TCP: How are the seq / ack numbers generated?

Question

Greetings and salutations!

I am currently working on a program which sniffs TCP packets being sent and received to and from a particular address. What I am trying to accomplish is replying with custom tailored packets to certain received packets. I've already got the parsing done. I can already generated valid Ethernet, IP, and--for the most part--TCP packets. The only thing that I cannot figure out is how the seq / ack numbers are determined. Also, while this may be irrelevant to the problem, the program is written in C++ using WinPCap.

I am asking for any tips, articles, or other resources that may help me.

Thanks!

Answer 1

The sequence numbers increment after a connection is established. The initial sequence number on a new connection is ideally chosen at random but a lot of OS's have some semi-random algorithm. The RFC's are the best place to find out more TCP RFC.

Answer 2

RFC 793 section 3.3 covers sequence numbers. Last time I wrote code at that level, I think we just kept a one-up counter for sequence numbers that persisted.

Answer 3

These values reference the expected offsets of the start of the payload for the packet relative to the initial sequence number for the connection.

Reference

Sequence number (32 bits) – has a dual role If the SYN flag is set, then this is the initial sequence number. The sequence number of the actual first data byte will then be this sequence number plus 1. If the SYN flag is not set, then this is the sequence number of the first data byte

Acknowledgement number (32 bits) – if the ACK flag is set then the value of this field is the next expected byte that the receiver is expecting.

Answer 4

Numbers are randomly generated from both sides, then increased by number of octets (bytes) send.

Answer 5

When a TCP connection is established, each side generates a random number as its initial sequence number. It is a strongly random number: there are security problems if anybody on the internet can guess the sequence number, as they can easily forge packets to inject into the TCP stream.

Thereafter, for every byte transmitted the sequence number will increment by 1. The ACK field is the sequence number from the other side, sent back to acknowledge reception.

RFC 793 (the original TCP protocol specification) would be of great help.

Answer 6

The best place for standards-related information is usually the original RFC (Request for comments), in this case, RFC 2018.

In general Wikipedia is also a good place to look.

Failing that, you're almost guaranteed to get results here.

Answer 7

Seems that the rest of the answers explained pretty much all about where to find detailed and official information about ACK's, namely TCP RFC

Here's a more practical and "easy understood" page that I found when I was doing similar implementations that may also help TCP Analysis - Section 2: Sequence & Acknowledgement Numbers

Answer 8

If I understand you correctly - you're trying to mount a TCP SEQ prediction attack. If that's the case, you'll want to study the specifics of your target OS's Initial Sequence Number generator.

There were widely publicized vulnerabilties in pretty much all the major OS's wrt their ISN generators being predictable. I haven't followed the fallout closely, but my understanding is that most vendors released patches to randomize their ISN increments.

Answer 9

salam! i have the same job 2 do. firstly the initial seq# ll be generated randomly(0-4294967297). then the recever ll count the length of the data it recieved n send the ACK of seq#+length=x to the sender.than the sequence ll be x n the sender ll send the data,similary the recever ll count the length (x+length=y) n send the ACK as y n so on...... its how the the seq/ack is generated... if u want to show it pratically try 2 sniff a packet in Wireshark n fallo tcpstream n see the scanario... AllahHafiz