One of the mechanisms that is built into TCP is the retransmission mechanism. This mechanism enables the recovery of data that is damaged, lost, duplicated, or delivered out of order.
This is achieved by assigning a sequence number to every transmitted byte, and expecting an acknowledgment (ACK) from the receiving party. If the ACK is not received within a timeout interval, the data is retransmitted.
At the receiver end, the sequence numbers are used to verify that the information comes in the order that it was sent in. If not, rearrange it to its previous state.
This mechanism works as follows:
- At the connection establishment, both sides tell each other what their initial sequence number will be.
- When data is sent, every packet has a sequence number. The sequence number indicates the number of the first byte in the TCP payload. The next packet that is sent will have the sequence number of the previous one plus the number of bytes in the previous packet plus 1 (in the next screenshot).
- When a packet is sent, the retransmission timeout (RTO) counter starts to count the time from the moment it was sent.
- When the receiver receives the packet, it answers with an ACK packet that tells the sender to send the next packet. In the following screenshot you will see how it works:
You can see from here that 10.0.0.7 is downloading a file from 62.219.24.171. The file is downloaded via HTTP (the Wireshark window was configured to show tcp.seq and tcp.ack from the Edit | Preferences columns configuration, as described in Chapter 1, Introduction to Wireshark Version 2).
From here, 62.219.24.171 sends packets with sequence numbers that end with 85101, 86557, after which 10.0.0.7 sends an ACK back telling the sender to send the packet that ends with 88009. The sender then sends it. And so on.
You can see an illustration of this here:
