Walk me through sequence and acknowledgment numbers for a short exchange, with real numbers.
Show the answer
Say this first
The sequence number is the number of the first data byte in a segment; the acknowledgment number is the next byte the receiver expects, and it is cumulative. SYN and FIN each use one number; pure ACKs use none. If the client starts at 1000 and sends 200 bytes after the handshake, its data segment is seq 1001 and the server acknowledges 1201.
Go deeper
Worked example
Real ISNs are random 32-bit numbers. Small ones keep the arithmetic visible. Client ISN 1000, server ISN 5000.
| # | Direction | Flags | Seq | Ack | Len | Why |
|---|---|---|---|---|---|---|
| 1 | C to S | SYN | 1000 | 0 | Client ISN | |
| 2 | S to C | SYN, ACK | 5000 | 1001 | 0 | Server ISN; SYN used byte 1000 |
| 3 | C to S | ACK | 1001 | 5001 | 0 | Pure ACK uses no number |
| 4 | C to S | PSH, ACK | 1001 | 5001 | 200 | Request, bytes 1001 to 1200 |
| 5 | S to C | ACK | 5001 | 1201 | 1460 | Response part 1, bytes 5001 to 6460 |
| 6 | S to C | PSH, ACK | 6461 | 1201 | 500 | Response part 2, bytes 6461 to 6960 |
| 7 | C to S | ACK | 1201 | 6961 | 0 | One ACK covers both segments |
| 8 | C to S | FIN, ACK | 1201 | 6961 | 0 | FIN uses byte 1201 |
| 9 | S to C | FIN, ACK | 6961 | 1202 | 0 | Acks the FIN; FIN uses byte 6961 |
| 10 | C to S | ACK | 1202 | 6962 | 0 | Final ACK, client enters TIME_WAIT |
Rules to say out loud
- Next seq from a sender = this seq + payload length (+1 for SYN or FIN).
- Ack = highest in-order byte received + 1. It never jumps over a hole.
- One ACK can cover many segments (segment 7), and with delayed ACK it usually covers two.
When segment 5 is lost
The client receives segment 6 first. It cannot advance past the hole, so it sends ack 5001 again (a
duplicate ACK), with a SACK block 6461-6961 if SACK was agreed. The server sees exactly which bytes to resend.
They will ask next
Why does Wireshark show sequence numbers starting at 0?
It shows relative sequence numbers by default: the ISN is displayed as 0. The real ISN is still in the packet. You can turn relative numbers off in the TCP protocol preferences. tcpdump shows the absolute ISN on the SYN and relative numbers after that unless you add
-S.What happens when the sequence number reaches 2^32?
It wraps to zero. Comparisons are done modulo 2^32, and at high speed timestamps (PAWS) stop old segments from a previous wrap being accepted.
Traps
- Adding 1 for a pure ACK. Only SYN, FIN and data bytes use sequence numbers.