On Sat, Sep 05, 2009 at 11:14:56PM +0200, Jean-Baptiste Quenot wrote: (...) > I loaded the pcap file in wireshark and noticed two things: > > 1) the source port is not the same as logged in the haproxy logs, it > may be useful to have both the source port connecting to haproxy, and > the source port connecting to the backend.
Yes, I've already been missing that too. But before changing the log format again, I'd like to make it more flexible and let people add this information if they need it. > 2) Using this filter: "tcp.dstport==83 and tcp.flags.syn==1" I iterate > over all lines and notice that the source port is never the same, so > it may imply that there is no duplicate SYN. exactly. Regards, Willy
