 120 is the sequence of the next upcoming byte.

This is really a counting problem we all have ;) How many book pages are there between pages 7 and 9, inclusive? Well, you'd say: 9-7=2. And that's bad because we are also counting the starting page, so there are in fact three pages, not two: 7, 8, and 9.

Does this make sense?

Best regards,
Peter

[white-zombie]

Oh God, thank you Peter, can't believe I missed that :)

Much appreciate your time, thank you!!!

[Rajeev Sharma]

Hey,

Check this link, things are explained simple enough:

http://packetlife.net/blog/2010/jun/7/understanding-tcp-sequence-acknowledgment-numbers/

HTH.

regards,

RS.