Why TCP_Relative_Sequence_Numbers don't start at 0 ?

  • retag add tags

I used wireshark to capture a tcp packet. I found out my "relative sequence number" alway equal "sequence Number (raw). Why it don't start at 0??

Transmission Control Protocol, Src Port: 63620, Dst Port: 443, Seq: 1052312681
    Sequence Number: 1052312681    (relative sequence number)
    Sequence Number (raw): 1052312681
    Acknowledgment Number: 0
    Acknowledgment number (raw): 0
    1011 .... = Header Length: 44 bytes (11)
    Flags: 0x002 (SYN)

I add wireshark -v output.

Wireshark 4.0.4 (v4.0.4-0-gea14d468d9ca).

Copyright 1998-2023 Gerald Combs [email protected] and contributors. Licensed under the terms of the GNU General Public License (version 2 or later). This is free software; see the file named COPYING in the distribution. There is NO WARRANTY; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) using Clang 13.0.0 (clang-1300.0.29.30), with GLib 2.68.4, with PCRE2, with zlib 1.2.11, with Qt 6.2.4, with libpcap, without POSIX capabilities, with Lua 5.2.4, with GnuTLS 3.6.15 and PKCS #11 support, with Gcrypt 1.8.7, with Kerberos (MIT), with MaxMind, with nghttp2 1.46.0, with brotli, with LZ4, with Zstandard, with Snappy, with libxml2 2.9.9, with libsmi 0.4.8, with QtMultimedia, with automatic updates using Sparkle, with SpeexDSP (using system library), with Minizip, with binary plugins.

Running on macOS 13.2.1, build 22D68 (Darwin 22.3.0), with Apple M1, with 16384 MB of physical memory, with GLib 2.68.4, with PCRE2 10.39 2021-10-29, with zlib 1.2.11, with Qt 6.2.4, with libpcap 1.10.1, with c-ares 1.15.0, with GnuTLS 3.6.15, with Gcrypt 1.8.7, with nghttp2 1.46.0, with brotli 1.0.9, with LZ4 1.9.2, with Zstandard 1.4.2, with libsmi 0.4.8, with LC_TYPE=C, binary plugins supported.

a13089's avatar
1
a13089
asked 2023-04-10 19:06:53 +0000, updated 2023-04-11 05:52:36 +0000
edit flag offensive 0 remove flag close merge delete

Comments

Can you add the output of wireshark -v or Help->About Wireshark:Wireshark to the question.

Chuckc's avatar Chuckc (2023-04-10 21:26:17 +0000) edit

This can be recreated with The Ultimate PCAP v20221220 and a display filter of tcp.seq == tcp.seq_raw.

Chuckc's avatar Chuckc (2023-04-12 21:22:22 +0000) edit

In that case, the TCP header being decoded is part of a ICMP response packet.

[Protocols in frame: eth:ethertype:ipv6:icmpv6:ipv6:tcp]

(The CloudFlare gods are out to get me today. Sorry for the multiple comment attempts.)

Chuckc's avatar Chuckc (2023-04-12 21:24:50 +0000) edit
add a comment see more comments