Home / server / Questions / 220453
In Process
Berkay
Asked: 2011-01-10 14:58:49 +0800 CST

Confusion about TCP packet analysis terms

  • 772

I'm analyzing our network and have some confusion about the terms: this is the 2-packet output from source to destination.

alt text

from these i have to get some features as describe, pls make me clear...

  1. packets with at least a bytes of TCP data payload: it seems tcp.len>0;

  2. The minimum segment size (confusion is headers are included or or not)

  3. The average segment size observed during the lifetime of the connection, the definition: is calculated as the value reported in the actual data bytes divided by the actual data pkts reported.

  4. Total bytes in IP packets, should be ip_len value.

  5. Total bytes in (Ethernet)

  6. The total number of bytes sent

probably related to frame.len and frame.cap_len these two terms are describes as, also make me clear about these two terms.

  • frame.cap_len: Frame length stored into the capture file
  • frame.len: Frame length on the wire
networking tcp packet-analyzer network-protocols packet

1 Answers

    • tcp_hdr.len - Length of the TCP header
    • tcp.len - Length of TCP payload
    • ip_hdr.len - Lenght of the IP header
    • ip.len - Size of the IP frame (including headers, loks like)
    • frame.len - Length of the on-the-wire frame (ethernet, most probably)
    • frame.cap_len - Length of the capture

    The "minimum segment size" is something I would normally consider to be "the lowest frame.len value where TCP fragmentation has been used", not "the minimum frame.len size sent", as anything that's smaller than the minimum frame ever sent.

    • 2