ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: [Wireshark-users] TCP Reassembly Question

From: "Small, James" <JSmall@xxxxxxxxxxxxxx>
Date: Sat, 16 Dec 2006 12:13:09 -0500
I have learned much from listening to the list, especially about TCP and
HTTP.  Thank you to everyone for this!

One question that this has brought up for me is on TCP Reassembly.  I
read Steven's TCP/IP Illustrated and other networking books so I have a
pretty good idea how TCP works.  However, I don't believe I completely
understand TCP segmenting.

Is the way it works like this?

I want to transmit a 100K PNG file via TCP.
TCP segments (right term?) the packet to accommodate the MTU of the
underlying transport.
So if we're using Ethernet with an MTU of 1500 and IP+TCP overhead of 40
bytes, my payload size is 1460 bytes per packet (assuming no MSS
reductions in SYN packets).
TCP would use 71 packets to transmit the 100K image (102400 bytes).
(Assuming ideal conditions and each packet is max size)

So I'm assuming if I use Wireshark, I would see 70 TCP segment of a
reassembled PDU frames and then one frame showing the transfer protocol
(http for example) at the end.

I have tried something like this and it appears to work that way.

So assuming my understanding is correct, is there any way to tell from
looking at a TCP packet/segment which other TCP segments are part of the
same "stream"?

Or is everything for one TCP session between the SYN-SYN/ACK-ACK and the
FIN/ACK-ACK-FIN/ACK-ACK part of the "stream"?

I guess another way to ask this question would be to say, can I use one
TCP session to send multiple files or does each file/data chunk require
a new TCP session/stream?

Thank you,
  --Jim