Lab3-2: TCP
In this lab, we use Wireshark to capture TCP packets to study many features of TCP
protocol. Many applications such as HTTP, SMTP, TELNET, and FTP use the service
of TCP. For this lab, we use HTTP application to download a rather long file.
The situation of TCP is different from UDP. TCP is a connection-oriented protocol;
it uses packets for connection establishment, connection termination, and data
3
transfer. This means that we can capture packets that use TCP as source or sink protocol
as well as packets that use an application-layer protocol as the source or sink, but
use TCP as the intermediate protocol. In this lab assignment, we capture both types of
packets and distinguish between them.
Assignment
■ Start your web browser and clear the browser's cache memory, but do not access
any website yet.
■ Open Wireshark and start capturing.
■ Go back to your web browser and retrieve any file from a website. Wireshark
starts capturing packets.
■ After enough packets have been captured, stop Wireshark and save the captured
file.
■ Using the captured file, select only those packets that use the service of TCP. For
this purpose, type tcp (lowercase) in the filter field and press Apply. The packet
list pane of the Wireshark window should now display a bunch of packets.
Part I: Connection-Establishment Phase
Identify the TCP packets used for connection establishment. Note that the last packe