Subject: Re: Need some Info. From: Simon Leinen <simon@limmat.switch.ch> Date: 16 Jan 2001 20:20:24 +0100 Message-ID: <aa4ryzcnif.fsf@limmat.switch.ch>
>>>>> "s" == Shashank <shashank@evl.uic.edu> writes:
> Below is a tcodump output.
> *************************************************************************
> 13:49:47.544632 172.21.21.23.1043 > 172.22.22.24.5555: S
> 1846530079:1846530079(0) win 16384
> <mss 9140,nop,wscale 0,nop,nop,timestamp 19346 0,[|tcp]> (DF)
> 13:49:47.751277 172.22.22.24.5555 > 172.21.21.23.1043: S
> 3166086983:3166086983(0) ack 1846530080 win 65535
> <mss 9140,nop,wscale2,nop,nop,timestamp 6121395 19346,[|tcp]> (DF)
> 13:49:47.751321 172.21.21.23.1043 > 172.22.22.24.5555: . ack 1 win 16384
> <nop,nop,timestamp 19346 6121395,nop,nop,cc 26> (DF)
> 13:49:47.752346 172.21.21.23.1043 > 172.22.22.24.5555: P 1:2049(2048) ack
> 1 win 16384 <nop,nop,timestamp 19346 6121395,nop,nop,cc 26> (DF)
> *************************************************************************
> 1. What is the last option that is specified in the SYNC packet
> ([|tcp]),
This is tcpdump's way of saying that the header in question (tcp)
couldn't be decoded in its entirety because it was cut off early. By
default, tcpdump collects only the first 68 bytes of each packet.
Call tcpdump with the -s option to specify a larger "snaplen" (e.g.
-s 1500). Then tcpdump will decode the complete header.
> 2. the "cc"option specifiesd in one of the data packets. It seems
> that this option is used by T/TCP, to minimize the number of
> segments exchanged in a single transation.. Is this correct??
No idea.
-- Simon. ---------------------------------------------------------------------------- To unsubscribe, send a message with body containing "unsubscribe tcptrace" to majordomo@tcptrace.org.
This archive was generated by hypermail 2b30 : 01/17/01 EST