TCP Fundamentals Part 1 // TCP/IP Explained with Wireshark

Let's dig into the Transport Control Protocol with a deep-dive into the fundamentals of TCP/IP. This is an important topic for all network engineers to understand when troubleshooting network problems.
If you liked this video, I’d really appreciate you giving me a like and subscribing, it helps me a whole lot. Also don't be shy, chat it up in the comments!
== More Training from Chris ==
▶Getting Started with Wireshark - bit.ly/udemywireshark
▶Getting Started with Nmap - bit.ly/udemynmap
== Live Wireshark Training ==
▶TCP/IP Deep Dive Analysis with Wireshark - bit.ly/virtualwireshark
== Private Wireshark Training ==
Let's get in touch - packetpioneer.com/product/pri...
Chapters in video:
0:00 Introduction to TCP
6:46 Why Learn TCP?
11:16 Who owns the transport layer?
17:58 The TCP Handshake
31:50 The Receive Window
34:15 TCP Options
55:11 TCP Window Scaling
1:00:22 Case Study #1 - No SACK
1:11:00 Measuring App Response Time
-------------- Trace File Analysis Services / Private Training ----------------------
Got packet problems that you need help digging into?
Want to schedule a private training with Chris for your team?
www.packetpioneer.com/contact

[@alexanderrikmanis8753]

Chris, you are just awesome! Do you have whole your courses available somewhere? Like you mentioned you run a few days classes. I am very keen to watch those recorded - something like what INE (and others) does.

[@ChrisGreer]

Hello Alexander - very happy to hear that the videos are helping you. I have an on-demand training available on Udemy. TCP/IP Deep Dive with Wireshark - bit.ly/udemywireshark Check it out! It's got a ton of hands-on labs, assignments, and ways to practice on your own. I hope you like it.

[@cupajoesir]

He repeats the questions! Good form sir, good form.

[@yashverma3583]

I keep coming back to this video from time to time and I always find something that I missed the last time. Thank you, Chris.

[@ChrisGreer]

Thanks for the comment Yash! I'm glad to hear that the video is helping you. Stay tuned on my Intro to Wireshark course for more TCP stuff.

[@RajivKumar-ee7xv]

Whole world need trainers and teachers like you. You are awesome

[@blackdarth3805]

Stellar public speaking and instruction. Glad I found this channel.

[@ChrisGreer]

Glad you found it!

[@parthamishra09]

I hope you know you're awesome !! The best thing is how you put 'air' into explanations and let the audience take notice of subtle things, ruminate, analyze and really understand. You have covered so many topics in this single session and made sure that everyone remembers/ retains 90% of those (I'm an app-guy and others would retain more than me). Amazing stuff !!

[@ChrisGreer]

thanks for the comment Partha! I appreciate it. Make sure to check out my new Wireshark Masterclass too - kzbin.info/www/bejne/hYaQcmV7orulgbM

[@parthamishra09]

@@ChrisGreer Thanks for that link. I wouldn't miss it for anything.

[@simonp1]

Excellently explained, I know nothing about this but after 1h17mins I can start to see a little of what it’s all about looking forward to the rest of the series

[@NotSoTechish]

Fantastic Chris! Your wait for the packet from layer 7 (1:12:00) was hilarious! You have actually inspired me to learn more on TCP. Thanks for the video.

[@MrHawk407]

Hats off Chris.. Thanks lot for this wonderful presentation.

[@sreenislg]

Can't go to next video, without liking it; Good video Chris, thanks for this basic TCP stuff; lets jump to your next session. Thank you.

[@kapilsonyt]

You are one hell of a expert Sir! I learned what I could not understand even in my years of networking career and in college degree. Thanks very much, appreciated!!!!!!

[@narendrakumar1987inn]

This is fantastic stuff. Very helpful. Thank you!

[@shivanimakwana2002]

Nice presentation,I like the way your are explaining things in a simple way & Very informative video.Thank you so much

[@TristanSchleining]

This was SUCH a good video! I think your teaching style is excellent. Thank you for making this available.

[@ChrisGreer]

Thank you for the comment Tristan!

[@ankitsharma-ef3cs]

Why is that only this much likes and comments for this video. It should be in Millions/Billion. Lots of Love from India....Ur awesome!😍

[@JDBoelter]

I feel as if I hit the motherlode of TCP and Wireshark knowledge with this presentation. Thanks, Chris!

[@ChrisGreer]

James Boelter thanks for the comment!

[@cottondai]

such a fantastic teacher and such insights into the TCP packets. I watched a 5 hour course on Wireshark from another teacher and watching this video I realized I am finally learning what the 3 way handshake is. This teacher should educate all network administrators and cyber security personnel.

