Wireshark-users: Re: [Wireshark-users] about next sequence number in TCP head
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 18 Dec 2008 14:52:11 -0800

On Dec 18, 2008, at 7:45 AM, Bo Xu wrote:
Can somebody tell me which document or RFC includes this mechanism ?
It's sort of implied by RFC 793 - the "next sequence number" of a TCP segment, which is computed by Wireshark as a convenience to the user, is the sequence number that would be used for the first byte of data following that segment. As sequence numbers are assigned, well, sequentially, and as they count bytes, if the sequence number of a TCP segment is N, and the segment has M bytes of data in it, the sequence number of the first byte of data following that segment would be N+M.