lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 28 Apr 2008 17:53:56 +0200 From: Joakim Tjernlund <joakim.tjernlund@...nsmode.se> To: Ilpo Järvinen <ilpo.jarvinen@...sinki.fi> Cc: Netdev <netdev@...r.kernel.org> Subject: Re: TCP slowdown in 2.6.25? On Mon, 2008-04-28 at 18:48 +0300, Ilpo Järvinen wrote: > On Mon, 28 Apr 2008, Joakim Tjernlund wrote: > > > On Mon, 2008-04-28 at 17:42 +0300, Ilpo Järvinen wrote: > > > On Mon, 28 Apr 2008, Joakim Tjernlund wrote: > > > > On Mon, 2008-04-28 at 14:12 +0200, Joakim Tjernlund wrote: > > > > > After upgrading from 2.6.23 to 2.6.25 I am seeing a big slow down on > > > > > our old www server. Stracing shows lots of EAGAIN but i not sure > > > > > these are relevant. I got no idea where to start looking so > > > > > I would appreciate some pointers. Perhaps this is a know issue? > > > > > > > > > > CPU is a PowerPC, mpc8321, network driver ucc_geth > > > > > > > > Some info: > > > > Even ftp transfers takes forever, but only in one direction: from the > > > > node with kernel 2.6.25 to some other host. Strace show me that > > > > write(2) hangs for long periods before succeeding to transmit > > > > the data. > > > > To some specific or "any" other host? How long is "long"? > > > > Any host. A 1304632 bytes file takes about 110 seconds to transfer > > (12 Kbytes/sec) > > > > A quick capture with wireshark indicates that some sent packages from > > the node never reaches the host on the network. > > Thanks, this is the important bit of info, TCP flow control limit seems > just a consequence of that... ...Now we'll just have to figure out what is > causing those losses. > > Is there some middlebox on the route to that host? Yes, there is a router in between , but I have had reports that the slowdown also happens without a router in between. Here is a fragment from wireshark, hope it means something to you :) Troble starts at frame 9 No. Time Source Destination Protocol Info 1 0.000000 192.168.101.13 192.168.1.15 FTP Request: PORT 192,168,101,13,158,17 Frame 1 (94 bytes on wire, 94 bytes captured) Ethernet II, Src: HewlettP_47:49:46 (00:1c:c4:47:49:46), Dst: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29) Internet Protocol, Src: 192.168.101.13 (192.168.101.13), Dst: 192.168.1.15 (192.168.1.15) Transmission Control Protocol, Src Port: 39399 (39399), Dst Port: ftp (21), Seq: 1, Ack: 1, Len: 28 Source port: 39399 (39399) Destination port: ftp (21) Sequence number: 1 (relative sequence number) [Next sequence number: 29 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) Window size: 1460 Checksum: 0xbe68 [correct] Options: (12 bytes) File Transfer Protocol (FTP) No. Time Source Destination Protocol Info 2 0.000064 192.168.1.15 192.168.101.13 FTP Response: 200 PORT command successful. Consider using PASV. Frame 2 (117 bytes on wire, 117 bytes captured) Ethernet II, Src: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29), Dst: D-Link_53:3b:0c (00:0d:88:53:3b:0c) Internet Protocol, Src: 192.168.1.15 (192.168.1.15), Dst: 192.168.101.13 (192.168.101.13) Transmission Control Protocol, Src Port: ftp (21), Dst Port: 39399 (39399), Seq: 1, Ack: 29, Len: 51 Source port: ftp (21) Destination port: 39399 (39399) Sequence number: 1 (relative sequence number) [Next sequence number: 52 (relative sequence number)] Acknowledgement number: 29 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) Window size: 46 Checksum: 0xe7c6 [incorrect, should be 0x839d (maybe caused by "TCP checksum offload"?)] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 1] [The RTT to ACK the segment was: 0.000064000 seconds] File Transfer Protocol (FTP) No. Time Source Destination Protocol Info 3 0.000739 192.168.101.13 192.168.1.15 TCP 39399 > ftp [ACK] Seq=29 Ack=52 Win=1460 Len=0 TSV=49341 TSER=7677016 Frame 3 (66 bytes on wire, 66 bytes captured) Ethernet II, Src: HewlettP_47:49:46 (00:1c:c4:47:49:46), Dst: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29) Internet Protocol, Src: 192.168.101.13 (192.168.101.13), Dst: 192.168.1.15 (192.168.1.15) Transmission Control Protocol, Src Port: 39399 (39399), Dst Port: ftp (21), Seq: 29, Ack: 52, Len: 0 Source port: 39399 (39399) Destination port: ftp (21) Sequence number: 29 (relative sequence number) Acknowledgement number: 52 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 1460 Checksum: 