Analysis of TCP Connection Initiation Using Wireshark

Analysis of TCP Connection Initiation Under Different Traffic Conditions Using Wireshark

▪️INTRODUCTION:

Every time you open a website, stream a video, or send a message online, something happens before any actual data moves — a handshake. A silent, structured agreement between two machines that says: "I want to talk. Are you ready?" This handshake is the foundation of TCP — the Transmission Control Protocol — and understanding how it behaves under pressure is central to understanding real-world network performance.

This experiment explores that exact question. How does TCP connection initiation change as network traffic increases? What can a rising SYN packet count tell us about network load? And at what point does the network begin to show signs of stress?

To answer these questions, traffic was generated under four controlled conditions — low, normal, medium, and high — using hping3 on Ubuntu (WSL). Each traffic level was captured and analyzed in Wireshark, with a specific focus on TCP SYN, SYN-ACK, and ACK packets across twenty graphs. The goal was not just to watch packets — it was to measure and interpret how TCP connection initiation scales with increasing load.

▪️OBJECTIVES:

To understand the mechanics of TCP connection initiation using the three-way handshake model

To generate controlled traffic at four distinct levels using hping3

To capture and analyze TCP packets using Wireshark's display filters and I/O graph tools

To measure TCP SYN packet rate as a proxy for connection initiation intensity

To observe how SYN, SYN-ACK, and ACK behavior changes across traffic levels

To identify signs of network stress under high traffic conditions 

▪️ARCHITECTURE DIAGRAM:

▪️TOOLS USED:

Tool	Purpose
Wireshark	Packet capture and traffic analysis
Ubuntu (WSL)	Linux environment for command execution
hping3	TCP SYN packet generation at controlled rates

---

▪️NETWORK PARAMETER:

The chosen network parameter is TCP connection initiation, measured through TCP SYN packet rate.

Every new TCP connection begins with a SYN packet. By counting and graphing SYN packets over time, we get a direct, quantifiable measure of how many connections are being initiated per second — which is precisely what changes across traffic levels.

▪️PROCEDURE:

Step 1 — Environment Setup

Wireshark was launched on the host machine with the correct network interface selected. Packet capture was started before each hping3 command to ensure no traffic was missed.

Step 2 — Traffic Generation Using hping3

Four traffic levels were generated using the following commands:

Low Traffic

sudo hping3 -S -p 80 -c 3 -i u300000 --fast 8.8.8.8

Three SYN packets sent with a 300ms interval — simulating a nearly idle network.

Normal Traffic

sudo hping3 -S -p 80 -c 10 -i u500000 --fast 8.8.8.8

Ten SYN packets at a 500ms interval — representing moderate background activity.

Medium Traffic

sudo hping3 -S -p 80 -c 30 -i u300000 --fast 8.8.8.8

Thirty SYN packets at 300ms intervals — representing elevated load with multiple concurrent connections.

High Traffic

sudo hping3 -S -p 80 -c 80 -i u150000 --fast 8.8.8.8

Eighty SYN packets at 150ms intervals — representing heavy simultaneous connection activity.

The flags used:

• -S — sets the SYN flag
• -p 80 — targets port 80 (HTTP)
• -c — controls packet count
• -i u[value] — sets interval in microseconds
• --fast — enables fast sending mode

Step 3 — Capture and Filter in Wireshark

Each traffic level was captured separately and saved. The following display filters were applied:

Filter	Purpose
tcp.flags.syn == 1 && tcp.flags.ack == 0	Isolates SYN packets
tcp.flags.syn == 1 && tcp.flags.ack == 1	Isolates SYN-ACK packets
tcp.flags.ack == 1 && tcp.flags.syn == 0	Isolates ACK packets
tcp	All TCP traffic

Step 4 — I/O Graph Analysis

Wireshark's I/O Graph tool (Statistics → I/O Graphs) was used to visualize packet rates over time. Separate graphs were generated for SYN, SYN-ACK, ACK, total TCP, and overlay (all three combined).

▪️RESULTS & ANALYSIS:

Section 1 — Low Traffic

1. TCP Connection Initiation under Low Traffic

Under low traffic conditions, TCP connection initiation was analyzed using SYN packets, which represent the start of a TCP session. A very small number of SYN packets were generated using hping3, resulting in minimal connection attempts. The I/O graph shows that the SYN packet rate remains extremely low, indicating that only a few connections were initiated. This reflects a stable and idle network environment.

Figure 1 — TCP SYN packet rate under low traffic
The I/O graph shows an extremely sparse SYN packet distribution, with near-zero activity across the time axis. Only isolated spikes are visible, corresponding to the three manually sent SYN packets. The y-axis remains close to zero throughout, confirming minimal connection initiation.

