tcp connection and stream flow question
up vote
1
down vote
favorite
Could anyone explain the main principe of tcp flow when making a session ?
I have take a tcp dump when i'm trying to browse a site. when I analyse the packet by wireshark, i have found many Three way handshake process for one site browse. is that considere as normal ? below the flow :
1-[SYN], 2-[SYN,ACK],3-[ACK], 4-GET/HTTP/1.1 , 5-HTTP/1.1 301 Moved Permanently (text/html), 6-[ACK],7-[ACK],8-[TCP DUP ACK6#1], 9-[SYN],10-[SYN,ACK], 11-[ACK], 12-Client Hello, 13-[ACK]
tcp protocol-theory wireshark transport-protocol tcpdump
edited 6 hours ago
Ron Maupin♦
61k1160109
asked 6 hours ago
R. Mami
284
add a comment |
up vote
1
down vote
favorite
Could anyone explain the main principe of tcp flow when making a session ?
I have take a tcp dump when i'm trying to browse a site. when I analyse the packet by wireshark, i have found many Three way handshake process for one site browse. is that considere as normal ? below the flow :
1-[SYN], 2-[SYN,ACK],3-[ACK], 4-GET/HTTP/1.1 , 5-HTTP/1.1 301 Moved Permanently (text/html), 6-[ACK],7-[ACK],8-[TCP DUP ACK6#1], 9-[SYN],10-[SYN,ACK], 11-[ACK], 12-Client Hello, 13-[ACK]
tcp protocol-theory wireshark transport-protocol tcpdump
edited 6 hours ago
Ron Maupin♦
61k1160109
asked 6 hours ago
R. Mami
284
add a comment |
up vote
1
down vote
favorite
up vote
1
down vote
favorite
Could anyone explain the main principe of tcp flow when making a session ?
I have take a tcp dump when i'm trying to browse a site. when I analyse the packet by wireshark, i have found many Three way handshake process for one site browse. is that considere as normal ? below the flow :
1-[SYN], 2-[SYN,ACK],3-[ACK], 4-GET/HTTP/1.1 , 5-HTTP/1.1 301 Moved Permanently (text/html), 6-[ACK],7-[ACK],8-[TCP DUP ACK6#1], 9-[SYN],10-[SYN,ACK], 11-[ACK], 12-Client Hello, 13-[ACK]
tcp protocol-theory wireshark transport-protocol tcpdump
edited 6 hours ago
Ron Maupin♦
61k1160109
asked 6 hours ago
R. Mami
284
Could anyone explain the main principe of tcp flow when making a session ?
I have take a tcp dump when i'm trying to browse a site. when I analyse the packet by wireshark, i have found many Three way handshake process for one site browse. is that considere as normal ? below the flow :
1-[SYN], 2-[SYN,ACK],3-[ACK], 4-GET/HTTP/1.1 , 5-HTTP/1.1 301 Moved Permanently (text/html), 6-[ACK],7-[ACK],8-[TCP DUP ACK6#1], 9-[SYN],10-[SYN,ACK], 11-[ACK], 12-Client Hello, 13-[ACK]
tcp protocol-theory wireshark transport-protocol tcpdump
tcp protocol-theory wireshark transport-protocol tcpdump
edited 6 hours ago
Ron Maupin♦
61k1160109
asked 6 hours ago
R. Mami
284
edited 6 hours ago
Ron Maupin♦
61k1160109
asked 6 hours ago
R. Mami
284
edited 6 hours ago
Ron Maupin♦
61k1160109
edited 6 hours ago
Ron Maupin♦
61k1160109
edited 6 hours ago
Ron Maupin♦
61k1160109
61k1160109
asked 6 hours ago
R. Mami
284
asked 6 hours ago
R. Mami
284
asked 6 hours ago
R. Mami
284
284
add a comment |
add a comment |
2 Answers
2
active
oldest
votes
up vote
3
down vote
accepted
The answer to your question is yes, it's normal. Modern web sites use multiple TCP streams to build the web page you see in your browser. Text and images can be downloaded concurrently, making the page load faster. Also, as you may notice, a single "page" may have components download from many different servers.
answered 6 hours ago
Ron Trunk
33.6k22970
that's very clear, thank you for the help
– R. Mami
6 hours ago
add a comment |
up vote
3
down vote
A browser may open multiple TCP connections in order to simultaneously load different parts of a web page. Each TCP connection will need to run through the full TCP handshake process because it is a separate connection.
