The port fields are two separate 16-bit fields in the TCP header, one for source and another for destination ports. The valid range of values is between 1 and 65535; the use of port 0 is typically a “signature” of some sort. When a source host wishes to connect to a destination host, an ephemeral port is typically selected in the range of ports greater than 1023. For each new sending connection that the host attempts that is not a retry, a different ephemeral port should be selected. | Network Traffic Analysis Using tcpdump Examination of Datagram Fields III Judy Novak Johns Hopkins University Applied Physics Laboratory jhnovak@ 1 All material Copyright Novak 2000 2001. All rights reserved. 1 This page intentionally left blank. TCP Fields 2 2 TCP Header 0 15 16 31 16-bit source port number 16-bit destination port number 32-bit sequence number 32-bit acknowledgement number 4-bit header length reserved 6-bits U R G A C K P S H R S T S Y N F I N 16-bit window size 16-bit checksum 16-bit urgent pointer options if any 20 byt ïs data if any 3 This page intentionally left blank.