0x2945 [correct] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 2] [The RTT to ACK the segment was: 0.000675000 seconds] No. Time Source Destination Protocol Info 4 0.001243 192.168.101.13 192.168.1.15 FTP Request: STOR uImage Frame 4 (79 bytes on wire, 79 bytes captured) Ethernet II, Src: HewlettP_47:49:46 (00:1c:c4:47:49:46), Dst: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29) Internet Protocol, Src: 192.168.101.13 (192.168.101.13), Dst: 192.168.1.15 (192.168.1.15) Transmission Control Protocol, Src Port: 39399 (39399), Dst Port: ftp (21), Seq: 29, Ack: 52, Len: 13 Source port: 39399 (39399) Destination port: ftp (21) Sequence number: 29 (relative sequence number) [Next sequence number: 42 (relative sequence number)] Acknowledgement number: 52 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) Window size: 1460 Checksum: 0x4c32 [correct] Options: (12 bytes) File Transfer Protocol (FTP) No. Time Source Destination Protocol Info 5 0.004577 192.168.1.15 192.168.101.13 TCP ftp-data > 40465 [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=7677017 TSER=0 WS=7 Frame 5 (74 bytes on wire, 74 bytes captured) Ethernet II, Src: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29), Dst: D-Link_53:3b:0c (00:0d:88:53:3b:0c) Internet Protocol, Src: 192.168.1.15 (192.168.1.15), Dst: 192.168.101.13 (192.168.101.13) Transmission Control Protocol, Src Port: ftp-data (20), Dst Port: 40465 (40465), Seq: 0, Len: 0 Source port: ftp-data (20) Destination port: 40465 (40465) Sequence number: 0 (relative sequence number) Header length: 40 bytes Flags: 0x02 (SYN) Window size: 5840 Checksum: 0x77be [correct] Options: (20 bytes) No. Time Source Destination Protocol Info 6 0.005238 192.168.101.13 192.168.1.15 TCP 40465 > ftp-data [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1460 TSV=49341 TSER=7677017 WS=2 Frame 6 (74 bytes on wire, 74 bytes captured) Ethernet II, Src: HewlettP_47:49:46 (00:1c:c4:47:49:46), Dst: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29) Internet Protocol, Src: 192.168.101.13 (192.168.101.13), Dst: 192.168.1.15 (192.168.1.15) Transmission Control Protocol, Src Port: 40465 (40465), Dst Port: ftp-data (20), Seq: 0, Ack: 1, Len: 0 Source port: 40465 (40465) Destination port: ftp-data (20) Sequence number: 0 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 40 bytes Flags: 0x12 (SYN, ACK) Window size: 5792 Checksum: 0x1f9d [correct] Options: (20 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 5] [The RTT to ACK the segment was: 0.000661000 seconds] No. Time Source Destination Protocol Info 7 0.005248 192.168.1.15 192.168.101.13 TCP ftp-data > 40465 [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSV=7677017 TSER=49341 Frame 7 (66 bytes on wire, 66 bytes captured) Ethernet II, Src: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29), Dst: D-Link_53:3b:0c (00:0d:88:53:3b:0c) Internet Protocol, Src: 192.168.1.15 (192.168.1.15), Dst: 192.168.101.13 (192.168.101.13) Transmission Control Protocol, Src Port: ftp-data (20), Dst Port: 40465 (40465), Seq: 1, Ack: 1, Len: 0 Source port: ftp-data (20) Destination port: 40465 (40465) Sequence number: 1 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 5888 (scaled) Checksum: 0x64d6 [correct] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 6] [The RTT to ACK the segment was: 0.000010000 seconds] No. Time Source Destination Protocol Info 8 0.005281 192.168.1.15 192.168.101.13 FTP Response: 150 Ok to send data. Frame 8 (88 bytes on wire, 88 bytes captured) Ethernet II, Src: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29), Dst: D-Link_53:3b:0c (00:0d:88:53:3b:0c) Internet Protocol, Src: 192.168.1.15 (192.168.1.15), Dst: 192.168.101.13 (192.168.101.13) Transmission Control Protocol, Src Port: ftp (21), Dst Port: 39399 (39399), Seq: 52, Ack: 42, Len: 22 Source port: ftp (21) Destination port: 39399 (39399) Sequence number: 52 (relative sequence number) [Next sequence number: 74 (relative sequence number)] Acknowledgement number: 42 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) Window size: 46 Checksum: 0xe7a9 [incorrect, should be 0x1c6f (maybe caused by "TCP checksum offload"?)] