On Mar 23, 2007, at 10:16 AM, Torbjorn Granlund wrote:
These are the ones the correspond. They come in bursts like that. If
I let it run a little longer, I get output like this:

19:45:56.939958 IP vm.se.lsoft.com.58679 > bang.swox.se.smtp: S
678305700:678305700(0) win 8192 <mss 1420,wscale
0,nop,nop,nop,timestamp 2317060084 0>
19:45:56.940154 IP bang.swox.se.smtp > vm.se.lsoft.com.58679: S
3183232720:3183232720(0) ack 678305701 win 57344 <mss
1460,nop,wscale 0,nop,nop,timestamp 24588210 2317060084>

Notice the ACK from vm.se.lsoft.com is off by one, but the timestamp option corresponds. Looks to be a bug with the vm machine, the bang
  machine is behaving properly per the TCP requirements.

Now you're confusing me.

It's not intentional.  I might be confusing us both.  :-)

(1) There is no ACK sent from vm.se.lsoft.com.  The only ACKs sent
    are i  the other directions, as per the tcpdumps above.

Uh, yes.  I meant this packet:

bang.swox.se.smtp > vm.se.lsoft.com.58679: S 3183232720:3183232720 (0) ack 678305701

(2) The ACKs are not off by one, or if you prefer, ACKs on TCP are
    always off by one.  They are one higher than one would expect.

You're right-- the SYN+ACK reply to a connection open (bare SYN) should reply with SEQ = ISS + 1 to acknowledge the SYN (which counts as a byte).


freebsd-questions@freebsd.org mailing list
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to