2. SYN-ACK Response under Low Traffic

SYN-ACK packets represent the server’s response to connection initiation. Under low traffic, the SYN-ACK packets closely match the SYN packets, indicating that each request is responded to immediately. The absence of delay or mismatch between SYN and SYN-ACK confirms that the network is operating smoothly.

Figure 2 — SYN-ACK response rate under low traffic
The graph shows SYN-ACK packets appearing in close temporal alignment with the SYN packets. The pattern is clean and immediate — no gaps, no delays. Each SYN is matched by a SYN-ACK, indicating smooth server responsiveness.

3. ACK Packet Behavior under Low Traffic

ACK packets are used to complete the handshake and acknowledge further communication. Even under low traffic, ACK packets appear slightly more than SYN packets because they continue beyond connection setup. This indicates that once connections are established, communication continues for a short duration.

Figure 3 — ACK packet distribution under low traffic
ACK packets appear slightly after the SYN/SYN-ACK exchange, and their count is marginally higher than the SYN count. This extension beyond the initial handshake indicates brief post-connection communication even after the session is established.

4. Overall TCP Activity under Low Traffic

The overall TCP activity remains minimal under low traffic conditions. The graph shows no significant spikes or irregular patterns, indicating that only a limited number of packets are being transmitted. This confirms that the network is operating under very low load.

Figure 4 — Total TCP packet activity under low traffic
The graph shows a uniform, nearly flat baseline with minimal variation. No burst patterns or irregular spikes are visible. The total packet count is low, consistent with the small number of packets generated.

5. TCP Handshake Visualization under Low Traffic

The overlay graph combining SYN, SYN-ACK, and ACK packets clearly shows the TCP handshake process. SYN and SYN-ACK packets overlap closely, while ACK packets extend slightly further in time. This demonstrates that connection setup is immediate and communication continues briefly after establishment.

Figure 5 — SYN, SYN-ACK, and ACK overlay under low traffic
The overlay clearly shows three distinct packet phases. SYN and SYN-ACK packets appear in tight synchrony, followed by a brief ACK trail. The spacing between events reflects the 300ms intervals set by hping3.

Section 2 — Normal Traffic

6. TCP Connection Initiation under Normal Traffic

Under normal traffic conditions, the number of SYN packets increases compared to low traffic. This indicates a higher rate of TCP connection initiation. The graph shows more frequent connection attempts, representing typical user-level activity such as browsing or background application communication.

Figure 6 — TCP SYN packet rate under normal traffic
Compared to low traffic, the SYN rate shows a visible increase. Multiple spikes are now observable on the I/O graph, spread across a wider time window. The baseline is no longer flat — there is consistent activity throughout the capture period.

7. SYN-ACK Response under Normal Traffic

The SYN-ACK packets continue to follow SYN packets closely under normal traffic. This indicates that the server is capable of handling the increased number of requests efficiently. The response remains consistent, showing that the network is still stable under moderate load.

Figure 7 — SYN-ACK response rate under normal traffic
SYN-ACK packets continue to track closely with SYN packets. The increase in volume is proportional, and there is no visible delay or mismatch between the two series.

8. ACK Packet Behavior under Normal Traffic

ACK packets increase significantly under normal traffic compared to low traffic. This indicates that more connections are being established and maintained simultaneously. The higher ACK count reflects ongoing communication across multiple TCP sessions.

Figure 8 — ACK packet count under normal traffic
ACK packets are noticeably more frequent than in the low traffic scenario. The graph shows more extended activity beyond the SYN-ACK phase, suggesting that the established connections are remaining active longer.

9. Overall TCP Activity under Normal Traffic

The total TCP packet activity increases under normal traffic conditions. The graph shows a higher baseline compared to low traffic, indicating increased network usage. This reflects a realistic network state where multiple applications or services are active.

Figure 9 — Total TCP traffic under normal traffic
The total packet count and baseline activity are both higher than low traffic. The graph shows a slightly elevated and sustained activity level, with no spikes severe enough to suggest stress.

10. TCP Handshake Visualization under Normal Traffic

The overlay graph shows a clear increase in SYN, SYN-ACK, and ACK packet density. While SYN and SYN-ACK still overlap, ACK packets extend further and appear more frequently. This indicates that connections are not only being initiated but also actively maintained.

Figure 10 — SYN, SYN-ACK, and ACK overlay under normal traffic
The overlay shows a denser clustering of events compared to the low traffic overlay. All three packet types are more frequent, and ACK packets now form a clearly extended trail beyond the handshake phase.

Section 3 — Medium Traffic

11. TCP Connection Initiation under Medium Traffic

Under medium traffic, the SYN packet rate increases significantly, showing frequent connection initiation within short intervals. This indicates that multiple TCP connections are being initiated in quick succession, reflecting a higher network load.