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4] [The RTT to ACK the segment was: 0.004038000 seconds] File Transfer Protocol (FTP) No. Time Source Destination Protocol Info 9 0.007732 192.168.101.13 192.168.1.15 FTP-DATA [TCP Previous segment lost] FTP Data: 1448 bytes Frame 9 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: HewlettP_47:49:46 (00:1c:c4:47:49:46), Dst: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29) Internet Protocol, Src: 192.168.101.13 (192.168.101.13), Dst: 192.168.1.15 (192.168.1.15) Transmission Control Protocol, Src Port: 40465 (40465), Dst Port: ftp-data (20), Seq: 1449, Ack: 1, Len: 1448 Source port: 40465 (40465) Destination port: ftp-data (20) Sequence number: 1449 (relative sequence number) [Next sequence number: 2897 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 5792 (scaled) Checksum: 0xc6b7 [correct] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 7] [The RTT to ACK the segment was: 0.002484000 seconds] [TCP Analysis Flags] [A segment before this frame was lost] FTP Data No. Time Source Destination Protocol Info 10 0.007763 192.168.1.15 192.168.101.13 TCP [TCP Dup ACK 7#1] ftp-data > 40465 [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSV=7677018 TSER=49341 SLE=1449 SRE=2897 Frame 10 (78 bytes on wire, 78 bytes captured) Ethernet II, Src: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29), Dst: D-Link_53:3b:0c (00:0d:88:53:3b:0c) Internet Protocol, Src: 192.168.1.15 (192.168.1.15), Dst: 192.168.101.13 (192.168.101.13) Transmission Control Protocol, Src Port: ftp-data (20), Dst Port: 40465 (40465), Seq: 1, Ack: 1, Len: 0 Source port: ftp-data (20) Destination port: 40465 (40465) Sequence number: 1 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) Window size: 5888 (scaled) Checksum: 0xeeb4 [correct] Options: (24 bytes) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 7] No. Time Source Destination Protocol Info 11 0.038975 192.168.101.13 192.168.1.15 TCP 39399 > ftp [ACK] Seq=42 Ack=74 Win=1460 Len=0 TSV=49345 TSER=7677017 Frame 11 (66 bytes on wire, 66 bytes captured) Ethernet II, Src: HewlettP_47:49:46 (00:1c:c4:47:49:46), Dst: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29) Internet Protocol, Src: 192.168.101.13 (192.168.101.13), Dst: 192.168.1.15 (192.168.1.15) Transmission Control Protocol, Src Port: 39399 (39399), Dst Port: ftp (21), Seq: 42, Ack: 74, Len: 0 Source port: 39399 (39399) Destination port: ftp (21) Sequence number: 42 (relative sequence number) Acknowledgement number: 74 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 1460 Checksum: 0x291d [correct] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 8] [The RTT to ACK the segment was: 0.033694000 seconds] No. Time Source Destination Protocol Info 12 0.209848 192.168.101.13 192.168.1.15 FTP-DATA [TCP Retransmission] FTP Data: 1448 bytes Frame 12 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: HewlettP_47:49:46 (00:1c:c4:47:49:46), Dst: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29) Internet Protocol, Src: 192.168.101.13 (192.168.101.13), Dst: 192.168.1.15 (192.168.1.15) Transmission Control Protocol, Src Port: 40465 (40465), Dst Port: ftp-data (20), Seq: 1, Ack: 1, Len: 1448 Source port: 40465 (40465) Destination port: ftp-data (20) Sequence number: 1 (relative sequence number) [Next sequence number: 1449 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 5792 (scaled) Checksum: 0x2760 [correct] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 10] [The RTT to ACK the segment was: 0.202085000 seconds] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [The RTO for this segment was: 0.202116000 seconds] [RTO based on delta from frame: 9] FTP Data No. Time Source Destination Protocol Info 13 0.209871 192.168.1.15 192.168.101.13 TCP ftp-data > 40465 [ACK] Seq=1 Ack=2897 Win=8832 Len=0 TSV=7677068 TSER=49362 Frame 13 (66 bytes on wire, 66 bytes captured) Ethernet II, Src: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29), Dst: D-Link_53:3b:0c (00:0d:88:53:3b:0c) Internet Protocol, Src: 192.168.1.15 (192.168.1.15), Dst: 192.168.101.13 (192.168.101.13) Transmission Control Protocol, Src Port: ftp-data (20), Dst Port: 40465 (40465), Seq: 1, Ack: 2897, Len: 0 Source port: ftp-data (20) Destination port: 40465 (40465) Sequence number: 1 (relative sequence number) Acknowledgement number: 2897 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 8832 (scaled) Checksum: 0x5927 [correct] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 9] [The RTT to ACK the segment