From owner-freebsd-hackers  Sun Dec 15 22:38:09 1996
Return-Path: <owner-hackers>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.4/8.8.4) id WAA09957
          for hackers-outgoing; Sun, 15 Dec 1996 22:38:09 -0800 (PST)
Received: from alpha.xerox.com (alpha.Xerox.COM [13.1.64.93])
          by freefall.freebsd.org (8.8.4/8.8.4) with SMTP id WAA09952
          for <hackers@freebsd.org>; Sun, 15 Dec 1996 22:38:06 -0800 (PST)
Received: from crevenia.parc.xerox.com ([13.2.116.11]) by alpha.xerox.com with SMTP id <16904(2)>; Sun, 15 Dec 1996 22:37:35 PST
Received: from localhost by crevenia.parc.xerox.com with SMTP id <177711>; Sun, 15 Dec 1996 22:37:27 -0800
To: Marc Slemko <marcs@znep.com>
cc: hackers@freebsd.org
Subject: Re: TCP FIN/ACK storm oddity 
In-reply-to: Your message of "Wed, 11 Dec 96 16:45:49 PST."
             <Pine.BSF.3.95.961211173514.29879H-100000@alive.ampr.ab.ca> 
Date: Sun, 15 Dec 1996 22:37:19 PST
From: Bill Fenner <fenner@parc.xerox.com>
Message-Id: <96Dec15.223727pst.177711@crevenia.parc.xerox.com>
Sender: owner-hackers@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

Sounds like what Peter Wemm saw in PR kern/1940.

Can you replicate the exchange from the second message, but use "tcpdump -S"
so that tcpdump doesn't try to be smart about the sequence numbers?  A
"tcpdump -w" might be even better.

  Bill