[@ChrisGreer]

Thanks for the comment! Glad the video helped.

[@wojciechnowakowski1803]

Absolutely fantastic explanation. Thank you!

[@innuite]

Why is that only 1.5K likes for this video. It should be in Millions!! ...and he repeats the questions clearly to answer..

[@ChrisGreer]

Thanks for the comment Arun!

[@albertos6503]

Impressive style & content. Thanks so much for sharing this

[@Kruskall]

Great, Thanks for sharing Chris... Love your enthusiasm, and the your joy of teaching the subject. Good Job!

[@ChrisGreer]

Thanks for the comment Michael!

[@zarar1941]

Chris, I have learned a lot from you in this video that I have not learned in last 10 years. thanks

[@lorenzopreston]

I love this video, I wish I had it during my Computer and Network Security course last semester. Thanks for sharing.

[@ayyapanr]

How can someone not love this guy!

[@PatrickLangendoen]

Informative and brought in a very nice way. I'm excited to see part 2. Are you gonna share that second part here on KZbin as well?

[@edsonrocks]

It was an incredible session Chris, thank you for the great explanations and good humour.

[@ChrisGreer]

Glad you enjoyed it!

[@PaulOfford]

Typical great presentation from Chris. The guy is a consummate professional.

[@johnnybegood8049]

That's some real good stuff. Thanks for sharing!

[@acostamanuel2011]

Stopped and liked the video because it has been one of the best and informative video of how TCP works in Wireshark.

[@ChrisGreer]

Thanks for the comment and for watching Manuel! Glad it helped you. Hope you like the rest of the content on the channel too.

What awesome video, 10 years as network guy and now I'll make sure that I'll understand TCP, Thanks @ChrisGreer

[@ChrisGreer]

Best to your TCP journey!

[@o4bfr]

Very good video. Thanx Mr Chris.

[@danonmily]

Terrific presentation! Very insightful

[@perspectivesmatter7440]

this was a brilliant hands-on example Chris. In additional to clearly explain how TCP works and why handshakes are always so important, you have humoursly also explained why application guys and network guys keep bickering over latency issues. I am from application team and this video has enhanced my troubleshooting skills. Thank you so much for posting this!

[@ChrisGreer]

Thanks for the comment! I really appreciate the feedback.

[@abelardomartinez3711]

Chris, eres el mejor. Apenas empiezo y entendí !!! gracias

[@sachs8379]

Man Chris, you just nail it with expressions, easier to remember, thanks a lot!

[@ChrisGreer]

Thanks for the comment!

[@anshukhanna6041]

Brilliant video. Please post the next part as well.

[@jasperbongertz4866]

Hi Chris, great intro into TCP, I'll recommend it to anyone who asks me about TCP beginner talks ;-) But I think there's a small error at 1:01:17 - missing SACK options does not mean there are no fast retransmissions possible. The triple dup ack mechanism works without SACK, but it may lead to full retransmits from the gap. There are three flavors of retransmissions: time out based, fast retransmission triggered by triple duplicate ack, and SACK (which in turn doesn't even need a triple duplicate ack to signal loss)

[@ChrisGreer]

Thanks for the comment Jasper - I hadn't seen a stack not have the option but still do fast retrans yet. But hey if it's out there I want to be correct about it!

[@manangandhi8338]

Chris Super explanation of TCP. More window Size to you..... I have seen lot of videos for tcp but this one contains all of it most the part i would recommend everyone to watch this video instead of shuffling through the youtube bits and bytes of other tcp video

[@TalkingMisc]

Thanks a lot for informative & detailed session.

[@pmaurin]

This is one of the best talks on networking I've seen. If you have part 2 available, it would be awesome to see it. Thank you for sharing.

[@ChrisGreer]

Thank you for the comment Pablo - I will post round two soon!

[@vishalgudhka4383]

Hi Chris - Thank you for such an awesome video. Informative, Easy to understand and remember.

[@ChrisGreer]

Thank you for the kind feedback Vishal!

[@khulekani_ndlovu]

Your courses on plural sight are the best. I've done other tutors' courses on plural sight and linked in learning which left me a bit confused since they hit the surface without much explanation. I just finished your "foundational TCP analysis with wireshark" course which is clear and the orderly step by step layout makes it easy to understand. Great job👌👌

[@ChrisGreer]

Thank you so much for taking the time to comment and give feedback. I really appreciate it.

[@lalosalamanca7131]

David Bombal just sent me here. I thought I knew TCP/IP, apparently nope. Good content Chris.

[@ChrisGreer]

Awesome Andy! Great to have you on the channel. Thank you for stopping by.