was: 0.202139000 seconds] No. Time Source Destination Protocol Info 14 0.211347 192.168.101.13 192.168.1.15 FTP-DATA [TCP Previous segment lost] FTP Data: 1448 bytes Frame 14 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: HewlettP_47:49:46 (00:1c:c4:47:49:46), Dst: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29) Internet Protocol, Src: 192.168.101.13 (192.168.101.13), Dst: 192.168.1.15 (192.168.1.15) Transmission Control Protocol, Src Port: 40465 (40465), Dst Port: ftp-data (20), Seq: 4345, Ack: 1, Len: 1448 Source port: 40465 (40465) Destination port: ftp-data (20) Sequence number: 4345 (relative sequence number) [Next sequence number: 5793 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 5792 (scaled) Checksum: 0x166f [correct] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 13] [The RTT to ACK the segment was: 0.001476000 seconds] [TCP Analysis Flags] [A segment before this frame was lost] FTP Data No. Time Source Destination Protocol Info 15 0.211360 192.168.1.15 192.168.101.13 TCP [TCP Dup ACK 13#1] ftp-data > 40465 [ACK] Seq=1 Ack=2897 Win=8832 Len=0 TSV=7677069 TSER=49362 SLE=4345 SRE=5793 Frame 15 (78 bytes on wire, 78 bytes captured) Ethernet II, Src: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29), Dst: D-Link_53:3b:0c (00:0d:88:53:3b:0c) Internet Protocol, Src: 192.168.1.15 (192.168.1.15), Dst: 192.168.101.13 (192.168.101.13) Transmission Control Protocol, Src Port: ftp-data (20), Dst Port: 40465 (40465), Seq: 1, Ack: 2897, Len: 0 Source port: ftp-data (20) Destination port: 40465 (40465) Sequence number: 1 (relative sequence number) Acknowledgement number: 2897 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) Window size: 8832 (scaled) Checksum: 0xcc65 [correct] Options: (24 bytes) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 13] No. Time Source Destination Protocol Info 16 0.211596 192.168.101.13 192.168.1.15 FTP-DATA FTP Data: 1448 bytes Frame 16 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: HewlettP_47:49:46 (00:1c:c4:47:49:46), Dst: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29) Internet Protocol, Src: 192.168.101.13 (192.168.101.13), Dst: 192.168.1.15 (192.168.1.15) Transmission Control Protocol, Src Port: 40465 (40465), Dst Port: ftp-data (20), Seq: 5793, Ack: 1, Len: 1448 Source port: 40465 (40465) Destination port: ftp-data (20) Sequence number: 5793 (relative sequence number) [Next sequence number: 7241 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 5792 (scaled) Checksum: 0x832a [correct] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 15] [The RTT to ACK the segment was: 0.000236000 seconds] FTP Data No. Time Source Destination Protocol Info 17 0.211606 192.168.1.15 192.168.101.13 TCP [TCP Dup ACK 13#2] ftp-data > 40465 [ACK] Seq=1 Ack=2897 Win=8832 Len=0 TSV=7677069 TSER=49362 SLE=4345 SRE=7241 Frame 17 (78 bytes on wire, 78 bytes captured) Ethernet II, Src: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29), Dst: D-Link_53:3b:0c (00:0d:88:53:3b:0c) Internet Protocol, Src: 192.168.1.15 (192.168.1.15), Dst: 192.168.101.13 (192.168.101.13) Transmission Control Protocol, Src Port: ftp-data (20), Dst Port: 40465 (40465), Seq: 1, Ack: 2897, Len: 0 Source port: ftp-data (20) Destination port: 40465 (40465) Sequence number: 1 (relative sequence number) Acknowledgement number: 2897 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) Window size: 8832 (scaled) Checksum: 0xc6bd [correct] Options: (24 bytes) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 2] [Duplicate to the ACK in frame: 13] No. Time Source Destination Protocol Info 18 0.212844 192.168.101.13 192.168.1.15 FTP-DATA FTP Data: 1448 bytes Frame 18 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: HewlettP_47:49:46 (00:1c:c4:47:49:46), Dst: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29) Internet Protocol, Src: 192.168.101.13 (192.168.101.13), Dst: 192.168.1.15 (192.168.1.15) Transmission Control Protocol, Src Port: 40465 (40465), Dst Port: ftp-data (20), Seq: 7241, Ack: 1, Len: 1448 Source port: 40465 (40465) Destination port: ftp-data (20) Sequence number: 7241 (relative sequence number) [Next sequence number: 8689 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 5792 (scaled) Checksum: 0x7d4e [correct] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 17] [The RTT to ACK the