How TCP Works - Bytes in Flight

In this video - we will dig into the bytes in flight measurement in Wireshark. You can download the sample trace file that we will use here:

Like/Share/Subscribe for more Wireshark content!

-------------------------FREE ON DEMAND TRAINING -------------------------------
Learn some new Wireshark tricks with my hands-on courses on Pluralsight.
Check out the free 10-Day Trial so you can watch them all. Just hit one of the links below.

------------------------LIVE WIRESHARK TRAINING ------------------------
Network Analysis Fundamentals - Two Days Remote via Zoom.

-------------------Essential TCP/IP Book for Analysts------------------
TCP/IP Illustrated, Volume 1: The Protocols (2nd Edition)

------------------------ Books for Wireshark Beginners ------------------

--------------- Trace File Analysis Services -----------------------
Got packet problems that you need help digging into?

[anujsharma]

There is no other best way then this to explain tcp bytes in flight..
Quick words - short, sorted, simple language & easy understanding thats what your videos does about tcp.

[vu]

I would give u 5 🌟 for sharing your tremendous knowledge boss..u r mine TCP master 😊

[travisbolton]

I always enjoy watching your wireshark videos. Keep them coming Packet master ....

[Neo_Creators]

You are awesome....just because of ur TCP videos I got to know many things about wireshark and TCP things...very exited and waiting for ur upcoming videos

[ThePumbaadk]

Nice to see that you have started the video series again 😄

[mustafaabdelfattah]

Very good vidio, simple, time supressed and added value, thank you christopher

[TheKhirocks]

Another great video Chris. For someone who is trying to learn traffic/protocol analysis for their job (as I am) your videos are amazing. Any additional resources for learning that you could suggest would be most welcome

[noaxin]

Hey Chris, you forgot to add your "How TCP Works - How to Interpret the TCPTrace Graph" to the playlist! Thank you for you hard work, love your vids

[raykellfoster]

Always good stuff bro Thanks! Keep it up !

[brunoluis]

Thank you very much for your help Chris.

[sureshhkumar]

Hi Chris. Please do the vedio captures in source nat and destination nat

[tianhepeng]

Hi Chris. Great collection. But can you give a video of 4-way TCP shutdown? And I think you miss a video of retransmission and duplicated ACK which you said you will have another video for that. Thanks anyaway.

[subhadeepgupta]

Can you kindly explain what packet count bytes means.

[punggukbulan]

Hi Chris, 'bytes in flight' is started on 1460 and incremented stepping by 1460 until it's acknowlwdged. But after ACK, why 'bytes in flight' doesnt start from 1460 like before, it starts from let say 13140, 24820, etc and incremented in a step by 1460.

[yohanmeier]

hello Chris if I understand correctly the tcp data in flight must never exceed the tcp reception window otherwise it will slow down the application. thank you for sharing (I'm French)



[claudiotonelli]

Hi Chris i'm Claudio from Italy: first of all i want tell you that you are the best tcp master i have ever seen!! i have an answer for you... i have a trace file where i have captured the update software of my Apple watch and i see that the bytes in flight are much greater of the tcp window... i'm not able to understand the cause... if you have any ti e can you explain me the cause? thank's in advance

[xiezengqiang]

Thank you very much, as your loyal audience.

[jch]

Great video! One question. I am trying to capture MQTT data generated from a end point device, I am noticing in my captures the Bytes in Flight are always bigger than the calculated Window size, but are always succeeding. If capturing in this manner, would the logic be flipflopped? Would it be an issue if the Calculated Window size was larger from the opposite direction?

[phantomlord]

Great work! How can we check how many TCP packets can the sender sent without waiting for ack? Asking as a rookie!

[davidpark]

i'm sorry but how to move bytes window to right side ?