Relation between the message size and the
number of packets observed by tcpdump

One TCP message is sent. What will be the result of tcpdump? I checked it by running the following Server and Client programs. Server program is run on Linux machine, and Client program is run on FreeBSD machine.

Server side program
Client side program
Header file

tcpdump result is such as follows:
18:44:34.890254 130.69.250.34.3014 > 130.69.250.35.6998: S 1488992096:1488992096(0) win 16384  (DF)
18:44:34.890410 130.69.250.35.6998 > 130.69.250.34.3014: S 3653639078:3653639078(0) ack 1488992097 win 32736 
18:44:34.890454 130.69.250.34.3014 > 130.69.250.35.6998: . ack 1 win 17520 (DF)
18:44:37.892431 130.69.250.34.3014 > 130.69.250.35.6998: . 1:1461(1460) ack 1 win 17520 (DF)
18:44:38.213242 130.69.250.35.6998 > 130.69.250.34.3014: . ack 1461 win 31276 (DF)
18:44:38.213279 130.69.250.34.3014 > 130.69.250.35.6998: . 1461:2921(1460) ack 1 win 17520 (DF)
18:44:38.213291 130.69.250.34.3014 > 130.69.250.35.6998: . 2921:4381(1460) ack 1 win 17520 (DF)
18:44:38.223239 130.69.250.35.6998 > 130.69.250.34.3014: . ack 4381 win 29200 (DF)
18:44:38.223264 130.69.250.34.3014 > 130.69.250.35.6998: . 4381:5841(1460) ack 1 win 17520 (DF)
18:44:38.223275 130.69.250.34.3014 > 130.69.250.35.6998: . 5841:7301(1460) ack 1 win 17520 (DF)
18:44:38.223286 130.69.250.34.3014 > 130.69.250.35.6998: . 7301:8761(1460) ack 1 win 17520 (DF)
18:44:38.233240 130.69.250.35.6998 > 130.69.250.34.3014: . ack 8761 win 26280 (DF)
18:44:38.233262 130.69.250.34.3014 > 130.69.250.35.6998: P 8761:10001(1240) ack 1 win 17520 (DF)
18:44:38.253239 130.69.250.35.6998 > 130.69.250.34.3014: . ack 10001 win 26280 (DF)
18:44:47.902417 130.69.250.34.3014 > 130.69.250.35.6998: F 10001:10001(0) ack 1 win 17520 (DF)
18:44:47.902568 130.69.250.35.6998 > 130.69.250.34.3014: . ack 10002 win 26280 (DF)
In this situation, the MTU (Maximum Tranfer Unit) size is 1500. Therefore, the size of one packet should be equal to or less than 1500 Byte. The size of IP header is 20 Bytes and the size of TCP header is 20 Byte. Therefore, one message which is passed from TCP layer to IP layer should be equal to or less than (1500 - 20 - 20) = 1460 Byte. In this case, one message of the size 10000 is sent from the Client side to the Server side. This message is fragmented to 6 packets of the size 1460 and 1 packet of the size 1240 (1460 x 6 + 1240 = 10000 ;-))


nobu@icnet.ne.jp