[@ChintakindiManohar]

You inspired me to learn more in depth TCP/IP

[@billlawhorn3285]

Thanks so much Chris for sharing your expertise.

[@ChrisGreer]

Glad it was helpful!

[@samar103]

This was awesome!!!

[@i_tsyg2531]

Excellent! Just wow!!

[@yuriy8149]

Super explanation. Thank you Chris!

[@ChrisGreer]

Glad it was helpful! Thank you!

[@kallikantzaros]

I have learned so much from this video in just one hour. 'Explain me like I'm five' at its best. Thank you so much.

[@ChrisGreer]

That is how I have to learn everything - like I am five! 😜

[@vinhphung]

Thanks for such helpful videos. You are awesome!

[@samirshaikh52]

Hi Chris, Very informative video on TCP. Learned a lot. Thank you very much.

[@ChrisGreer]

Great Samir, Thanks for watching and for the comment. I'll post round 2 soon.

[@yongkangchia1993]

Great speech! Enjoyable even for a begineer like me

[@miladnouri9537]

Im not a native english and im not even so good in english but all these hard stuff with your teaching style, is so understandable. Thanks and i wish best for you.

[@ChrisGreer]

Thank you!

[@scrummyvision]

extremely helpful videos, love your passion for packets!

[@ChrisGreer]

Glad you like them!

[@franchise2570]

Thank you Chris for this video, you're a great teacher. Your explanation of waiting on Layer 7 traffic to fall down to Layer 4 on the server side was hilarious. 😂

[@ChrisGreer]

Thank you! I'm really glad you liked it! Please feel free to share...

[@hellodarknessmyoldfren]

Nice. Also, dropping a link to pcaps you're using so we can follow by step-to-step in a video description would've been super cool.

[@arnavgundewar3619]

Thanks for the help.

[@lucidboi5334]

What a great speaker!

[@sandeepaher5107]

Bravo .. buddy you nailed it ... content to your style of explaining.. loved it all..... :)

[@ChrisGreer]

Thanks for the comment Sandeep! Glad the video helps.

[@jairunet]

Hello @Chris thanks for posting this great presentation, I learn something new and very interesting with each of your talks. Would you be able to point me to where I can learn to build profiles? I am basically used to using tcpdump in Linux but will be great to use wireshark as another tool to analyze the packets, and I believe that having the filters, colors and profiles set for each situation will optimize troubleshooting a lot and make it easier for other teams and management to have a better view and at least a bit of understanding on what they are seeing. Thank you very much in advance.

[@mayurhabbu7361]

Chris, fantastic presentation . I really learned a lot .

[@ChrisGreer]

Glad it was helpful!

[@manigandansrinivasan5194]

I guess you don't know how Noble work you are doing .... I really appreciate the effort you put in to learn weeds of TCP and importantly sharing your knowledge..... God Bless .Keep going

[@ChrisGreer]

Thank you so much for the comment. I appreciate it!

[@innbydelse]

excellent presentation!

[@chetandurgavale5623]

What a lecture! Simply Amazing

[@ChrisGreer]

Thanks for the good vibes!

[@joelourenco4621]

Very good! Thank you.

[@TruthYouNeed]

Chris. Thank You for this.

[@ChrisGreer]

My pleasure!

[@rasb421]

Very knowledgeable..Appreciate in sharing the knowledge

[@ChrisGreer]

Glad you like it!

[@lokesh20verma]

Hi Chris, Very nice presentation.. When you can share part-2?

[@olivier7593]

Im in the first few hours of learning to how to become a pen tester. If im honsest, this tcp thing looks relatively easy. I'm mostly worried about the command's i have to remember. A whole new language. Including phyton. But this is super interesting. Do you have tips and tricks, I've get what ipv4/ipv6, subnetting what a /20 a /24 network is. And how and why it's different, and what routing is, what a gre and ipsec tunnels is. What an handshake is, and what the window sizes and the multiplier is, The package size. I'm curious how to continue. Looking forward to learn way more about networking, testing kali, linux, understanding and writing code, discovering that I don't understand anything of this. And learning to understand. Love this journey so far... Thank you for this video and the collaborations you did with david bombal, and many others... Cheers!

[@mariamfirdous8456]

oh gosh this is wonderful. clear out many things. working in ISP receiving client complaints how their replication cant be done cause they cant see full throughput. i wish i can send them this video to learn how network work and before blaming their ISP they need to check wats going on with their application.

[@ChrisGreer]

Great to hear you enjoyed the video! Yes please send it to whoever may benefit. Yeah I bet you get blamed for quite a bit that is not your fault!

[@GCS1]

Fantastic teacher awesome session. Thanks.

