Wireshark · Ethereal-users: [Ethereal-users] RE: TCP ACK packets with data in them...

["Bob Eby" <beby@xxxxxxxxxxxx>]

Okay... I was able to reproduce this in a fairly simple case.  I'm
attaching a zip file with my findings.  Readme.txt has details.  

> I suspect it's "a segment of data larger than the Ethernet maximum 
> frame size minus about 54 bytes"

Ya, in my tests that works out to anything over 1460 bytes.  

> It may just be that if you do a single socket send call with data that

> requires more than one TCP segment, the PUSH bit won't be set except
on
> the last segment.

That's exactly what I'm seeing.  I've attached proof.  

So, now that I know what's happening what do I do with it?  I'm not
exactly a network guru here, I don't know whether to go to Sun and
Microsoft to make a stink about this, or if I just attempt to ignore it
and chock it up as one minor pothole on the information superhighway.
As a start I was hoping someone would duplicate my results and help
affirm that this isn't merely a problem in ethereal or WinPCap.  

-Bob
beby@xxxxxxxxxxxx

P.S. - Looks like there was no blocking, I was merely impatient waiting
for my first digest update...

P.P.S - I should clarify the lack of copyright notices.  No notices =
public domain.  Of course I'm not a lawyer.

Attachment: broken_nio.zip
Description: Zip compressed data