A practical walkthrough of TCP header fields as seen in Wireshark, using a captured HTTP request to identify and explain each component of a real packet.
TCP Headers in Wireshark
In one of my prior videos we did a capture of the data going between my demo laptop and my demo Pi. It was a webpage request, so I pulled that up again and let's take a look at it.
First of all, what I see here on the left hand side is it's coming from the IP address of the demo laptop, and it's a request to get an HTTP page from the demo Pi. This is the packet that we're going to take a look at and see what the TCP header looks like.
On this packet, what we're going to do is open up the layer 4 section of this, or the TCP section of this. It says this is a TCP packet here, so we're going to open up the layer 4, this TCP section.
The first couple things that we run across are the source port and the destination port. We've already talked about that in a prior video, so I'm not going to get more in depth into that. Then we see some additional data — some of this data that is displayed is just data that Wireshark has attached to it to make it easier for us to read. So we see some of that information here.
Then we see the sequence number. We actually see the sequence number in two different forms. Here's the raw form. The raw form is the sequence number that these machines actually use, so if you go and look at the data, that is the actual data within the packet. But what we have here is Wireshark has made it a little bit easier for us to interpret the data by putting in the sequence number that's relative. What that means is that even though this is packet — oh, what is that number? — it said, well, we're just going to call this sequence number one. That makes it a lot easier to read.
We see the same thing with the acknowledgement number. We have the acknowledgement number in the raw form of the data, which is this quite large number here. But they said, okay, what we're going to include so it's easier to read is an acknowledgement number that is relative. So this acknowledgement number here is just one.
We have the header length, which is 20 bytes. And then we see the flags here with a drop down. The total shows you what the sum of these flags are, or we can open it up and see what the individual flags are.
This has the acknowledgement bit set. That just means that the field up here that has this acknowledgement number — this one right here, this acknowledgement — is relevant. So the one just means that, hey, pay attention to that field, pay attention to that number, it makes a difference. We've got the push flag set as well, it's one.
Then we have the window size, so this is for windowing. It specifies some data on that, with once again some brackets here telling us Wireshark has done some summaries so that we can see that information.
It shows us the checksum here, to make sure that the information here is correct and hasn't been changed. And then some information, and then finally the TCP payload here.
Here we see some of the fields within the TCP header, and those line up — although the terminology can be a little different — with what we talked about. For instance, one of the things that is a little different in terminology is that we see a header length here versus the data offset, which is what we covered in our lecture. So it can go by a little different names here. But for the most part, all these fields lined up with what we talked about.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →