tcp connection and stream flow question
up vote
2
down vote
favorite
Could anyone explain the main principe of tcp flow when making a session ?
I have take a tcp dump when i'm trying to browse a site. when I analyse the packet by wireshark, i have found many Three way handshake process for one site browse. is that considere as normal ? below the flow :
1-[SYN], 2-[SYN,ACK],3-[ACK], 4-GET/HTTP/1.1 , 5-HTTP/1.1 301 Moved Permanently (text/html), 6-[ACK],7-[ACK],8-[TCP DUP ACK6#1], 9-[SYN],10-[SYN,ACK], 11-[ACK], 12-Client Hello, 13-[ACK]
tcp protocol-theory wireshark transport-protocol tcpdump
edited 16 hours ago
Ron Maupin♦
61.1k1160109
asked 16 hours ago
R. Mami
334
add a comment |
up vote
2
down vote
favorite
Could anyone explain the main principe of tcp flow when making a session ?
I have take a tcp dump when i'm trying to browse a site. when I analyse the packet by wireshark, i have found many Three way handshake process for one site browse. is that considere as normal ? below the flow :
1-[SYN], 2-[SYN,ACK],3-[ACK], 4-GET/HTTP/1.1 , 5-HTTP/1.1 301 Moved Permanently (text/html), 6-[ACK],7-[ACK],8-[TCP DUP ACK6#1], 9-[SYN],10-[SYN,ACK], 11-[ACK], 12-Client Hello, 13-[ACK]
tcp protocol-theory wireshark transport-protocol tcpdump
edited 16 hours ago
Ron Maupin♦
61.1k1160109
asked 16 hours ago
R. Mami
334
The fact the the second TCP handshake then moves on to "Client Hello" makes me thing that you actually switched to a different protocol. The first HTTP request (and TCP connection) resulted in an HTTP redirect, which was probably an HTTP to HTTPS redirect, and then a new connection (HTTP over TLS over TCP) was opened on a different port, am I correct?
– jcaron
7 hours ago
add a comment |
up vote
2
down vote
favorite
up vote
2
down vote
favorite
Could anyone explain the main principe of tcp flow when making a session ?
I have take a tcp dump when i'm trying to browse a site. when I analyse the packet by wireshark, i have found many Three way handshake process for one site browse. is that considere as normal ? below the flow :
1-[SYN], 2-[SYN,ACK],3-[ACK], 4-GET/HTTP/1.1 , 5-HTTP/1.1 301 Moved Permanently (text/html), 6-[ACK],7-[ACK],8-[TCP DUP ACK6#1], 9-[SYN],10-[SYN,ACK], 11-[ACK], 12-Client Hello, 13-[ACK]
tcp protocol-theory wireshark transport-protocol tcpdump
edited 16 hours ago
Ron Maupin♦
61.1k1160109
asked 16 hours ago
R. Mami
334
Could anyone explain the main principe of tcp flow when making a session ?
I have take a tcp dump when i'm trying to browse a site. when I analyse the packet by wireshark, i have found many Three way handshake process for one site browse. is that considere as normal ? below the flow :
1-[SYN], 2-[SYN,ACK],3-[ACK], 4-GET/HTTP/1.1 , 5-HTTP/1.1 301 Moved Permanently (text/html), 6-[ACK],7-[ACK],8-[TCP DUP ACK6#1], 9-[SYN],10-[SYN,ACK], 11-[ACK], 12-Client Hello, 13-[ACK]
tcp protocol-theory wireshark transport-protocol tcpdump
tcp protocol-theory wireshark transport-protocol tcpdump
edited 16 hours ago
Ron Maupin♦
61.1k1160109
asked 16 hours ago
R. Mami
334
edited 16 hours ago
Ron Maupin♦
61.1k1160109
asked 16 hours ago
R. Mami
334
edited 16 hours ago
Ron Maupin♦
61.1k1160109
edited 16 hours ago
Ron Maupin♦
61.1k1160109
edited 16 hours ago
Ron Maupin♦
61.1k1160109
61.1k1160109
asked 16 hours ago
R. Mami
334
asked 16 hours ago
R. Mami
334
asked 16 hours ago
R. Mami
334
334
The fact the the second TCP handshake then moves on to "Client Hello" makes me thing that you actually switched to a different protocol. The first HTTP request (and TCP connection) resulted in an HTTP redirect, which was probably an HTTP to HTTPS redirect, and then a new connection (HTTP over TLS over TCP) was opened on a different port, am I correct?
