[e2e] ***28 Acks, TCP Anomaly - Continuation of TCP/TCPDUMP/Why is it happening ?
Kalyan
kalyanramcvs at rediffmail.com
Fri Apr 11 22:16:45 PDT 2003
Oops!! Sorry, my previos mail had an attachment which got rendered
as junk. I apologize.
Greg, Spencer, Yoshifumi, Alok:
Thank you for replying to my query. I was worried because I
thought I really posted something very very stupid.
Greg:
Do you think there is some kind of bug in the Sender's TCP ?
And Thanks, I got why the P is set ...
Spencer:
My tcpdump is over the WAN. I was actually "tcpdump"ing my
browsing sessions (at the client or the receiving side) and I
actually found such sequences repated three times.
My Setup:
My Host: 111.111.11.111(say)
My OS: Redhat Linux 7.2
Destination Host: 222.22.222.222 (say)
Destination OS: No idea. Maybe ,I've got to TBIT and find out
what
flavor of TCP is at the Sender.
Yoshifumi:
I've purposefully removed the options ( I thought they were not
playing any role here). Now I'm attaching the actual file (with
IPs modified though). Please let me know what you think.
I've attached a ascii file which contains the chunk of tcpdump
which might be an anomaly.
Any kind of suggestions, advices, inputs will greatly be
appreciated.
Thanks,
¬Kalyan C
1048542208.980726 222.22.222.222.80 > 111.111.11.111.1326: .
55132:56580(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013
35586078> (DF)
1048542208.980726 222.22.222.222.80 > 111.111.11.111.1326: .
56580:58028(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013
35586078>
1048542208.980726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586097 54510013,nop,nop,sack
sack 1 {56580:58028} >
1048542208.980726 222.22.222.222.80 > 111.111.11.111.1326: .
58028:59476(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013
35586078>
1048542208.980726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586097 54510013,nop,nop,sack
sack 1 {56580:59476} >
1048542208.990726 222.22.222.222.80 > 111.111.11.111.1326: .
59476:60924(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013
35586078>
1048542208.990726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586098 54510013,nop,nop,sack
sack 1 {56580:60924} >
1048542208.990726 222.22.222.222.80 > 111.111.11.111.1326: .
60924:62372(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013
35586078>
1048542208.990726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586098 54510013,nop,nop,sack
sack 1 {56580:62372} >
1048542208.990726 222.22.222.222.80 > 111.111.11.111.1326: .
62372:63820(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013
35586078>
1048542208.990726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586098 54510013,nop,nop,sack
sack 1 {56580:63820} >
1048542208.990726 222.22.222.222.80 > 111.111.11.111.1326: .
63820:65268(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013
35586078>
1048542208.990726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586098 54510013,nop,nop,sack
sack 1 {56580:65268} >
1048542208.990726 222.22.222.222.80 > 111.111.11.111.1326: .
65268:66716(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013
35586078>
1048542208.990726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586098 54510013,nop,nop,sack
sack 1 {56580:66716} >
1048542208.990726 222.22.222.222.80 > 111.111.11.111.1326: .
66716:68164(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013
35586078>
1048542208.990726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586098 54510013,nop,nop,sack
sack 1 {56580:68164} >
1048542208.990726 222.22.222.222.80 > 111.111.11.111.1326: .
68164:69612(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013
35586078>
1048542208.990726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586098 54510013,nop,nop,sack
sack 1 {56580:69612} >
1048542208.990726 222.22.222.222.80 > 111.111.11.111.1326: .
69612:71060(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013
35586078>
1048542208.990726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586098 54510013,nop,nop,sack
sack 1 {56580:71060} >
1048542209.000726 222.22.222.222.80 > 111.111.11.111.1326: .
71060:72508(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013
35586078>
1048542209.000726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586099 54510013,nop,nop,sack
sack 1 {56580:72508} >
1048542209.000726 222.22.222.222.80 > 111.111.11.111.1326: .
72508:73956(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013
35586078>
1048542209.000726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586099 54510013,nop,nop,sack
sack 1 {56580:73956} >
1048542209.140726 222.22.222.222.80 > 111.111.11.111.1326: .
73956:75404(1448) ack 2514 win 64651 <nop,nop,timestamp 54510014
35586095>
1048542209.140726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586113 54510013,nop,nop,sack
sack 1 {56580:75404} >
1048542209.140726 222.22.222.222.80 > 111.111.11.111.1326: .
75404:76852(1448) ack 2514 win 64651 <nop,nop,timestamp 54510014
35586095>
1048542209.140726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586113 54510013,nop,nop,sack
sack 1 {56580:76852} >
1048542209.140726 222.22.222.222.80 > 111.111.11.111.1326: .
76852:78300(1448) ack 2514 win 64651 <nop,nop,timestamp 54510014
35586095>
1048542209.140726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586113 54510013,nop,nop,sack
sack 1 {56580:78300} >
1048542209.140726 222.22.222.222.80 > 111.111.11.111.1326: .