segment was: 0.001238000 seconds] FTP Data No. Time Source Destination Protocol Info 19 0.212854 192.168.1.15 192.168.101.13 TCP [TCP Dup ACK 13#3] ftp-data > 40465 [ACK] Seq=1 Ack=2897 Win=8832 Len=0 TSV=7677069 TSER=49362 SLE=4345 SRE=8689 Frame 19 (78 bytes on wire, 78 bytes captured) Ethernet II, Src: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29), Dst: D-Link_53:3b:0c (00:0d:88:53:3b:0c) Internet Protocol, Src: 192.168.1.15 (192.168.1.15), Dst: 192.168.101.13 (192.168.101.13) Transmission Control Protocol, Src Port: ftp-data (20), Dst Port: 40465 (40465), Seq: 1, Ack: 2897, Len: 0 Source port: ftp-data (20) Destination port: 40465 (40465) Sequence number: 1 (relative sequence number) Acknowledgement number: 2897 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) Window size: 8832 (scaled) Checksum: 0xc115 [correct] Options: (24 bytes) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 3] [Duplicate to the ACK in frame: 13] No. Time Source Destination Protocol Info 20 0.213095 192.168.101.13 192.168.1.15 FTP-DATA FTP Data: 1448 bytes Frame 20 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: HewlettP_47:49:46 (00:1c:c4:47:49:46), Dst: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29) Internet Protocol, Src: 192.168.101.13 (192.168.101.13), Dst: 192.168.1.15 (192.168.1.15) Transmission Control Protocol, Src Port: 40465 (40465), Dst Port: ftp-data (20), Seq: 8689, Ack: 1, Len: 1448 Source port: 40465 (40465) Destination port: ftp-data (20) Sequence number: 8689 (relative sequence number) [Next sequence number: 10137 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 5792 (scaled) Checksum: 0x6b7f [correct] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 19] [The RTT to ACK the segment was: 0.000241000 seconds] FTP Data No. Time Source Destination Protocol Info 21 0.213105 192.168.1.15 192.168.101.13 TCP [TCP Dup ACK 13#4] ftp-data > 40465 [ACK] Seq=1 Ack=2897 Win=8832 Len=0 TSV=7677069 TSER=49362 SLE=4345 SRE=10137 Frame 21 (78 bytes on wire, 78 bytes captured) Ethernet II, Src: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29), Dst: D-Link_53:3b:0c (00:0d:88:53:3b:0c) Internet Protocol, Src: 192.168.1.15 (192.168.1.15), Dst: 192.168.101.13 (192.168.101.13) Transmission Control Protocol, Src Port: ftp-data (20), Dst Port: 40465 (40465), Seq: 1, Ack: 2897, Len: 0 Source port: ftp-data (20) Destination port: 40465 (40465) Sequence number: 1 (relative sequence number) Acknowledgement number: 2897 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) Window size: 8832 (scaled) Checksum: 0xbb6d [correct] Options: (24 bytes) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 4] [Duplicate to the ACK in frame: 13] No. Time Source Destination Protocol Info 22 0.214345 192.168.101.13 192.168.1.15 FTP-DATA [TCP Fast Retransmission] FTP Data: 1448 bytes Frame 22 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: HewlettP_47:49:46 (00:1c:c4:47:49:46), Dst: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29) Internet Protocol, Src: 192.168.101.13 (192.168.101.13), Dst: 192.168.1.15 (192.168.1.15) Transmission Control Protocol, Src Port: 40465 (40465), Dst Port: ftp-data (20), Seq: 2897, Ack: 1, Len: 1448 Source port: 40465 (40465) Destination port: ftp-data (20) Sequence number: 2897 (relative sequence number) [Next sequence number: 4345 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) Window size: 5792 (scaled) Checksum: 0x0799 [correct] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 21] [The RTT to ACK the segment was: 0.001240000 seconds] [TCP Analysis Flags] [This frame is a (suspected) fast retransmission] [This frame is a (suspected) retransmission] FTP Data No. Time Source Destination Protocol Info 23 0.214360 192.168.1.15 192.168.101.13 TCP ftp-data > 40465 [ACK] Seq=1 Ack=10137 Win=11648 Len=0 TSV=7677070 TSER=49362 Frame 23 (66 bytes on wire, 66 bytes captured) Ethernet II, Src: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29), Dst: D-Link_53:3b:0c (00:0d:88:53:3b:0c) Internet Protocol, Src: 192.168.1.15 (192.168.1.15), Dst: 192.168.101.13 (192.168.101.13) Transmission Control Protocol, Src Port: ftp-data (20), Dst Port: 40465 (40465), Seq: 1, Ack: 10137, Len: 0 Source port: ftp-data (20) Destination port: 40465 (40465) Sequence number: 1 (relative sequence number) Acknowledgement number: 10137 