> > How to TCP keepalive packets look like? Also, isn't it possible that the > > third packet already carries data, in the general (read TCP protocol as > > it is written) case? You probably won't get that with the normal socket > > interface from userlevel, but does TCP forbid it? I don't think so. > > Correct. And besides when you receive data and have nothing to send > you'll ack with a zero-length packet. I agree.
But that reminds me something. I had a problem once (not solved) with a novell server that used to send TCP packets with 2 bytes of data, then 52, then 2, then 52. It never sent packets filled to the MSS size as negotiated at the beginning. That caused the pop3 traffic to go terribly slow, and finally the server decided to close the connection due to timeout of not sending a mail message in time. I tcpdumped the session, and did not see any, in my opinion, valid cause, like advertising a smaller tcp window. Also some (but not all) modem connection to the server had full 576 byte packets Any ideas on the cause? Regards, Maciej Soltysiak
