On Wed, 9 Jul 2008, Robert L Mathews wrote: > > Is the RST segment valid? Could you create a dump file using the '-S' flag > > of tcpdump so that not relative but absolute sequence numbers are printed? > > Sure thing; here's another one with -S: > > http://tigertech.net/20080709.tcpdump.server.txt The end of the TCP session is as follows: 08:55:16.499702 IP 64.62.209.98.443 > 96.221.109.137.49553: P 716440962:716440999(37) ack 2354211888 win 71 <nop,nop,timestamp 140394633 528033351> Server sends data still pending to the client. 08:55:16.499799 IP 64.62.209.98.443 > 96.221.109.137.49553: F 716440999:716440999(0) ack 2354211888 win 71 <nop,nop,timestamp 140394633 528033351> Then the server sends a connection termination request. 08:55:16.500008 IP 96.221.109.137.49553 > 64.62.209.98.443: F 2354211888:2354211888(0) ack 716440962 win 65535 <nop,nop,timestamp 528033351 140394349> Client did not receive the last two packets from the server but sends a connection termination request too. 08:55:16.500037 IP 64.62.209.98.443 > 96.221.109.137.49553: . ack 2354211889 win 71 <nop,nop,timestamp 140394633 528033351> Server ACKs that it received the FIN packet from the client. 08:55:16.529487 IP 96.221.109.137.49553 > 64.62.209.98.443: R 2354211888:2354211888(0) win 0 Client sends RST, which is out of (before) the window (left edge is at 2354211889), thus ignored by the server. 08:55:16.740815 IP 64.62.209.98.443 > 96.221.109.137.49553: P 716440962:716440999(37) ack 2354211889 win 71 <nop,nop,timestamp 140394693 528033351> Server tries to send the data still pending. You wrote the client runs Mac OS X 10.4.11. I don't really know what's wrong with it but it seems as a client related issue - or an ISP between the client and server which tries to generate fake RST packets to tear down connections. Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlec@xxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : KFKI Research Institute for Particle and Nuclear Physics H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
