[e2e] ***28 Acks, TCP Anomaly - Continuation of TCP/TCPDUMP/Why is it happening ?

Kalyan kalyanramcvs at rediffmail.com
Fri Apr 11 22:16:45 PDT 2003


Oops!! Sorry, my previos mail had an attachment which got rendered 
as junk. I apologize.

Greg, Spencer, Yoshifumi, Alok:

Thank you for replying to my query. I was worried because I
thought I really posted something very very stupid.

Greg:
Do you think there is some kind of bug in the Sender's TCP ?
And Thanks, I got why the P is set ...

Spencer:
My tcpdump is over the WAN. I was actually "tcpdump"ing my
browsing sessions (at the client or the receiving side)  and I
actually found such sequences repated three times.

My Setup:
My Host: 111.111.11.111(say)
My OS: Redhat Linux 7.2

Destination Host: 222.22.222.222 (say)
Destination OS: No idea. Maybe ,I've got to TBIT and find out 
what
flavor of TCP is at the Sender.

Yoshifumi:
I've purposefully removed the options ( I thought they were not
playing any role here). Now I'm attaching the actual file (with
IPs modified though). Please let me know what you think.

I've attached a ascii file which contains the chunk of tcpdump
which might be an anomaly.
Any kind of suggestions, advices, inputs will greatly be
appreciated.

