Wireshark-users: Re: [Wireshark-users] TCP retransmit, HTTP and web page not loading
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Sake Blok <sake@xxxxxxxxxx>
Date: Wed, 25 Jun 2008 19:21:07 +0200
On Wed, Jun 25, 2008 at 09:21:21AM -0700, Gerald Combs wrote:
> I think Frank might be on the right track here. Inbound packets from
> 206.191.131.51 max out at 1018 bytes. This seems suspiciously low.

That's because the client asks for an MSS of 964 (see TCP options
in SYN packets). All the 1018 byte packets have exactly 964 bytes
TCP payload.

But that's no different between the two tcp-sessions towards the
server. Still, one fails, the other one doesn't.

One thing I have came accross before is servers that allow only one
tcp session per src-ip. But in those cases the three way handshake 
would already fail, which is not the case in the problem at hand...

Cheers,
    Sake