- Alice (speaking to Bob): Bob, I have a good joke to tell, can I call you at 12:00 ?
- Bob (turns head towards Alice): OK, fine for me, but can we make it at 13:00 ?
- Alice (nodding): Works for me.
- At 13:00, Alice starts telling a joke.
Did you recognize the three way TCP handshake ?
- Alice: Client
- Bob: Server
- I have a good joke to tell: TCP segment with SYN flag
- 12:00: initial sequence number
- OK: TCP segment with SYN and ACK flag
- 13:00: acknowledgment number (initial sequence number + 1)
- Works for me: TCP segment with ACK flag, acknowledgment of the server acknowledgment
More details on this in https://www.linuxjournal.com/article/6447
tcpdump uses a dot(‘.’) to indicate segments with the ACK flag.