On 7 November 2012 17:35, Nick Bright <nick.bright@xxxxxxxxxx> wrote: > On the web server that should be receiving the hit, tcpdump reports: > > 16:31:21.283309 IP 64.254.49.2.33315 > 64.254.32.23.http: Flags [S], seq > 4294319084, win 14600, options [mss 1460,sackOK,TS val 11023544 ecr > 0,nop,wscale 7], length 0 > 16:31:21.283415 IP 64.254.32.23.http > 64.254.49.2.33315: Flags [S.], seq > 2198086634, ack 4294319085, win 14480, options [mss 1460,sackOK,TS val > 2023464600 ecr 11023544,nop,wscale 7], length 0 > 16:31:22.282510 IP 64.254.32.23.http > 64.254.49.2.33315: Flags [S.], seq > 2198086634, ack 4294319085, win 14480, options [mss 1460,sackOK,TS val > 2023465600 ecr 11023544,nop,wscale 7], length 0 > > (this repeats several times, in what I would presume are browser retries) At any point do you get <timestamp> IP 64.254.49.2.33315 > 64.253.32.23.http: Flags [.] <rest of line> It looks like no return ACK is being sent from the client, without the 3WHS you're never going to see a connection in the Apache logs. kmw