Thanks,
¬Kalyan C

1048542208.980726 222.22.222.222.80 > 111.111.11.111.1326: . 
55132:56580(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013 
35586078> (DF)
1048542208.980726 222.22.222.222.80 > 111.111.11.111.1326: . 
56580:58028(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013 
35586078>
1048542208.980726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586097 54510013,nop,nop,sack 
sack 1 {56580:58028} >
1048542208.980726 222.22.222.222.80 > 111.111.11.111.1326: . 
58028:59476(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013 
35586078>
1048542208.980726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586097 54510013,nop,nop,sack 
sack 1 {56580:59476} >
1048542208.990726 222.22.222.222.80 > 111.111.11.111.1326: . 
59476:60924(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013 
35586078>
1048542208.990726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586098 54510013,nop,nop,sack 
sack 1 {56580:60924} >
1048542208.990726 222.22.222.222.80 > 111.111.11.111.1326: . 
60924:62372(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013 
35586078>
1048542208.990726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586098 54510013,nop,nop,sack 
sack 1 {56580:62372} >
1048542208.990726 222.22.222.222.80 > 111.111.11.111.1326: . 
62372:63820(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013 
35586078>
1048542208.990726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586098 54510013,nop,nop,sack 
sack 1 {56580:63820} >
1048542208.990726 222.22.222.222.80 > 111.111.11.111.1326: . 
63820:65268(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013 
35586078>
1048542208.990726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586098 54510013,nop,nop,sack 
sack 1 {56580:65268} >
1048542208.990726 222.22.222.222.80 > 111.111.11.111.1326: . 
65268:66716(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013 
35586078>
1048542208.990726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586098 54510013,nop,nop,sack 
sack 1 {56580:66716} >
1048542208.990726 222.22.222.222.80 > 111.111.11.111.1326: . 
66716:68164(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013 
35586078>
1048542208.990726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586098 54510013,nop,nop,sack 
sack 1 {56580:68164} >
1048542208.990726 222.22.222.222.80 > 111.111.11.111.1326: . 
68164:69612(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013 
35586078>
1048542208.990726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586098 54510013,nop,nop,sack 
sack 1 {56580:69612} >
1048542208.990726 222.22.222.222.80 > 111.111.11.111.1326: . 
69612:71060(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013 
35586078>
1048542208.990726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586098 54510013,nop,nop,sack 
sack 1 {56580:71060} >
1048542209.000726 222.22.222.222.80 > 111.111.11.111.1326: . 
71060:72508(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013 
35586078>
1048542209.000726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586099 54510013,nop,nop,sack 
sack 1 {56580:72508} >
1048542209.000726 222.22.222.222.80 > 111.111.11.111.1326: . 
72508:73956(1448) ack 2514 win 64651 <nop,nop,timestamp 54510013 
35586078>
1048542209.000726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586099 54510013,nop,nop,sack 
sack 1 {56580:73956} >
1048542209.140726 222.22.222.222.80 > 111.111.11.111.1326: . 
73956:75404(1448) ack 2514 win 64651 <nop,nop,timestamp 54510014 
35586095>
1048542209.140726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586113 54510013,nop,nop,sack 
sack 1 {56580:75404} >
1048542209.140726 222.22.222.222.80 > 111.111.11.111.1326: . 
75404:76852(1448) ack 2514 win 64651 <nop,nop,timestamp 54510014 
35586095>
1048542209.140726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586113 54510013,nop,nop,sack 
sack 1 {56580:76852} >
1048542209.140726 222.22.222.222.80 > 111.111.11.111.1326: . 
76852:78300(1448) ack 2514 win 64651 <nop,nop,timestamp 54510014 
35586095>
1048542209.140726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586113 54510013,nop,nop,sack 
sack 1 {56580:78300} >
1048542209.140726 222.22.222.222.80 > 111.111.11.111.1326: . 
78300:79748(1448) ack 2514 win 64651 <nop,nop,timestamp 54510014 
35586096>
1048542209.140726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586113 54510013,nop,nop,sack 
sack 1 {56580:79748} >
1048542209.140726 222.22.222.222.80 > 111.111.11.111.1326: . 
79748:81196(1448) ack 2514 win 64651 <nop,nop,timestamp 54510014 
35586096>
1048542209.140726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586113 54510013,nop,nop,sack 
sack 1 {56580:81196} >
1048542209.150726 222.22.222.222.80 > 111.111.11.111.1326: . 
81196:82644(1448) ack 2514 win 64651 <nop,nop,timestamp 54510014 
35586096>
1048542209.150726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586114 54510013,nop,nop,sack 
sack 1 {56580:82644} >
1048542209.170726 222.22.222.222.80 > 111.111.11.111.1326: . 
82644:84092(1448) ack 2514 win 64651 <nop,nop,timestamp 54510015 
35586096>
1048542209.170726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586116 54510013,nop,nop,sack 
sack 1 {56580:84092} >
1048542209.180726 222.22.222.222.80 > 111.111.11.111.1326: . 
84092:85540(1448) ack 2514 win 64651 <nop,nop,timestamp 54510015 
35586096>
1048542209.180726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586117 54510013,nop,nop,sack 
sack 1 {56580:85540} >
1048542209.180726 222.22.222.222.80 > 111.111.11.111.1326: . 
85540:86988(1448) ack 2514 win 64651 <nop,nop,timestamp 54510015 
35586096>
1048542209.180726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586117 54510013,nop,nop,sack 
sack 1 {56580:86988} >
1048542209.180726 222.22.222.222.80 > 111.111.11.111.1326: . 
86988:88436(1448) ack 2514 win 64651 <nop,nop,timestamp 54510015 
35586096>
1048542209.180726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586117 54510013,nop,nop,sack 
sack 1 {56580:88436} >
1048542209.180726 222.22.222.222.80 > 111.111.11.111.1326: . 
88436:89884(1448) ack 2514 win 64651 <nop,nop,timestamp 54510015 
35586096>
1048542209.180726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586117 54510013,nop,nop,sack 
sack 1 {56580:89884} >
1048542209.180726 222.22.222.222.80 > 111.111.11.111.1326: . 
89884:91332(1448) ack 2514 win 64651 <nop,nop,timestamp 54510015 
35586096>
1048542209.180726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586117 54510013,nop,nop,sack 
sack 1 {56580:91332} >
1048542209.180726 222.22.222.222.80 > 111.111.11.111.1326: . 
91332:92780(1448) ack 2514 win 64651 <nop,nop,timestamp 54510015 
35586096>
1048542209.180726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586117 54510013,nop,nop,sack 
sack 1 {56580:92780} >
1048542209.180726 222.22.222.222.80 > 111.111.11.111.1326: . 
92780:94228(1448) ack 2514 win 64651 <nop,nop,timestamp 54510015 
35586096>
1048542209.180726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586117 54510013,nop,nop,sack 
sack 1 {56580:94228} >
1048542209.180726 222.22.222.222.80 > 111.111.11.111.1326: . ack 
2514 win 64651 <nop,nop,timestamp 54510015 35586098>
1048542209.180726 222.22.222.222.80 > 111.111.11.111.1326: P 
94228:95295(1067) ack 2514 win 64651 <nop,nop,timestamp 54510015 
35586096>
1048542209.180726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586117 54510013,nop,nop,sack 
sack 1 {56580:95295} >
1048542209.180726 222.22.222.222.80 > 111.111.11.111.1326: . 
56568:56580(12) ack 2514 win 64651 <nop,nop,timestamp 54510015 
35586098>
1048542209.180726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
55132 win 63712 <nop,nop,timestamp 35586117 54510013,nop,nop,sack 
sack 1 {56568:95295} >
1048542209.190726 222.22.222.222.80 > 111.111.11.111.1326: . 
55132:56568(1436) ack 2514 win 64651 <nop,nop,timestamp 54510015 
35586098>
1048542209.190726 222.22.222.222.80 > 111.111.11.111.1326: . ack 
2514 win 64651 <nop,nop,timestamp 54510015 35586099>
1048542209.190726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
95295 win 30408 <nop,nop,timestamp 35586118 54510015>
1048542209.230726 111.111.11.111.1326 > 222.22.222.222.80: . ack 
95295 win 60816 <nop,nop,timestamp 35586122 54510015>

_______________________________________________________________________
Odomos - the only  mosquito protection outside 4 walls -
Click here to know more!
http://r.rediff.com/r?http://clients.rediff.com/odomos/Odomos.htm&&odomos&&wn




More information about the end2end-interest mailing list