On 11/7/2012 4:41 PM, Kevin Wilcox wrote:
On 7 November 2012 17:35, Nick Bright<nick.bright@xxxxxxxxxx> wrote:On the web server that should be receiving the hit, tcpdump reports: 16:31:21.283309 IP 64.254.49.2.33315> 64.254.32.23.http: Flags [S], seq 4294319084, win 14600, options [mss 1460,sackOK,TS val 11023544 ecr 0,nop,wscale 7], length 0 16:31:21.283415 IP 64.254.32.23.http> 64.254.49.2.33315: Flags [S.], seq 2198086634, ack 4294319085, win 14480, options [mss 1460,sackOK,TS val 2023464600 ecr 11023544,nop,wscale 7], length 0 16:31:22.282510 IP 64.254.32.23.http> 64.254.49.2.33315: Flags [S.], seq 2198086634, ack 4294319085, win 14480, options [mss 1460,sackOK,TS val 2023465600 ecr 11023544,nop,wscale 7], length 0 (this repeats several times, in what I would presume are browser retries)At any point do you get <timestamp> IP 64.254.49.2.33315> 64.253.32.23.http: Flags [.]<rest of line> It looks like no return ACK is being sent from the client, without the 3WHS you're never going to see a connection in the Apache logs. kmw
I don't see any output from tcpdump that has a "Flags [.]", they are all "Flags [S.]" or "Flags [S]".
Thanks, -- ----------------------------------------------- - Nick Bright - - Vice President of Technology - - Valnet -=- We Connect You -=- - - Tel 888-332-1616 x 315 / Fax 620-331-0789 - - Web http://www.valnet.net/ - ----------------------------------------------- - Are your files safe? - - Valnet Vault - Secure Cloud Backup - - More information & 30 day free trial at - - http://www.valnet.net/services/valnet-vault - -----------------------------------------------
<<attachment: smime.p7s>>