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 11648 (scaled) Checksum: 0x3cc7 [correct] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 20] [The RTT to ACK the segment was: 0.001265000 seconds] No. Time Source Destination Protocol Info 24 0.215843 192.168.101.13 192.168.1.15 FTP-DATA [TCP Previous segment lost] FTP Data: 1448 bytes Frame 24 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: HewlettP_47:49:46 (00:1c:c4:47:49:46), Dst: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29) Internet Protocol, Src: 192.168.101.13 (192.168.101.13), Dst: 192.168.1.15 (192.168.1.15) Transmission Control Protocol, Src Port: 40465 (40465), Dst Port: ftp-data (20), Seq: 11585, Ack: 1, Len: 1448 Source port: 40465 (40465) Destination port: ftp-data (20) Sequence number: 11585 (relative sequence number) [Next sequence number: 13033 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) Window size: 5792 (scaled) Checksum: 0x3791 [correct] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 23] [The RTT to ACK the segment was: 0.001483000 seconds] [TCP Analysis Flags] [A segment before this frame was lost] FTP Data No. Time Source Destination Protocol Info 25 0.215854 192.168.1.15 192.168.101.13 TCP [TCP Dup ACK 23#1] ftp-data > 40465 [ACK] Seq=1 Ack=10137 Win=11648 Len=0 TSV=7677070 TSER=49362 SLE=11585 SRE=13033 Frame 25 (78 bytes on wire, 78 bytes captured) Ethernet II, Src: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29), Dst: D-Link_53:3b:0c (00:0d:88:53:3b:0c) Internet Protocol, Src: 192.168.1.15 (192.168.1.15), Dst: 192.168.101.13 (192.168.101.13) Transmission Control Protocol, Src Port: ftp-data (20), Dst Port: 40465 (40465), Seq: 1, Ack: 10137, Len: 0 Source port: ftp-data (20) Destination port: 40465 (40465) Sequence number: 1 (relative sequence number) Acknowledgement number: 10137 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) Window size: 11648 (scaled) Checksum: 0x7776 [correct] Options: (24 bytes) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 23] No. Time Source Destination Protocol Info 26 0.839712 192.168.101.13 192.168.1.15 FTP-DATA [TCP Retransmission] FTP Data: 1448 bytes Frame 26 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: HewlettP_47:49:46 (00:1c:c4:47:49:46), Dst: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29) Internet Protocol, Src: 192.168.101.13 (192.168.101.13), Dst: 192.168.1.15 (192.168.1.15) Transmission Control Protocol, Src Port: 40465 (40465), Dst Port: ftp-data (20), Seq: 10137, Ack: 1, Len: 1448 Source port: 40465 (40465) Destination port: ftp-data (20) Sequence number: 10137 (relative sequence number) [Next sequence number: 11585 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) Window size: 5792 (scaled) Checksum: 0xfd4c [correct] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 25] [The RTT to ACK the segment was: 0.623858000 seconds] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [The RTO for this segment was: 0.623869000 seconds] [RTO based on delta from frame: 24] FTP Data No. Time Source Destination Protocol Info 27 0.839767 192.168.1.15 192.168.101.13 TCP ftp-data > 40465 [ACK] Seq=1 Ack=13033 Win=14592 Len=0 TSV=7677226 TSER=49425 Frame 27 (66 bytes on wire, 66 bytes captured) Ethernet II, Src: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29), Dst: D-Link_53:3b:0c (00:0d:88:53:3b:0c) Internet Protocol, Src: 192.168.1.15 (192.168.1.15), Dst: 192.168.101.13 (192.168.101.13) Transmission Control Protocol, Src Port: ftp-data (20), Dst Port: 40465 (40465), Seq: 1, Ack: 13033, Len: 0 Source port: ftp-data (20) Destination port: 40465 (40465) Sequence number: 1 (relative sequence number) Acknowledgement number: 13033 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 14592 (scaled) Checksum: 0x3085 [correct] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 24] [The RTT to ACK the segment was: 0.623924000 seconds] No. Time Source Destination Protocol Info 28 0.841458 192.168.101.13 192.168.1.15 FTP-DATA [TCP Previous segment lost] FTP Data: 1448 bytes Frame 28 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: HewlettP_47:49:46 (00:1c:c4:47:49:46), Dst: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29) Internet Protocol, Src: 192.168.101.13 (192.168.101.13), Dst: 192.168.1.15 (192.168.1.15) Transmission Control Protocol, Src Port: 40465 (40465), Dst Port: