It determines how many octets can be sent before waiting for an acknowledgment.

The Window size is the value of the sliding window.

FIN - Finish, the request to close the TCP session.

SYN - Synchronize, only set when a new TCP session is negotiated during the TCP three-way handshake.

ACK - Acknowledgment of a segment receipt.

The Code bits have a special meaning in session management and in the treatment of segments.

The Acknowledgment Number specifies the next octet expected by the receiver.

The Sequence Number specifies the number of the last octet in a segment.

FTP servers listen on port 21 for FTP client connections. Note: In the Wireshark capture below, the destination port is 21, which is FTP. The combination of the source IP address, source port, destination IP address, and destination port uniquely identifies the session to the sender and receiver.

The values in the range 0–1,023 represent the “well-known ports” and are associated with popular services and applications (as described in RFC 1700), such as Telnet, FTP, and HTTP.

The TCP Destination Port Number is used to identify the upper layer protocol or application on the remote site.

The value is normally a random value above 1,023.

The TCP Source Port Number belongs to the TCP session host that opened a connection.

An explanation of each field is provided for reference: The image above is a TCP datagram diagram. The expanded TCP datagram appears similar to the packet detail pane shown below. Highlight the first TCP datagram from the host computer, and expand the TCP datagram. In Wireshark, detailed TCP information is available in the packet details pane (middle section).

Wireshark filter wildcard