78300:79748(1448) ack 2514 win 64651 <nop,nop,timestamp 54510014
35586096>
1048542209.140726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586113 54510013,nop,nop,sack
sack 1 {56580:79748} >
1048542209.140726 222.22.222.222.80 > 111.111.11.111.1326: .
79748:81196(1448) ack 2514 win 64651 <nop,nop,timestamp 54510014
35586096>
1048542209.140726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586113 54510013,nop,nop,sack
sack 1 {56580:81196} >
1048542209.150726 222.22.222.222.80 > 111.111.11.111.1326: .
81196:82644(1448) ack 2514 win 64651 <nop,nop,timestamp 54510014
35586096>
1048542209.150726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586114 54510013,nop,nop,sack
sack 1 {56580:82644} >
1048542209.170726 222.22.222.222.80 > 111.111.11.111.1326: .
82644:84092(1448) ack 2514 win 64651 <nop,nop,timestamp 54510015
35586096>
1048542209.170726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586116 54510013,nop,nop,sack
sack 1 {56580:84092} >
1048542209.180726 222.22.222.222.80 > 111.111.11.111.1326: .
84092:85540(1448) ack 2514 win 64651 <nop,nop,timestamp 54510015
35586096>
1048542209.180726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586117 54510013,nop,nop,sack
sack 1 {56580:85540} >
1048542209.180726 222.22.222.222.80 > 111.111.11.111.1326: .
85540:86988(1448) ack 2514 win 64651 <nop,nop,timestamp 54510015
35586096>
1048542209.180726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586117 54510013,nop,nop,sack
sack 1 {56580:86988} >
1048542209.180726 222.22.222.222.80 > 111.111.11.111.1326: .
86988:88436(1448) ack 2514 win 64651 <nop,nop,timestamp 54510015
35586096>
1048542209.180726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586117 54510013,nop,nop,sack
sack 1 {56580:88436} >
1048542209.180726 222.22.222.222.80 > 111.111.11.111.1326: .
88436:89884(1448) ack 2514 win 64651 <nop,nop,timestamp 54510015
35586096>
1048542209.180726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586117 54510013,nop,nop,sack
sack 1 {56580:89884} >
1048542209.180726 222.22.222.222.80 > 111.111.11.111.1326: .
89884:91332(1448) ack 2514 win 64651 <nop,nop,timestamp 54510015
35586096>
1048542209.180726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586117 54510013,nop,nop,sack
sack 1 {56580:91332} >
1048542209.180726 222.22.222.222.80 > 111.111.11.111.1326: .
91332:92780(1448) ack 2514 win 64651 <nop,nop,timestamp 54510015
35586096>
1048542209.180726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586117 54510013,nop,nop,sack
sack 1 {56580:92780} >
1048542209.180726 222.22.222.222.80 > 111.111.11.111.1326: .
92780:94228(1448) ack 2514 win 64651 <nop,nop,timestamp 54510015
35586096>
1048542209.180726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586117 54510013,nop,nop,sack
sack 1 {56580:94228} >
1048542209.180726 222.22.222.222.80 > 111.111.11.111.1326: . ack
2514 win 64651 <nop,nop,timestamp 54510015 35586098>
1048542209.180726 222.22.222.222.80 > 111.111.11.111.1326: P
94228:95295(1067) ack 2514 win 64651 <nop,nop,timestamp 54510015
35586096>
1048542209.180726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586117 54510013,nop,nop,sack
sack 1 {56580:95295} >
1048542209.180726 222.22.222.222.80 > 111.111.11.111.1326: .
56568:56580(12) ack 2514 win 64651 <nop,nop,timestamp 54510015
35586098>
1048542209.180726 111.111.11.111.1326 > 222.22.222.222.80: . ack
55132 win 63712 <nop,nop,timestamp 35586117 54510013,nop,nop,sack
sack 1 {56568:95295} >
1048542209.190726 222.22.222.222.80 > 111.111.11.111.1326: .
55132:56568(1436) ack 2514 win 64651 <nop,nop,timestamp 54510015
35586098>
1048542209.190726 222.22.222.222.80 > 111.111.11.111.1326: . ack
2514 win 64651 <nop,nop,timestamp 54510015 35586099>
1048542209.190726 111.111.11.111.1326 > 222.22.222.222.80: . ack
95295 win 30408 <nop,nop,timestamp 35586118 54510015>
1048542209.230726 111.111.11.111.1326 > 222.22.222.222.80: . ack
95295 win 60816 <nop,nop,timestamp 35586122 54510015>
_______________________________________________________________________
Odomos - the only mosquito protection outside 4 walls -
Click here to know more!
http://r.rediff.com/r?http://clients.rediff.com/odomos/Odomos.htm&&odomos&&wn
More information about the end2end-interest
mailing list