– jcaron
7 hours ago
add a comment |
The fact the the second TCP handshake then moves on to "Client Hello" makes me thing that you actually switched to a different protocol. The first HTTP request (and TCP connection) resulted in an HTTP redirect, which was probably an HTTP to HTTPS redirect, and then a new connection (HTTP over TLS over TCP) was opened on a different port, am I correct?
– jcaron
7 hours ago
The fact the the second TCP handshake then moves on to "Client Hello" makes me thing that you actually switched to a different protocol. The first HTTP request (and TCP connection) resulted in an HTTP redirect, which was probably an HTTP to HTTPS redirect, and then a new connection (HTTP over TLS over TCP) was opened on a different port, am I correct?
– jcaron
7 hours ago
The fact the the second TCP handshake then moves on to "Client Hello" makes me thing that you actually switched to a different protocol. The first HTTP request (and TCP connection) resulted in an HTTP redirect, which was probably an HTTP to HTTPS redirect, and then a new connection (HTTP over TLS over TCP) was opened on a different port, am I correct?
– jcaron
7 hours ago
add a comment |
2 Answers
2
active
oldest
votes
up vote
3
down vote
accepted
The answer to your question is yes, it's normal. Modern web sites use multiple TCP streams to build the web page you see in your browser. Text and images can be downloaded concurrently, making the page load faster. Also, as you may notice, a single "page" may have components download from many different servers.
answered 16 hours ago
Ron Trunk
33.6k22970
that's very clear, thank you for the help
– R. Mami
16 hours ago
add a comment |
up vote
3
down vote
A browser may open multiple TCP connections in order to simultaneously load different parts of a web page. Each TCP connection will need to run through the full TCP handshake process because it is a separate connection.
If you look closely, you will see different source ports on each connection. A connection is identified by a pair of sockets (source and destination), each socket consisting of the IP and TCP addresses. If you change even one of the four values (source or destination IP or TCP addresses), then it is a different TCP connection, and the connection must be initialized.
answered 16 hours ago
Ron Maupin♦
61.1k1160109
that's very clear, thank you for the help
– R. Mami
16 hours ago
add a comment |
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
3
down vote
accepted
The answer to your question is yes, it's normal. Modern web sites use multiple TCP streams to build the web page you see in your browser. Text and images can be downloaded concurrently, making the page load faster. Also, as you may notice, a single "page" may have components download from many different servers.
answered 16 hours ago
Ron Trunk
33.6k22970
that's very clear, thank you for the help
– R. Mami
16 hours ago
add a comment |
up vote
3
down vote
accepted
The answer to your question is yes, it's normal. Modern web sites use multiple TCP streams to build the web page you see in your browser. Text and images can be downloaded concurrently, making the page load faster. Also, as you may notice, a single "page" may have components download from many different servers.
answered 16 hours ago
Ron Trunk
33.6k22970
that's very clear, thank you for the help
– R. Mami
16 hours ago
add a comment |
up vote
3
down vote
accepted
up vote
3
down vote
accepted
The answer to your question is yes, it's normal. Modern web sites use multiple TCP streams to build the web page you see in your browser. Text and images can be downloaded concurrently, making the page load faster. Also, as you may notice, a single "page" may have components download from many different servers.
answered 16 hours ago
Ron Trunk
33.6k22970
The answer to your question is yes, it's normal. Modern web sites use multiple TCP streams to build the web page you see in your browser. Text and images can be downloaded concurrently, making the page load faster. Also, as you may notice, a single "page" may have components download from many different servers.
