Packt+ | Advance your knowledge in tech

You're reading from Network Analysis using Wireshark 2 Cookbook Practical recipes to analyze and secure your network using Wireshark 2

Product type Paperback

Published in Mar 2018

Publisher

ISBN-13 9781786461674

Length 626 pages

Edition 2nd Edition

Tools

Wireshark

Concepts

Network Security

Authors (3):

Nagendra Kumar Nainar

Yoram Orzach

Yogesh Ramdoss

View More author details

Table of Contents (25) Chapters

Title Page

Dedication

Packt Upsell

Contributors

Preface

1. Introduction to Wireshark Version 2 FREE CHAPTER

2. Mastering Wireshark for Network Troubleshooting

3. Using Capture Filters

4. Using Display Filters

5. Using Basic Statistics Tools

6. Using Advanced Statistics Tools

7. Using the Expert System

8. Ethernet and LAN Switching

9. Wireless LAN

10. Network Layer Protocols and Operations

11. Transport Layer Protocol Analysis

12. FTP, HTTP/1, and HTTP/2

13. DNS Protocol Analysis

14. Analyzing Mail Protocols

15. NetBIOS and SMB Protocol Analysis

16. Analyzing Enterprise Applications' Behavior

17. Troubleshooting SIP, Multimedia, and IP Telephony

18. Troubleshooting Bandwidth and Delay Issues

19. Security and Network Forensics

Index

TCP enhancements – selective ACK and timestamps

Various TCP enhancements have been introduced over a period of time to augment the TCP performance. In this section, we will discuss a couple of these important enhancements and see how Wireshark can be used to analyze the same.

Getting ready

When you observe that the TCP flow performance is degraded and is not working as expected, connect Wireshark to capture the TCP flow for analysis.

How to do it...

For backward compatibility, a feature enhancement like selective ACK (SACK) or TCP timestamp will be negotiated during the initial three-way handshake. The TCP endpoints will include the relevant TCP options in the SYN and SYN/ACK packets.

TCP selective acknowledgement option

TCP SACK is a TCP option that will be included in the SYN and SYN/ACK segments. When the TCP endpoints are enabled with TCP SACK feature, the endpoint signal the capability to peer by including the same in SYN packet.