SubnetLayer

Sequence & Acknowledgement Numbers

How TCP counts every byte — and never loses track

Step 1 of 2 — understand the idea. Read this first and the packet trace will confirm what you already expect, instead of teaching you two things at once.

What you'll be able to do

Before this lesson — it builds directly on:
The network can lose packets, duplicate them, and deliver them out of order — and it never tells anyone. So TCP gives every single byte a number. With numbers, all three problems become solvable: the receiver can put bytes back in order, spot a gap, and discard a duplicate. Without them, none of that is possible.

✗ Common misunderstanding: Sequence numbers count packets — packet 1, packet 2, packet 3…

Why that's wrong: They count BYTES of the stream. Two packets carrying 1460 bytes each are numbered 1000 and 2460 — a gap of 1460, not 1.

Correct model: A sequence number is the position of a byte in that direction's stream, like a page number in a very long book. Packets are just how the pages get shipped.

The packets prove it: In the data-transfer trace, the second segment's sequence number is the first one's plus its payload length — never plus one.

✗ Common misunderstanding: The acknowledgement number identifies the packet being acknowledged.

Why that's wrong: It names the next BYTE the receiver wants. It frequently corresponds to no packet boundary at all, and one ACK can cover many packets.

Correct model: Read every ACK as a sentence: “I have everything before this number; send me this byte next.”

The packets prove it: After a 43-byte request, the server's ACK is ISN+1+43 — a byte position. In the SACK lesson one ACK jumps across eight segments at once.

Watch these fields in the lab: tcp.sequenceNumber · tcp.ackNumber

Every number in every trace in this app follows five rules. Learn these and you can predict what comes next instead of just reading it.

The rules, then a worked case:

1. Payload bytes     → consume that many numbers
2. SYN               → consumes 1
3. FIN               → consumes 1
4. Pure ACK (no data)→ consumes 0
5. Retransmission    → reuses the ORIGINAL numbers

Sender transmits 500 bytes starting at sequence number 1000.
  Bytes on the wire:  1000 through 1499
  Receiver replies:   ACK = 1500
  Meaning:            “I have everything through 1499; send 1500 next.”

ACK 1500 — not 1499, and not 'packet 3'. The acknowledgement names the next byte wanted, always.

Cumulative acknowledgementThe acknowledgement number names the next byte the receiver expects, confirming everything before it. If bytes 1000 to 1499 arrive, the receiver sends ACK 1500. One acknowledgement can confirm many segments at once, and the number never goes backwards.Sender transmits 500 bytes starting at 1000bytes 1000 … 1499500 bytes on the wireReceiver repliesACK = 1500“next byte I expect”Not 1499 (the last byte received) and not “packet 3” — the NEXT byte wanted.If the next 500 bytes also arrive, the ACK becomes 2000. It never moves backwards.
ACK 1500 means “I have everything up to and including byte 1499 — send byte 1500 next.” It names a byte, not a packet.

Watch these fields in the lab: tcp.sequenceNumber · tcp.ackNumber · tcp.payload

✓ Concept check — before you open the packets

These test the idea, not the trace. You should be able to answer them from the explanation above.

A sender transmits 200 bytes starting at sequence 3000, then 300 more bytes. What is the sequence number of the second segment, and what ACK does the receiver send after both arrive?

A receiver sends ACK 9000 twice in a row, with no data of its own in between. What does the second one tell the sender?

Now that you understand the concept, observe how it appears in the packet exchange.

The lab runs a real simulated capture — pause, step, click any packet, and inspect every byte.