answered 16 hours ago
Ron Trunk
33.6k22970
answered 16 hours ago
Ron Trunk
33.6k22970
answered 16 hours ago
Ron Trunk
33.6k22970
answered 16 hours ago
Ron Trunk
33.6k22970
33.6k22970
that's very clear, thank you for the help
– R. Mami
16 hours ago
add a comment |
that's very clear, thank you for the help
– R. Mami
16 hours ago
that's very clear, thank you for the help
– R. Mami
16 hours ago
that's very clear, thank you for the help
– R. Mami
16 hours ago
add a comment |
up vote
3
down vote
A browser may open multiple TCP connections in order to simultaneously load different parts of a web page. Each TCP connection will need to run through the full TCP handshake process because it is a separate connection.
If you look closely, you will see different source ports on each connection. A connection is identified by a pair of sockets (source and destination), each socket consisting of the IP and TCP addresses. If you change even one of the four values (source or destination IP or TCP addresses), then it is a different TCP connection, and the connection must be initialized.
answered 16 hours ago
Ron Maupin♦
61.1k1160109
that's very clear, thank you for the help
– R. Mami
16 hours ago
add a comment |
up vote
3
down vote
A browser may open multiple TCP connections in order to simultaneously load different parts of a web page. Each TCP connection will need to run through the full TCP handshake process because it is a separate connection.
If you look closely, you will see different source ports on each connection. A connection is identified by a pair of sockets (source and destination), each socket consisting of the IP and TCP addresses. If you change even one of the four values (source or destination IP or TCP addresses), then it is a different TCP connection, and the connection must be initialized.
answered 16 hours ago
Ron Maupin♦
61.1k1160109
that's very clear, thank you for the help
– R. Mami
16 hours ago
add a comment |
up vote
3
down vote
up vote
3
down vote
A browser may open multiple TCP connections in order to simultaneously load different parts of a web page. Each TCP connection will need to run through the full TCP handshake process because it is a separate connection.
If you look closely, you will see different source ports on each connection. A connection is identified by a pair of sockets (source and destination), each socket consisting of the IP and TCP addresses. If you change even one of the four values (source or destination IP or TCP addresses), then it is a different TCP connection, and the connection must be initialized.
answered 16 hours ago
Ron Maupin♦
61.1k1160109
A browser may open multiple TCP connections in order to simultaneously load different parts of a web page. Each TCP connection will need to run through the full TCP handshake process because it is a separate connection.
If you look closely, you will see different source ports on each connection. A connection is identified by a pair of sockets (source and destination), each socket consisting of the IP and TCP addresses. If you change even one of the four values (source or destination IP or TCP addresses), then it is a different TCP connection, and the connection must be initialized.
answered 16 hours ago
Ron Maupin♦
61.1k1160109
edited 16 hours ago
answered 16 hours ago
Ron Maupin♦
61.1k1160109
answered 16 hours ago
Ron Maupin♦
61.1k1160109
answered 16 hours ago
Ron Maupin♦
61.1k1160109
61.1k1160109
that's very clear, thank you for the help
– R. Mami
16 hours ago
add a comment |
that's very clear, thank you for the help
– R. Mami
16 hours ago
that's very clear, thank you for the help
– R. Mami
16 hours ago
that's very clear, thank you for the help
– R. Mami
16 hours ago
add a comment |
Thanks for contributing an answer to Network Engineering Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fnetworkengineering.stackexchange.com%2fquestions%2f55378%2ftcp-connection-and-stream-flow-question%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
The fact the the second TCP handshake then moves on to "Client Hello" makes me thing that you actually switched to a different protocol. The first HTTP request (and TCP connection) resulted in an HTTP redirect, which was probably an HTTP to HTTPS redirect, and then a new connection (HTTP over TLS over TCP) was opened on a different port, am I correct?
– jcaron
7 hours ago