Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Maximum value of TCP sequence number

I'm trying to capture packets and reorganize packets for obtaining original HTTP request.

I'm capturing packets by IPQUEUE(by iptables rule), and I figured out that packets are not captured in order.

I already know that in TCP protocol, packets have to be re-sequenced, so I'm trying to re-sequence packets by sequence number.

According to Wikipedia, the sequence number of TCP is 32 bits number. Then, what happens if sequence number reaches to MAX 32bits number?

Because sequence number of SYN packet is random number, I think this limitation can be reached very fast.

If anybody has a commend on it, or has some links helpful, please leave me a answer.

like image 741
Wonjae Lee Avatar asked Oct 06 '22 05:10

Wonjae Lee


1 Answers

From RFC-1185

  Avoiding reuse of sequence numbers within the same connection is
  simple in principle: enforce a segment lifetime shorter than the
  time it takes to cycle the sequence space, whose size is
  effectively 2**31.

  If the maximum effective bandwidth at which TCP
  is able to transmit over a particular path is B bytes per second,
  then the following constraint must be satisfied for error-free 
  operation:
      2**31 / B  > MSL (secs)  

So In simpler words TCP will take care of it. In addition of this condition TCP also has concept of Timestamps to handle sequence number wrap around condition. From the same above RFC

  Timestamps carried from sender to receiver in TCP Echo options can
  also be used to prevent data corruption caused by sequence number
  wrap-around, as this section describes.

Specifically TCP uses PAWS mechanism to handle TCP wrap around case. You can find more information about PAWS in RFC-1323

like image 135
a.m. Avatar answered Oct 10 '22 02:10

a.m.