-
Book Overview & Buying
-
Table Of Contents
Packet Analysis with Wireshark
By :
In this section we will learn how the TCP opens and closes its connections. In order to establish a connection, the three-way handshake procedure is used as described in the following section.
The three-way handshake is a connection establishment procedure from the client socket to the server socket, as shown in the following image:

Before the start of the TCP three-way handshake, the client will be in the CLOSED state and the server will be in the LISTEN state as shown:
|
SN |
TCP-A (122.167.84.137) state |
Flow CTL |
TCP-B (10.0.0.221) state | ||
|
From |
To |
From |
To | ||
|
1 |
CLOSED |
CLOSED |
LISTEN | ||
The TCP state machine
To examine a three-way handshake in Wireshark, open the normal-connection.pcap file provided in the book.
The first step of the handshake process is that the socket client will construct a SYN packet and send it to the server. During this process the socket client...
Change the font size
Change margin width
Change background colour