1

I'm confused about the meaning of the "sequence number (raw)" in wireshark when I capture the first SYN package. What is the difference between the "sequence number (relative)" and "sequence number (raw)"?

printscreen in wireshark

Eason Wang
  • 29
  • 1
  • 6

1 Answers1

4

The raw sequence number is the actual value assigned on the packet.

WireShark groups TCP sessions and assigns them relative sequence (and acknowledgment) numbers which start from 0 (and incrementing by 1 as it seems, for each subsequent packet) so the user can identify the sequence of events.

According to the corresponding wiki page:

By default Wireshark and TShark will keep track of all TCP sessions and convert all Sequence Numbers (SEQ numbers) and Acknowledge Numbers (ACK Numbers) into relative numbers. This means that instead of displaying the real/absolute SEQ and ACK numbers in the display, Wireshark will display a SEQ and ACK number relative to the first seen segment for that conversation.

That wiki page also includes instructions on how to enable/disable this feature.

To get to that wiki page you can follow some paths including the following:

  1. WireShark home wiki page -> Use WireShark / TShark -> Preferences -> Protcols -> TCP -> TCP_Relative_Sequence_Numbers.
  2. WireShark home wiki page -> References -> PortReference: TCP -> Transmission Control Protocol -> Preference Settings -> TCP_Relative_Sequence_Numbers and TCP Window Scaling.

See also:

  1. How can I get the actual TCP sequence number in Wireshark?
  2. TCP: How are the seq / ack numbers generated? (which led me to TCP's RFC 793, page 27).
gthanop
  • 3,035
  • 2
  • 10
  • 27
  • Thank you for your answer. Now I know the difference. Futhermore, this package is the SYN package and I want to know if this real/absolute SEQ would be the begining random SEQ number as [TCP: How are the seq / ack numbers generated? ](https://stackoverflow.com/questions/692880/tcp-how-are-the-seq-ack-numbers-generated) described? – Eason Wang Nov 18 '21 at 15:03
  • No problem! Packets with the `SYN` flag set are used to initiate a TCP connection as far as I know. Which means that the raw sequence number in the case of your image is also the Initial Sequence Number (ISN for short). – gthanop Nov 18 '21 at 15:10