TCP Fundamentals - Retransmissions, Window Size // TCP/IP Explained

Chris, I think this may be the best material I've ever come across for understanding some of the specific elements of TCP. The time you spent on the receive window confirmed the detail I have in my notes, but the congestion window explanation has always been somewhat elusive online! I have some pretty concise notes, but to see the concepts played out visually in a steady way, and also in context with the capture files, was simply great to watch. Didn't feel like an hour and 20mins. Some great tips too when analysing in Wireshark. Great work - this is how TCP should be taught.

Thanks for these great videos, I'll bet the slow application was a tape drive.

Im 40 years old.. just got interested into this stuff and working on my ccna and i wish you were my teacher..thank you for your great videos

These two videos took my understanding of TCP to a whole new level. Thank you.

This is an awesome talk I am new to wireshark and packets but watching your talk on D.Bombal right before this talk made the topic understandable and approachable.

Great great vedio, this is the best course about the usage for wireshark I have even seen even 4 years pass. Thank you😊

Love it !!!!!

Hi Chris,
This is really helpful. I got one question. In one capture, I can see MSS is set as 1460 (as per SYN, SYN/ACK) but later I can see TCP segment length (from client)much higher than 1460 (as high as 7K, 14K, 30K etc). How to explain that? The capture is on the client side with iperf. The client and servers are back to back connected.

Watched this video for the 7th time and can see this for 7 more time :)

Any resources on how to start catching packets (for almost beginners)? Thank you.

thanks man, real nice tutorial, i love the way you started from scratch and gave a solid base. thanks again

Chris, this is like getting enlightened, thank you

Thank you very nuch

Chris, great content as always. I have a scenario where receiver advertised it’s receive window of 211 no window scaling and next packet sender still sends 1460 bytes why would it do that knowing the receiver window size is low. Sender continues to do that why would it do that?

Can i get this pcapng file ?

Chris, well explained as always. Can you please upload the packet capture ?

Hi Chris, very nice lecture this is becoming my favorite channel of all time :D.
I'm a beginner in TCP/IP and the discussion got a little too complex to me at the end so I got lost a bit please clear this up if you can:

In the last part 'TCP MSS Problem' if I understand correctly the MSS which was agreed by the server&client during the handshake was reduced mid communication because of some router which was in between them? Did I get that right? And if so, how is that possible, isn't the MSS something which is only agreed upon during the 3 way handshake and then set in stone for the remaining of the connection? How can some intermediary router change that?

Please please show subtitles in spanish or english I am from Colombia this video is viewing in all world

Excellent video to get interested in the guts of TCP. This has me very interested in testing my network and servers now to see if there are any optimizations or bottlenecks now.

What an amazing content this is. You rock Chris.

Hello Chris, may I ask for the pcap traces for window size

I am spending my valentine with TCP

Chris .... You did mindblowing lecture ... Your selfless thought by sharing what you learned are commendable ....

For case study, MSS problem i was confused with the explaination, since it was saying the outbound router of the client side was replaced and missed the config, but the talking at the end is saying the server is getting 1432 mss advertised by the client, and but the trace we actually referring to the client side capture rigth? So the server side is thinking client is doing 1460, but client side router is only doing 1432, and passed mss size to client, so when server tried 1460, no go, being dropped by client side router.

Such good stuff!! Thanks Chris. Indebted!

So if server is only sending mss of 1432 instead of 1460 the remaining 28 packets will go in next round trip. Will client send sack for them?

real good stuff, I must leave a comment and click a like!

You're amazing! Thank you for the wonderful content!

That guy who keep cough should just get out ...

You are the best and no one can beat you... Keep up the good job...

No part 3? 🥺🥺

Another banger

Hi Chris, Is there a relation b/w receive window and ACK?

TCP training at its best...

if the server side bucket is filling up and server side app is the cause how can we say client is hanging us up

65535 - that's how many "aha" moments I got watching your video. Awesome stuff Chris!!

You are a god

Great job! Thanks!

Awesome. Very well explained. Great Job, Chris!!

As a fresher starting as a Support engineer this was amazing session on TCP, hope to see more!

You are awesome man, learnt so much from this. Great explanation.

Awesome stuff, both parts. I've worked as an F5 support engineer for a couple years prior to watching this, and I took a ton away from watching these two sessions. Thanks alot man!

Thank you! This was very very clear an simple, just like it should be :)

Hi, Chris! Great explanation! Thanks! I just wonder, could you share your traffic dumps so we could repeat all your moves.

Excellent Sir..... Worth 🥰🥰🥰

Hi Chris, Your videos are really helpful and awesome explanations. I really start to enjoy packet analysing. Is there any place I can get different captures with issue description to analyse and later verify my analysed report is correct? thank you for the great videos again

Some time passed since this video was published but I`ll try to ask anyway :)
First... After many years at IT in different roles (System\Network\Security\Managment) I have to say that this is great and clear explanation of TCP and I learned new stuff.
Now the question regarding the last case study about LDAP. Actually what happend is some FW between the Client and the File Server just dropped packets (from server to the client) because their MSS exceeded what it alterded in the original SYN,SYN-ACK,ACK packets exchange? I get it right ?