Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 01 Jan 2007 20:21:00 -0500
From:      "David S. Madole" <david@madole.net>
To:        'Steve Watt' <steve@Watt.COM>, "'hackers@freebsd.org'" <hackers@freebsd.org>
Subject:   RE: Interesting TCP issue
Message-ID:  <20070102013337.26CA513C44B@mx1.freebsd.org>

next in thread | raw e-mail | index | archive | help
> From Steve Watt on Monday, January 01, 2007 4:37 PM
>=20
> # tcpdump -vv -s 1500 -i dc0 -X net 213.244.128.0/18
> tcpdump: lestening on dc0, link-type EN10MB (Ethernet), capture size 1500
> bytes
> 13:18:13.607493 IP (tos 0x20, ttl  58, id 12896, offset 0, flags [DF],
> proto: TCP (6), length: 74) share.skype.net.50406 > wattres.watt.com.smtp=
:
> P, cksum 0x9297 (correct), 4072464914:4072464936(22) ack 1248591103 win 4=
6
> <nop,nop,timestamp 2511885672 520058954>
>         0x0000:  4520 004a 3260 4000 3a06 c609 d5f4 aa50  E..J2`@.:......=
P
>         0x0010:  425d 8582 c4e6 0019 f2bc e212 4a6b fcff  B]..........Jk.=
.
>         0x0020:  8018 002e 9297 0000 0101 080a 95b8 5568  ..............U=
h
>         0x0030:  1eff 784a 4548 4c4f 2073 6861 7265 2e73  ..xJEHLO.share.=
s
>         0x0040:  6b79 7065 2e6e 6574 0d0a                 kype.net..
>=20
> Interesting.  I presume it has something to do with the
> idiotically small window the remote server is advertising.  So I
> set net.inet.tcp.minmss down to 46, and that resulted in a RST
> being spit back to skype's server when its retransmit happened.

Are you sure the window is really that small and that window scaling was no=
t negotiated at the start of the connection? The initial packets are not ca=
ptured here so I can't tell.

Is it possible to get a really complete capture of a session including the =
initial handshake?

David





Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20070102013337.26CA513C44B>