Figure 11 — TCP SYN packet rate under medium traffic
The SYN rate shows a significant jump from normal traffic. The I/O graph has a higher baseline, with visible clusters of SYN activity that indicate multiple connections being initiated in quick succession.

12. SYN-ACK Response under Medium Traffic

SYN-ACK packets continue to overlap with SYN packets under medium traffic, showing that the server is still responding effectively. However, the increased packet density reflects higher communication intensity and more simultaneous connections.

Figure 12 — SYN-ACK response under medium traffic
SYN-ACK packets continue to overlap with SYN packets, but the density is higher. The visual clustering of responses reflects the increased number of simultaneous connection requests being handled.

13. ACK Packet Behavior under Medium Traffic

ACK packets become highly frequent under medium traffic conditions. This indicates that many TCP sessions are active at the same time, leading to continuous acknowledgment of data. The increased ACK rate reflects sustained communication rather than just connection setup.

Figure 13 — ACK frequency under medium traffic
ACK packets are now highly frequent. The graph shows a near-continuous stream of acknowledgments, indicating that multiple TCP sessions are simultaneously active and exchanging data.

14. TCP Analysis and Network Stress under Medium Traffic

Under medium traffic, initial signs of TCP control activity may appear, such as retransmissions or minor irregularities. These indicate that the network is beginning to experience slight stress due to increased load, although it still operates efficiently.

Figure 14 — TCP control activity and stress indicators under medium traffic
The graph begins to show subtle irregularities — slight variations in inter-packet timing that may correspond to early retransmission activity or minor queuing. The overall shape remains active but not erratic.

15. TCP Handshake Visualization under Medium Traffic

The overlay graph shows dense clustering of SYN, SYN-ACK, and ACK packets. This clearly represents multiple concurrent TCP sessions. The close overlap between SYN and SYN-ACK confirms responsiveness, while the extended ACK behavior indicates continuous communication.

Figure 15 — SYN, SYN-ACK, and ACK overlay under medium traffic
The overlay shows dense, overlapping bursts across all three packet types. SYN and SYN-ACK remain tightly coupled, while ACK packets now form a dense, sustained layer that extends throughout the capture window.

Section 4 — High Traffic

16. TCP Connection Initiation under High Traffic

Under high traffic conditions, the SYN packet rate reaches its highest level. The graph shows a dense burst of connection attempts within a short time period. This reflects a heavily loaded network with many simultaneous connection requests.

Figure 16 — TCP SYN packet rate under high traffic
The SYN rate reaches its peak. The I/O graph shows a dense burst of SYN packets compressed into a short time window, with the highest y-axis values observed across all four traffic conditions.

17. SYN-ACK Response under High Traffic

Despite the high number of connection requests, SYN-ACK packets continue to follow SYN packets closely. This indicates that the server is still able to respond to incoming requests, although the density suggests a high level of activity.

Figure 17 — SYN-ACK density under high traffic
Despite the high volume of incoming SYN packets, SYN-ACK responses continue to track them closely. The overlap between SYN and SYN-ACK peaks is maintained, but the density of the graph is significantly higher than all previous traffic levels.

18. ACK Packet Behavior under High Traffic

ACK packets show the highest density under high traffic. This indicates that multiple TCP connections are active simultaneously, and continuous acknowledgment is taking place. The increased ACK rate reflects heavy communication and sustained data exchange.

Figure 18 — ACK packet density under high traffic
ACK packets show the highest density of any traffic condition. The graph is near-continuous, with little visible gap between acknowledgment events. This reflects the large number of simultaneously active TCP sessions.

19. TCP Analysis and Network Stress under High Traffic

Under high traffic conditions, TCP analysis flags become more visible. This includes retransmissions or control-level irregularities, indicating that the network is experiencing stress due to high load. These patterns reflect the limits of network stability under heavy usage.

Figure 19 — TCP stress indicators under high traffic
The graph shows visible signs of TCP control activity — possible retransmissions, irregular spacing between packets, and pattern variations that suggest the network is operating near its stable threshold. The overall traffic volume is significantly elevated compared to all previous conditions.

20. TCP Handshake Visualization under High Traffic

The overlay graph shows a highly dense overlap of SYN, SYN-ACK, and ACK packets. This represents multiple concurrent TCP connections and continuous communication. The graph clearly demonstrates how connection initiation and data exchange scale under heavy traffic conditions.

Figure 20 — Full TCP handshake overlay under high traffic
The overlay shows the densest clustering of all four conditions. SYN, SYN-ACK, and ACK packets form a tightly woven visual mass, with all three series peaking simultaneously. The graph clearly demonstrates the cumulative effect of high-volume, concurrent TCP connection activity.

