[3048] in linux-net channel archive
Re: Tcpdump interpretation
daemon@ATHENA.MIT.EDU (Kris Karas)
Wed May 29 12:29:30 1996
Date: Wed, 29 May 1996 10:29:45 -0400
From: Kris Karas <ktk@bih.harvard.edu>
To: Robert Wuest <rwuest@ix.netcom.com>
CC: linux-net@vger.rutgers.edu
Robert Wuest wrote:
> Could someone please tell me just what I'm seeing here?
> 22:57:59.106450 A > B: . 237056:237568(512) ack 1 win 8192
> 22:57:59.106450 B > A: . ack 237568 win 31744
> 22:57:59.486450 A > B: . 238080:238592(512) ack 1 win 8192 (lost packet?)
Yes, lost packet. A knows that B has a window size of 31744, and so is
sending a bunch of packets in a row (before waiting for an ACK) in an
attempt to be efficient.
> 22:58:00.536450 A > B: . 239616:240128(512) ack 1 win 8192
> 22:58:00.536450 B > A: . ack 237568 win 31744
> 22:58:00.926450 A > B: . 237568:238080(512) ack 1 win 8192 missing one?
Correct. A retransmits a packet for that portion of the sequence that B
asked for again.
> 22:58:00.926450 B > A: . ack 240128 win 30720
Now B is telling A that it not only got the retransmitted packet, but
also has stored the other packets A sent. A is now free to continue the
sequence with a packet starting at 240128.
--
Kris Karas | ktk@bih.harvard.edu | http://ktk.bih.harvard.edu/~ktk/
AMA 463814 | RF900RR HawkGT !car | Will design LISP machines for food.
AMACCS 274 | PGP Available | *disclaimer* -> "I barely speak for
DoD 1236 | | myself, much less anybody else."
