-1

I am trying to capture the packets moving from my system when i searched URL www.google.com in the browser. This is the flow I am seeing in wireshark.

  1. DNS request was made
  2. TCP three-way handshake is done
  3. TLSV1.2 handshake has started.

In between tlv1.2 handshake I am seeing TCP packets moving from my system to the same port. What is that traffic regarding? I am sharing the screenshot for the same.

enter image description here

V-rund Puro-hit
  • 5,518
  • 9
  • 31
  • 50

1 Answers1

0

The TCP packets with description "ACK" are TCP acknowledgement packets. An acknowledgement packet is sent to the server for each time the client receives a TCP data packet from the server.

The TCP packets with description "TCP segment of a reassembled PDU" are TCP fragmented data packet. TCP may divide an upper layer packet into multiple packets. A TCP fragmented data packet is a piece of a divided packet. For example, the TLS server certificate packet (#1842) was divided into 3 packets by TCP, #1839, #1841, and #1842.

kaitoy
  • 1,545
  • 9
  • 16