[@ChrisGreer]

Thank you!

[@KanekiSidibe]

This presentation is awesome. I wished you could teach me that in my class lecture

[@vbp2610]

thanks chris... well explained ....

[@ChrisGreer]

Glad it was helpful!

[@453nabeel]

Amazing Chris. This is brilliant. Really Geek stuff

[@ChrisGreer]

Thanks Nabeel - I try by best to geek-out but still not be boring!

[@453nabeel]

@@ChrisGreer Sir is it possible we could have more from you about traces , case studies etc. Do u have any training course ?

[@ChrisGreer]

@@453nabeel Yes sir! of course. I do have more training - remote, onsite, or on-demand. If you are interested in more please shoot me an email at [e-mail] or contact me through my website - www.packetpioneer.com. I'm happy to work with you to help you meet your Wireshark goals.

[@SantoshSharma]

Hi Chris, nowadays i am watching lot of videos on wireshark. but your approach of understanding is unique. I really appreciate if you could please assist me on below. I was reported issue, where application team was facing duplicate transaction issue. and i was contacted to see if network is causing any issue. 4 servers are involved in this and i have taken wireshark capture on all 4 servers. but it is using SSL protocol which is encrypted. so as per my thinking i think we cannot come to know if duplication is happening by looking to TCP\IP packet only. could you please suggest me if it is possible.

[@CT-zq3kz]

Excellent method of teaching

[@ChrisGreer]

Thank you for the comment!

[@georgesanderson918]

I cannot thank you more!

[@user-ex2zb5mo5c]

Hi Chris, Is there possible to find the devices surrounding me, like the camera, router, and other stuff via monitor mode?

[@jhonycash6119]

really nice conference! very helpful

[@ChrisGreer]

Glad it was helpful!

[@patrickborys3490]

Awsome !!!!! Thank you !!!!

[@ChrisGreer]

You're welcome!

[@romualdgarcia9108]

merci beaucoup !

[@horaciosantana2153]

Awesome Chris, can you do a modbus analysis? It would be great

[@deepakpanwar6629]

It's great presentation..I appreciate it.. Had a question can window scale be -1.

[@deepakpanwar6629]

Oops I got the ans....thanks..

[@xtra9996]

Hey Chris, great video. In your last case study a router diminished the MMS which caused latency on the network. To realize that you did a scan on the server side. Is there a way to spot this kind of problems when you only got a client scan?

[@ChrisGreer]

Hello Xtra999. In this case, not really - I needed to see how the SYN was leaving the server and how it was arriving at the client. I suppose you could infer that it was an MSS problem by the TCP behavior, but that is something you probably would need experience in looking for. Thanks for the comment.

[@rohscx]

Good stuff. Thanks

[@ChrisGreer]

Glad you enjoyed it!

[@ramonnepomuceno5299]

great talk!

[@parveshtaneja2005]

Very good explanation Sir

[@ChrisGreer]

Thanks Parvesh! I appreciate the comment.

[@filipersimoes]

Awesome!!!

[@sridharnr1]

Awesome video

[@imransyed8766]

He is Very good instructor !!!

[@ChrisGreer]

Thanks for the comment @imran! Glad it helped you.

[@imransyed8766]

@@ChrisGreer clarity in explaning concept was too good. Have a great day !!

[@olmikify]

thank you

[@drmanhattan225]

Just bought your Udemy course Chris. Would you recommend for a network engineer to try work through that Stevens book TCP/IP Illustrated vol 1? Thanks

[@SantoshSharma]

@1:10:54 you said after http get from client . server sent ACK only acknwldg previous sent data but not sending any other data, that is perfectly fine. But i have one doubt. you said if that ack is not received to client then it will re-transmit. i think client will not re-transmit. TCP-keep alive message should go in that case.

[@manasacharya4554]

Chris you are awesome. Can you please upload the packet capture?

[@yuvarajthirunavukkarasu4932]

great video

[@MandarDesai1919]

Superb video

[@franciscodeighton3223]

First I thought "Over an hour, that's long...". Now I think "Could have been longer!!!" :-) :-) :-) Awesome presentation. Motivates to dig in! Many thanks!!! :-)

[@ChrisGreer]

Thanks for the comment Francisco! I appreciate it.

[@shyamyadav-xd4zl]

superb!!

[@abhivats5027]

Hi @chris, Can router change the MSS in between ?

[@ChrisGreer]

Yes! Look into MSS clamping.

[@abhivats5027]

@@ChrisGreer Thank you for the response. But I am wondering will router do a layer 4 lookup for a transit traffic and rewrite the TCP header fields as it is just supposed to do a destination IP lookup ?

[@damanv3493]

Thnks Chris