Hello, I see the following behaviour on a SUSE Linux 2.6.16.27-0.9-smp kernel. With the initial SYN having WS=0 the WS=9 in the 2'nd line isn't taken into account. If so it looks to me that the windowsize of 12 is the reason that the FIN is directly send. Is this the correct behaviour?
Many thanks in advance Pit No. Time Source Destination Protocol Info 11112 20.988429 10.100.184.91 10.100.0.98 TCP 53486 35975 [SYN] Seq=1409073086 Len=0 MSS=1460 TSV=101256718 TSER=0 WS=0 11113 20.988446 10.100.0.98 10.100.184.91 TCP 35975 53486 [SYN, ACK] Seq=277483755 Ack=1409073087 Win=5792 Len=0 MSS=1460 TSV=227785901 TSER=101256718 WS=9 11114 20.988803 10.100.184.91 10.100.0.98 TCP 53486 35975 [ACK] Seq=1409073087 Ack=277483756 Win=5840 Len=0 TSV=101256718 TSER=227785901 11115 20.989047 10.100.0.98 10.100.184.91 TCP 35975 53486 [FIN, ACK] Seq=277483756 Ack=1409073087 Win=12 Len=0 TSV=227785901 TSER=101256718 11116 20.989303 10.100.184.91 10.100.0.98 TCP 53486 35975 [PSH, ACK] Seq=1409073087 Ack=277483756 Win=5840 Len=285 TSV=101256718 TSER=227785901[Packet size limited during capture] 11117 20.989319 10.100.0.98 10.100.184.91 TCP 35975 53486 [RST] Seq=277483756 Len=0 T-Mobile Deutschland GmbH Aufsichtsrat: Hamid Akhavan (Vorsitzender) Geschaftsfuhrung: Philipp Humm (Sprecher), Thomas Berlemann, Stefan Homeister, Holger Kranzusch, Gunther Ottendorfer, Dr. Raphael Kubler, Dr. Steffen Roehn Handelsregister: Amtsgericht Bonn, HRB 59 19 Sitz der Gesellschaft: Bonn WEEE-Reg.-Nr.: DE60800328
_______________________________________________ Wireshark-users mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-users
