# TCP capture lab: one connection, every segment

The instructions and questions are on the Canvas page (TCP Lab, part 1). This file lists what is here, how to run it, and how to read what it prints.

## What is what

| File | |
| :--- | :--- |
| `capture.py` | given, do not change it: builds the network, runs one transfer, captures it, and prints every packet |
| `captures/` | the saved captures, made when you run `capture.py`; you can open them in Wireshark too |

The network: `h1 (10.0.0.1) --- s1 --- h2 (10.0.0.2)`. The switch s1 holds every packet for 10 ms, so a round trip takes 20 ms. h1 connects to h2, sends 3000 bytes, and says it is done sending; h2 counts the bytes, answers `got 3000 bytes`, and closes.

## Build and run

In the course container, from this folder:

```
python3 capture.py
python3 capture.py --relative
python3 capture.py slow
python3 capture.py udp
python3 capture.py show captures/tcp.pcap
```

`capture.py` on its own prints the TCP connection with sequence numbers as sent; `--relative` counts them from the start of the connection, the way Wireshark shows them. `slow` has h2 read slowly so the window closes, `udp` sends the same 3000 bytes over UDP, and `show` prints a saved capture again. Every run starts a new connection, so the raw sequence numbers change each time.

## Reading the output

One line per packet, captured at h1:

| Column | Meaning |
| :--- | :--- |
| `time (ms)` | milliseconds since the first packet |
| `direction` | who sent it |
| `flags` | the TCP flags that are set |
| `seq` | the sequence number of the segment's first byte |
| `ack` | the next byte the sender expects from the other side (only when ACK is set) |
| `len` | bytes of data carried, not counting headers |
| `win` | the window: how many more bytes the sender of this segment will accept |
| `note` | what tshark noticed, such as a zero window |

Two TCP options are turned off so the numbers match the lecture: timestamps and window scaling. A capture from your own computer will have both.