If you look closely, you will see different source ports on each connection. A connection is identified by a pair of sockets (source and destination), each socket consisting of the IP and TCP addresses. If you change even one of the four values (source or destination IP or TCP addresses), then it is a different TCP connection, and the connection must be initialized.
answered 6 hours ago
Ron Maupin♦
61k1160109
that's very clear, thank you for the help
– R. Mami
6 hours ago
add a comment |
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
3
down vote
accepted
The answer to your question is yes, it's normal. Modern web sites use multiple TCP streams to build the web page you see in your browser. Text and images can be downloaded concurrently, making the page load faster. Also, as you may notice, a single "page" may have components download from many different servers.
answered 6 hours ago
Ron Trunk
33.6k22970
that's very clear, thank you for the help
– R. Mami
6 hours ago
add a comment |
up vote
3
down vote
accepted
The answer to your question is yes, it's normal. Modern web sites use multiple TCP streams to build the web page you see in your browser. Text and images can be downloaded concurrently, making the page load faster. Also, as you may notice, a single "page" may have components download from many different servers.
answered 6 hours ago
Ron Trunk
33.6k22970
that's very clear, thank you for the help
– R. Mami
6 hours ago
add a comment |
up vote
3
down vote
accepted
up vote
3
down vote
accepted
The answer to your question is yes, it's normal. Modern web sites use multiple TCP streams to build the web page you see in your browser. Text and images can be downloaded concurrently, making the page load faster. Also, as you may notice, a single "page" may have components download from many different servers.
answered 6 hours ago
Ron Trunk
33.6k22970
The answer to your question is yes, it's normal. Modern web sites use multiple TCP streams to build the web page you see in your browser. Text and images can be downloaded concurrently, making the page load faster. Also, as you may notice, a single "page" may have components download from many different servers.
answered 6 hours ago
Ron Trunk
33.6k22970
answered 6 hours ago
Ron Trunk
33.6k22970
answered 6 hours ago
Ron Trunk
33.6k22970
answered 6 hours ago
Ron Trunk
33.6k22970
33.6k22970
that's very clear, thank you for the help
– R. Mami
6 hours ago
add a comment |
that's very clear, thank you for the help
– R. Mami
6 hours ago
that's very clear, thank you for the help
– R. Mami
6 hours ago
that's very clear, thank you for the help
– R. Mami
6 hours ago
add a comment |
up vote
3
down vote
A browser may open multiple TCP connections in order to simultaneously load different parts of a web page. Each TCP connection will need to run through the full TCP handshake process because it is a separate connection.
If you look closely, you will see different source ports on each connection. A connection is identified by a pair of sockets (source and destination), each socket consisting of the IP and TCP addresses. If you change even one of the four values (source or destination IP or TCP addresses), then it is a different TCP connection, and the connection must be initialized.
answered 6 hours ago
Ron Maupin♦
61k1160109
that's very clear, thank you for the help
– R. Mami
6 hours ago
add a comment |
up vote
3
down vote
A browser may open multiple TCP connections in order to simultaneously load different parts of a web page. Each TCP connection will need to run through the full TCP handshake process because it is a separate connection.
If you look closely, you will see different source ports on each connection. A connection is identified by a pair of sockets (source and destination), each socket consisting of the IP and TCP addresses. If you change even one of the four values (source or destination IP or TCP addresses), then it is a different TCP connection, and the connection must be initialized.
answered 6 hours ago
Ron Maupin♦
61k1160109
that's very clear, thank you for the help
– R. Mami
6 hours ago
add a comment |
up vote
3
down vote
up vote
3
down vote
A browser may open multiple TCP connections in order to simultaneously load different parts of a web page. Each TCP connection will need to run through the full TCP handshake process because it is a separate connection.
If you look closely, you will see different source ports on each connection. A connection is identified by a pair of sockets (source and destination), each socket consisting of the IP and TCP addresses. If you change even one of the four values (source or destination IP or TCP addresses), then it is a different TCP connection, and the connection must be initialized.
answered 6 hours ago
Ron Maupin♦
61k1160109
A browser may open multiple TCP connections in order to simultaneously load different parts of a web page. Each TCP connection will need to run through the full TCP handshake process because it is a separate connection.
If you look closely, you will see different source ports on each connection. A connection is identified by a pair of sockets (source and destination), each socket consisting of the IP and TCP addresses. If you change even one of the four values (source or destination IP or TCP addresses), then it is a different TCP connection, and the connection must be initialized.
answered 6 hours ago
Ron Maupin♦
61k1160109
edited 5 hours ago
answered 6 hours ago
Ron Maupin♦
61k1160109
answered 6 hours ago
Ron Maupin♦
61k1160109
answered 6 hours ago
Ron Maupin♦
61k1160109
61k1160109
that's very clear, thank you for the help
– R. Mami
6 hours ago
add a comment |
that's very clear, thank you for the help
– R. Mami
6 hours ago
that's very clear, thank you for the help
– R. Mami
6 hours ago
that's very clear, thank you for the help
– R. Mami
6 hours ago
add a comment |
Thanks for contributing an answer to Network Engineering Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fnetworkengineering.stackexchange.com%2fquestions%2f55378%2ftcp-connection-and-stream-flow-question%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