▪️FINDINGS AND RECOMMENDATIONS:

Across all four traffic levels, SYN packet rate scaled directly and proportionally with traffic intensity, confirming it as a reliable indicator of connection initiation load. SYN-ACK packets tracked SYN packets closely at every level, indicating that the server remained responsive throughout. ACK packet density grew faster than SYN density at higher loads, reflecting the volume of sustained concurrent sessions beyond just the handshake phase. Medium and high traffic conditions revealed early signs of TCP's self-regulating mechanisms — retransmissions and timing irregularities — which are expected protocol behaviors under load, not failures. For future work, it is recommended to extend this experiment to include throughput and latency measurements alongside SYN rate, to build a more complete picture of network behavior under increasing load, and to test against a real server rather than a public IP to observe full handshake completion rates.

▪️INFERENCES:

• TCP connection initiation rate is directly measurable through SYN packet frequency — this is a practical method for network load assessment
• A healthy network shows a 1:1 or near-1:1 correspondence between SYN and SYN-ACK packets — any divergence would signal server-side issues
• ACK packet density is a useful secondary indicator of sustained communication intensity, beyond just connection setup
• Under high traffic, TCP's self-regulating mechanisms (retransmission, flow control) begin to activate — the protocol is designed to handle this, but it adds overhead
• Controlled experiments using hping3 allow reproducible traffic generation that would be impossible to achieve by simply opening browser tabs

▪️AI USAGE:

AI tools were used during the preparation of this blog to assist with structuring explanations and refining the narrative of the analysis. All experimental work — traffic generation, packet capture, Wireshark analysis, and graph interpretation — was performed independently. AI assistance was used for documentation and writing quality, not for the technical execution of the experiment.

▪️CONCLUSION:

This experiment set out to understand how TCP connection initiation behaves as network traffic increases — and the results are clear. As traffic grows from low to high, SYN packet rate rises proportionally, SYN-ACK responses maintain their coupling with incoming requests, and ACK packet density surges to reflect the volume of active sessions.

The most important takeaway is that TCP connection initiation is not a fixed, background process — it is a dynamic indicator of network load. Measuring SYN packet rate with tools like Wireshark gives a real, quantifiable window into how hard a network is working at any given moment.

Beyond the graphs, this experiment reinforces something fundamental about TCP as a protocol — it is designed to absorb pressure gracefully. Even at the highest traffic level tested, the three-way handshake continued to function, and connections continued to be established. The stress indicators that appeared at medium and high traffic are not failures — they are TCP doing its job.

▪️YOUTUBE LINK: https://www.youtube.com/watch?v=dyhjwDfpKII

▪️GITHUB LINK: https://github.com/Diksha Sh/TCP_ANALYSIS

▪️BACKGROUND & REFERENCES:

TCP (Transmission Control Protocol) is a connection-oriented protocol defined in RFC 793 by the IETF. It guarantees reliable, ordered, and error-checked delivery of data between applications. Before any data transfer, TCP requires a three-way handshake:

1. SYN — The client sends a synchronize segment to initiate the connection
2. SYN-ACK — The server responds, acknowledging the request
3. ACK — The client confirms, completing the handshake

This process is fundamental to understanding connection behavior. Every new TCP session begins here, which is why monitoring SYN packets gives a direct measurement of connection initiation rate.

Wireshark, the tool used for packet capture and analysis, is an open-source network protocol analyzer widely used in academia and industry for traffic inspection, debugging, and network forensics.

References used:

• Forouzan, B. A. (2022). Data Communications and Networking (5th ed.). McGraw-Hill. — foundational TCP/IP theory

• Wireshark Foundation. Wireshark User's Guide. https://www.wireshark.org/docs/wsug_html_chunked/

• Postel, J. (1981). Transmission Control Protocol — RFC 793. IETF. https://www.rfc-editor.org/rfc/rfc793

• hping3 Manual Page. http://www.hping.org/manpage.html

• Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. — used for TCP behavior under load

• Chappell, L. (2012). Wireshark Network Analysis. Laura Chappell University. https://www.chappell-university.com/

▪️ACKNOWLEDGEMENT

School of Computer Science and Engineering (SCOPE), Vellore Institute of Technology Chennai, for offering the theory and lab courses with an industry-standard syllabus that made this kind of hands-on analysis possible.

Dr. T. Subbulakshmi, Professor, SCOPE, VIT Chennai, for her consistent guidance, detailed feedback, and high standards that pushed this work to be thorough and well-documented.

Gerald Comb, founder of Wireshark and ACM Software System Award winner (2018), for creating and maintaining a tool that makes deep packet-level network analysis accessible to students and professionals alike.

My peers, for discussions on traffic generation approaches and Wireshark filter techniques that helped refine the methodology used in this experiment.

My parents, for their encouragement and support throughout this semester.

▪️ AUTHOR

Ms. Diksha Sharma, II year B.Tech. CSE student, School of Computer Science and Engineering, VIT Chennai