ftp-data (20), Seq: 14481, Ack: 1, Len: 1448 Source port: 40465 (40465) Destination port: ftp-data (20) Sequence number: 14481 (relative sequence number) [Next sequence number: 15929 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 5792 (scaled) Checksum: 0x35c8 [correct] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 27] [The RTT to ACK the segment was: 0.001691000 seconds] [TCP Analysis Flags] [A segment before this frame was lost] FTP Data No. Time Source Destination Protocol Info 29 0.841471 192.168.1.15 192.168.101.13 TCP [TCP Dup ACK 27#1] ftp-data > 40465 [ACK] Seq=1 Ack=13033 Win=14592 Len=0 TSV=7677226 TSER=49425 SLE=14481 SRE=15929 Frame 29 (78 bytes on wire, 78 bytes captured) Ethernet II, Src: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29), Dst: D-Link_53:3b:0c (00:0d:88:53:3b:0c) Internet Protocol, Src: 192.168.1.15 (192.168.1.15), Dst: 192.168.101.13 (192.168.101.13) Transmission Control Protocol, Src Port: ftp-data (20), Dst Port: 40465 (40465), Seq: 1, Ack: 13033, Len: 0 Source port: ftp-data (20) Destination port: 40465 (40465) Sequence number: 1 (relative sequence number) Acknowledgement number: 13033 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) Window size: 14592 (scaled) Checksum: 0x5494 [correct] Options: (24 bytes) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 27] No. Time Source Destination Protocol Info 30 0.842958 192.168.101.13 192.168.1.15 FTP-DATA FTP Data: 1448 bytes Frame 30 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: HewlettP_47:49:46 (00:1c:c4:47:49:46), Dst: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29) Internet Protocol, Src: 192.168.101.13 (192.168.101.13), Dst: 192.168.1.15 (192.168.1.15) Transmission Control Protocol, Src Port: 40465 (40465), Dst Port: ftp-data (20), Seq: 15929, Ack: 1, Len: 1448 Source port: 40465 (40465) Destination port: ftp-data (20) Sequence number: 15929 (relative sequence number) [Next sequence number: 17377 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 5792 (scaled) Checksum: 0x9c77 [correct] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 29] [The RTT to ACK the segment was: 0.001487000 seconds] FTP Data No. Time Source Destination Protocol Info 31 0.842969 192.168.1.15 192.168.101.13 TCP [TCP Dup ACK 27#2] ftp-data > 40465 [ACK] Seq=1 Ack=13033 Win=14592 Len=0 TSV=7677227 TSER=49425 SLE=14481 SRE=17377 Frame 31 (78 bytes on wire, 78 bytes captured) Ethernet II, Src: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29), Dst: D-Link_53:3b:0c (00:0d:88:53:3b:0c) Internet Protocol, Src: 192.168.1.15 (192.168.1.15), Dst: 192.168.101.13 (192.168.101.13) Transmission Control Protocol, Src Port: ftp-data (20), Dst Port: 40465 (40465), Seq: 1, Ack: 13033, Len: 0 Source port: ftp-data (20) Destination port: 40465 (40465) Sequence number: 1 (relative sequence number) Acknowledgement number: 13033 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) Window size: 14592 (scaled) Checksum: 0x4eeb [correct] Options: (24 bytes) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 2] [Duplicate to the ACK in frame: 27] No. Time Source Destination Protocol Info 32 1.049833 192.168.101.13 192.168.1.15 FTP-DATA [TCP Retransmission] FTP Data: 1448 bytes Frame 32 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: HewlettP_47:49:46 (00:1c:c4:47:49:46), Dst: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29) Internet Protocol, Src: 192.168.101.13 (192.168.101.13), Dst: 192.168.1.15 (192.168.1.15) Transmission Control Protocol, Src Port: 40465 (40465), Dst Port: ftp-data (20), Seq: 13033, Ack: 1, Len: 1448 Source port: 40465 (40465) Destination port: ftp-data (20) Sequence number: 13033 (relative sequence number) [Next sequence number: 14481 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 5792 (scaled) Checksum: 0xb312 [correct] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 31] [The RTT to ACK the segment was: 0.206864000 seconds] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [The RTO for this segment was: 0.206875000 seconds] [RTO based on delta from frame: 30] FTP Data No. Time Source Destination Protocol Info 33 1.049863 192.168.1.15 192.168.101.13 TCP ftp-data > 40465 [ACK] Seq=1 Ack=17377 Win=17536 Len=0 TSV=7677278 TSER=49446 Frame 33 (66 bytes on wire, 66 bytes captured) Ethernet II, Src: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29), Dst: