TCP Analysis

A study of TCP connection setup, data transfer, acknowledgments, retransmission checks, and sequence-number behavior during an HTTP file upload.

Overview

The capture follows a TCP connection between a local client and gaia.cs.umass.edu. The traffic includes connection setup, an HTTP POST carrying file data, ACK behavior, and a sequence graph that shows how bytes move over time.

Objective

Use Wireshark to connect TCP header fields with reliable delivery behavior: SYN setup, sequence numbers, ACKs, segment sizes, RTT estimates, retransmission indicators, and flow behavior.

Environment / Scenario

Client192.168.2.198:51820

Server128.119.245.12:80

ApplicationHTTP POST over TCP

Payload examplealice.txt transfer

What I Investigated

How the SYN flag starts a TCP connection and advertises options such as SACK permitted.
How the HTTP POST and file content are split across multiple TCP segments.
How ACKs confirm received byte ranges and support reliable delivery.
Whether retransmissions appeared in the trace and how the sequence graph reflects send behavior.

Key Observations

The client connection uses local address 192.168.2.198 and source port 51820 toward server port 80.
The SYN segment begins the connection, and SACK-permitted support is visible in the TCP options.
The POST payload does not fit into a single TCP segment; Wireshark reassembles multiple segments into the HTTP object.
Early data-carrying segments were acknowledged quickly, with observed RTT values around 50 ms for the first two measured segments.
The selected data flow did not show the highlighted POST segments being retransmitted, although retransmission analysis was checked separately in Wireshark.

Annotated Screenshots

TCP SYN segment showing flags and SACK option — Wireshark capture showing the SYN segment that initiates the connection. The TCP flags and SACK-permitted option are useful when diagnosing setup and loss-recovery behavior.

TCP HTTP POST showing client IP and port — Wireshark capture showing the HTTP POST carried over TCP from 192.168.2.198 using source port 51820 to server port 80.

TCP data segments and ACKs — This frame group illustrates multiple data-carrying TCP segments and the server ACKs that advance the acknowledged byte position.

TCP sequence number graph — The sequence-number graph shows bursts of transmitted data followed by a flat period after the transfer completes or pauses.

Why It Matters for Troubleshooting

Slow or broken applications often come down to transport behavior: failed handshakes, retransmissions, packet loss, delayed acknowledgments, small receive windows, or stalled data transfer. TCP analysis gives support teams evidence for whether the problem is connection setup, reliability, congestion behavior, or the application above TCP.

Key Takeaways

TCP reliability is visible through sequence numbers, ACKs, retransmission analysis, and reassembly.
Application payloads are often split across several TCP segments.
Sequence graphs help summarize transfer behavior that is hard to see packet by packet.