> There is an small bug in tcpdump 3.6.2 working on Solaris and Linux
>
> At the beginning of the execution with
> "tcpdump -X -vvv -s 140 host 10.1.3.3 and port 80"
> the dump of a packet with IP options displays well the TCP ack,
> but then with almost the same packet it shows the TCP ack as 1.
To me this looks like the expected behavior. Are you sure you're not
seeing the effect of relative versus absolute TCP sequence numbers?
See the -S entry in the man page.
Steinar Haug, Nethelp consulting, [EMAIL PROTECTED]
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
