Wireshark 101: TCP Flow Control; HakTip 135 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

this hack tip is brought to you by the
all-new G flex 2 from LG life's good
well connect tip the show will we break
down concepts tools and techniques for
hackers gurus and IT ninjas I'm Shannon
Morse and today we are checking out
Wireshark and TCP flow control that
sounds weird
so when sending TCP packets you can run
into problems in which the outcome would
be retransmissions or duplicates which
we explained a couple of weeks ago now
there is a way to keep packet loss from
happening too because why would you
always just want to deal with it after
the problem has occurred might as well
keep it from happening in the first
place now this is called a sliding
window mechanism it lets you adjust the
rate of data retransmission depending on
the destinations receive window the
destination has a certain amount of
bytes that it can hold in a TCP buffer
space and if the amount of data spills
over the buffer space it results in
packet loss and that's no fun so if we
look at a packet in Wireshark this is
going to be found under the window size
under the TCP packet header so if I look
at my very very first packet up here
everything should be totally cool and
totally easy and simple my window size
is 8760 so lots and lots of bytes and my
acknowledgment number is 1 now if I go
to my second one my acknowledgment
number is 29 21 so quite a few bytes
were sent and my window size has
decreased to 58 40 if you take the
original amount of the window size 8760
minus the bytes that we had 29 21 you'll
equal out to 58 40 - the first previous
byte of course now after that we get
another one with 58 41 and the window
size value now has dropped down to 29 20
so we're getting less and less space
from that destination telling us that we
we might want to slow down all those
packets that are coming over to us real
quick now each time the amount of bytes
accumulates in this thing called a
buffer space so that's where it's all
cumulating eventually it'll be processed
up to the application layer protocol and
the buffer space will be available again
for a new packet of bytes now if a
server is receiving data too quickly and
it can't process all the bytes fast
enough to keep its buffer space low it
can send information in its
acknowledgment packet telling the source
to send lower amounts of data now know
how when you have like a big empty pail
you have just big empty pail there's
nothing in there right now you can
basically dump water into it really
really fast and won't spill out because
the pail is large enough to hold all of
that water well if I replace that with
something like a little coffee cup you
would have to pour water into it a
little bit slower so that it doesn't
spill all over the place and you can't
hold as much water in the cup until
you've already drank what's already in
there mmm delicious coffee so now I can
have a little bit more bytes in there
that's kind of what's happening here now
if a destination is running out of space
it can also send an acknowledgement
saying that has zero bite size window
this thing called a zero bite size
window and then the source will just
send all these packets called keepalive
packets now if we had this issue you
would see something like this so I have
my middle packet right here it's a
number 4 if I scroll down a little bit
you'll notice that the window size says
0 so in this case the source is going to
know ok I need to stop and pause for a
little bit until I can send some more
bytes because I currently don't have
enough room to send all the data that I
want to I have another example here that
is in a save file where we have our
first packet which looks completely
normal length is 1410 but then TCP sends
over this packet or the destination
sends a TCP packet called 0 window now
this is going to show window size of 0
and then we'll have our keepalive packet
which simply says a window size of 108
so very very little packets another 0
window keep alive 0 window keep alive in
0 window so you'll continue seeing those
one after another until eventually it
has enough room
in that buffer size in that buffer
window to allow more bytes to be sent
through and that's pretty much how 0
windows work of course if you have a
question or a comment you can always
send those below or you can email us
tips at hack 5 org and be sure to check
out our sister show hack 5 for more
great stuff just like this I'll be there
reminding you to trust your Tecna lest
this hack tip is brought to you by the
all-new G flex 2 from LG life's good