D-Link_53:3b:0c (00:0d:88:53:3b:0c) Internet Protocol, Src: 192.168.1.15 (192.168.1.15), Dst: 192.168.101.13 (192.168.101.13) Transmission Control Protocol, Src Port: ftp-data (20), Dst Port: 40465 (40465), Seq: 1, Ack: 17377, Len: 0 Source port: ftp-data (20) Destination port: 40465 (40465) Sequence number: 1 (relative sequence number) Acknowledgement number: 17377 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 17536 (scaled) Checksum: 0x1f2d [correct] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 30] [The RTT to ACK the segment was: 0.206905000 seconds] No. Time Source Destination Protocol Info 34 1.051331 192.168.101.13 192.168.1.15 FTP-DATA [TCP Previous segment lost] FTP Data: 1448 bytes Frame 34 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: HewlettP_47:49:46 (00:1c:c4:47:49:46), Dst: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29) Internet Protocol, Src: 192.168.101.13 (192.168.101.13), Dst: 192.168.1.15 (192.168.1.15) Transmission Control Protocol, Src Port: 40465 (40465), Dst Port: ftp-data (20), Seq: 18825, Ack: 1, Len: 1448 Source port: 40465 (40465) Destination port: ftp-data (20) Sequence number: 18825 (relative sequence number) [Next sequence number: 20273 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 5792 (scaled) Checksum: 0xb6a5 [correct] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 33] [The RTT to ACK the segment was: 0.001468000 seconds] [TCP Analysis Flags] [A segment before this frame was lost] FTP Data No. Time Source Destination Protocol Info 35 1.051356 192.168.1.15 192.168.101.13 TCP [TCP Dup ACK 33#1] ftp-data > 40465 [ACK] Seq=1 Ack=17377 Win=17536 Len=0 TSV=7677279 TSER=49446 SLE=18825 SRE=20273 Frame 35 (78 bytes on wire, 78 bytes captured) Ethernet II, Src: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29), Dst: D-Link_53:3b:0c (00:0d:88:53:3b:0c) Internet Protocol, Src: 192.168.1.15 (192.168.1.15), Dst: 192.168.101.13 (192.168.101.13) Transmission Control Protocol, Src Port: ftp-data (20), Dst Port: 40465 (40465), Seq: 1, Ack: 17377, Len: 0 Source port: ftp-data (20) Destination port: 40465 (40465) Sequence number: 1 (relative sequence number) Acknowledgement number: 17377 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) Window size: 17536 (scaled) Checksum: 0x214b [correct] Options: (24 bytes) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 33] No. Time Source Destination Protocol Info 36 1.053083 192.168.101.13 192.168.1.15 FTP-DATA [TCP Previous segment lost] FTP Data: 1448 bytes Frame 36 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: HewlettP_47:49:46 (00:1c:c4:47:49:46), Dst: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29) Internet Protocol, Src: 192.168.101.13 (192.168.101.13), Dst: 192.168.1.15 (192.168.1.15) Transmission Control Protocol, Src Port: 40465 (40465), Dst Port: ftp-data (20), Seq: 23169, Ack: 1, Len: 1448 Source port: 40465 (40465) Destination port: ftp-data (20) Sequence number: 23169 (relative sequence number) [Next sequence number: 24617 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 5792 (scaled) Checksum: 0xeccc [correct] Options: (12 bytes) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 35] [The RTT to ACK the segment was: 0.001727000 seconds] [TCP Analysis Flags] [A segment before this frame was lost] FTP Data No. Time Source Destination Protocol Info 37 1.053094 192.168.1.15 192.168.101.13 TCP [TCP Dup ACK 33#2] ftp-data > 40465 [ACK] Seq=1 Ack=17377 Win=17536 Len=0 TSV=7677279 TSER=49446 SLE=23169 SRE=24617 SLE=18825 SRE=20273 Frame 37 (86 bytes on wire, 86 bytes captured) Ethernet II, Src: G-ProCom_2f:ed:29 (00:0f:fe:2f:ed:29), Dst: D-Link_53:3b:0c (00:0d:88:53:3b:0c) Internet Protocol, Src: 192.168.1.15 (192.168.1.15), Dst: 192.168.101.13 (192.168.101.13) Transmission Control Protocol, Src Port: ftp-data (20), Dst Port: 40465 (40465), Seq: 1, Ack: 17377, Len: 0 Source port: ftp-data (20) Destination port: 40465 (40465) Sequence number: 1 (relative sequence number) Acknowledgement number: 17377 (relative ack number) Header length: 52 bytes Flags: 0x10 (ACK) Window size: 17536 (scaled) Checksum: 0x1781 [correct] Options: (32 bytes) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 2] [Duplicate to the ACK in frame: 33] > > > -- > i. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists