Problème MTU / MSS ? : Support Debian

Voir les messages sans réponses | Voir les sujets actifs

Problème MTU / MSS ?

Page 1 sur 2

[ 39 messages ]

Aller à la page 1, 2 Suivante

Sujet précédent | Voir le premier message non lu | Sujet suivant

Auteur

Message

Thomas

Sujet du message: Problème MTU / MSS ?

Posté: 12 Avr 2012 16:39

Nouvel utilisateur

Inscription: 12 Avr 2012 16:18
Messages: 17

Bonjour

J'ai un site qui permet de synchroniser ses données avec son téléphone, et certains utilisateurs n'y arrivent pas car une trame HTTP n'est pas totalement reçu par le serveur (pour info serveur Apache avec req_timeout body=20s.)

Ce problème survient avec les téléphones qui se connectent via leur opérateur (en Wifi ça marche)

J'ai longtemps pensé que ça venait du MTU et du MSS de la carte réseau (qui est à 1500), j'ai alors ajouté la règle iptables:

Code:

iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o eth0 -j TCPMSS --clamp-mss-to-pmtu

Mais ça ne corrige pas problème ....

Voici une trace ethereal pour voir le problème:

Code:

Time        Source          Destination       Protocol Length   Info
196846   188.89.67.221     88.190.31.67      TCP      60     54828 > http [SYN] Seq=0 Win=49640 Len=0 MSS=1460
196967   88.190.31.67      188.89.67.221     TCP      58     http > 54828 [SYN, ACK] Seq=0 Ack=1 Win=5808 Len=0 MSS=1452
216133   188.89.67.221     88.190.31.67      TCP      60     54828 > http [ACK] Seq=1 Ack=1 Win=65535 Len=0
216824   188.89.67.221     88.190.31.67      TCP      401    [TCP segment of a reassembled PDU]
216952   88.190.31.67      188.89.67.221     TCP      54     http > 54828 [ACK] Seq=1 Ack=348 Win=6432 Len=0
216967   188.89.67.221     88.190.31.67      TCP      1202   [TCP segment of a reassembled PDU]
217067   88.190.31.67      188.89.67.221     TCP      54     http > 54828 [ACK] Seq=1 Ack=1496 Win=8036 Len=0
559194   88.190.31.67      188.89.67.221     HTTP     373    HTTP/1.1 100 continue 
559321   88.190.31.67      188.89.67.221     TCP      54     http > 54828 [FIN, ACK] Seq=320 Ack=1496 Win=8036 Len=0
578906   188.89.67.221     88.190.31.67      TCP      60     [TCP Previous segment lost] 54828 > http [ACK] Seq=8796 Ack=320 Win=49640 Len=0
579292   188.89.67.221     88.190.31.67      TCP      60     54828 > http [ACK] Seq=8796 Ack=321 Win=49640 Len=0

Et le résutat HTTP: (Content-Length=61459 et body reçu=environ 1000 octets)

Code:

POST /syncml?sid=hg29brcm6jtbpvuffpns0sk9l5 HTTP/1.1
Content-Language: nl
Content-Type: application/vnd.syncml+xml
Content-Length: 61459
User-Agent: Funambol BlackBerry Plug-in 10.0.7
Device-Agent: RIM Wireless Handheld MIDP-2.0 CLDC-1.1
Accept-Encoding: gzip
Host: sync.memotoo.com
Cache-Control: max-age=43200
Connection: keep-alive

<SyncML>
<SyncHdr>
<VerDTD>1.2</VerDTD>
<VerProto>SyncML/1.2</VerProto>
<SessionID>1332755332471</SessionID>
<MsgID>2</MsgID>
<Target>
<LocURI>http://sync.memotoo.com/syncml?sid=hg29brcm6jtbpvuffpns0sk9l5</LocURI>
</Target>
<Source>
<LocURI>fbb-630432428</LocURI>
</Source>
</SyncHdr>
<SyncBody>
<Status>
<CmdID>1</CmdID>
<MsgRef>1</MsgRef>
<CmdRef>0</CmdRef>
<Cmd>SyncHdr</Cmd>
<TargetRef>fbb-630432428</TargetRef>
<SourceRef>http://sync.memotoo.com/syncml?sid=hg29brcm6jtbpvuffpns0sk9l5</SourceRef>
<Data>200</Data>
</Status>
<Status>
<CmdID>2</CmdID>
<MsgRef>1</MsgRef>
<CmdRef>3</CmdRef>
<Cmd>Alert</Cmd>
<TargetRef>card</TargetRef>
<SourceRef>Contacts</SourceRef>
<Data>200</Data>
<Item>
<Data>
<Anchor xmlns="syncml:metinf">
<Next>1332755335000</Next>
</Anchor>
</Data>
</Item>
</Status>
<Sync>
<CmdID>3</CmdID>
<Target>
<LocURI>card</LocURI>
</Target>
<Source>
<LocURI>Contacts</LocURI>
</Source>
<Replace>
<CmdID>4</CmdID>
<Item>
<Source>
<LocURI>1193640228</LocURI>
</Source>
<Meta>
<Type xmlns="syncml:metinf">text/x-vcard</Type>
</Meta>
<Data>BEGIN:VCARD
VERSION:2.1
N:Bats;Jan-Jaap;;;
TEL;VOICE;HOME:+31 53 428 09 50
TEL;VOICE;HOME:

HTTP/1.1 100 continue
Date: Mon, 26 Mar 2012 09:49:19 GMT
Server: Apache/2.2.16 (Debian)
X-Powered-By: PHP/5.3.3-7+squeeze8
Set-Cookie: PHPSESSID=hg29brcm6jtbpvuffpns0sk9l5; path=/
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 20
Connection: close
Content-Type: text/html

Au bout de 20 seconde, le serveur renvoit le code "100 continue" pour dire va s'y continue mais ça ne marche pas.

Si vous avez des idées ce serait super car je sèches un peu.

Merci !
Thomas

Haut

Niloo

Sujet du message: Re: Problème MTU / MSS ?

Posté: 12 Avr 2012 19:43

Très bavard(e)!

Inscription: 25 Oct 2007 15:42
Messages: 634

As-tu testé avec un plus petit MTU et/ou un plus grand req_timeout_body ?

A propos du MTU, je dis cela car j'ai administré un certain nombre de serveur et service sur une plateforme de test dans le cadre de validation LTE (4G) chez un constructeur en télécommunication.
Je me suis rendu compte qu'il fallait baisser le MTU pour que tous les flux passent.

Avec la commande suivante on testait le MTU max du payload :
ping -l 1300 -f google.fr
Si le paquet devait être fragmenté alors il fallait baisser le MTU.

_________________
Hébergement web - Infogérance

Haut

PascalHambourg

Sujet du message: Re: Problème MTU / MSS ?

Posté: 12 Avr 2012 23:52

Contributeur

Inscription: 18 Déc 2007 00:11
Messages: 4783

Ouais, --clamp-mss-to-pmtu ne sert à rien si le MTU des routes liées à l'interface est à 1500.
Accessoirement, cela ne sert que sur un routeur intermédiaire, pas sur la machine source puisqu'il suffit de baisser le MTU de l'interface pour faire baisser d'autant le MSS annoncé.

_________________
Attention : contributeur méchant !
Pentium III 550 MHz, RAM 128 Mio, disque 4,3 Go. Debian Squeeze avec noyau Linux maison. On ne rit pas ! c'est mon nouveau serveur+routeur ADSL.

Haut

Thomas

Sujet du message: Re: Problème MTU / MSS ?

Posté: 13 Avr 2012 14:35

Nouvel utilisateur

Inscription: 12 Avr 2012 16:18
Messages: 17

Merci pour vos remarques

@nillo: alors j'ai testé ta commande et j'ai des packets perdu. (mon MTU est à 1492: avant il était à 1500 mais je l'ai changé il y a 3 mois). Quelle valeur dis-tu par "plus petit MTU" -> 1300 ? ou plus petit ?
Ce message "WARNING: probably, rcvbuf is not enough to hold preload." est un problème à corriger ?

Code:

ping -l 1300 -f google.fr
WARNING: probably, rcvbuf is not enough to hold preload.
PING google.fr (173.194.67.94) 56(84) bytes of data.
.............................................................................
--- google.fr ping statistics ---
7483 packets transmitted, 7406 received, 1% packet loss, time 4434ms
rtt min/avg/max/mdev = 10.967/11.095/14.148/0.165 ms, pipe 36, ipg/ewma 0.592/11.108 ms

@PascalHambourg: Je penses que le clamp-mss-to-pmtu marche à peu près car il est en POSTROUTING. Mais je suis d'accord avec toi ça marcherait mieux sur un routeur.

Ce qui est quand même étonnant c'est que j'ai un "TCP Previous segment lost" dans la trace ethereal. Est-ce une piste à suivre ?

Haut

Niloo

Sujet du message: Re: Problème MTU / MSS ?

Posté: 13 Avr 2012 22:23

Très bavard(e)!

Inscription: 25 Oct 2007 15:42
Messages: 634

Oui plus petit MTU.
Par défaut c'est 1500, je devais le passer à 1400 voir 1300 dans certains cas.
Tout cela à cause de l'encapsulation de la norme 3GPP entre le mobile (téléphone, clé usb, ...) et le coeur de réseau.

Après ce n'est qu'une hypothèse ...

Au passage c'est Niloo

_________________
Hébergement web - Infogérance

Haut

PascalHambourg

Sujet du message: Re: Problème MTU / MSS ?

Posté: 14 Avr 2012 10:34

Contributeur

Inscription: 18 Déc 2007 00:11
Messages: 4783

Thomas a écrit:

Je penses que le clamp-mss-to-pmtu marche à peu près car il est en POSTROUTING.

Cela ne suffit pas le rendre efficace. Il est important de bien comprendre comment fonctionne l'option --clamp-mss-to-pmtu de la cible TCPMSS pour l'utiliser correctement.

Elle compare le MSS contenu dans les paquets TCP SYN avec le MSS calculé à partir du MTU de la route utilisée pour router l'adresse de destination du paquet (égal au MTU de l'interface de sortie, sauf cas particuliers), et remplace le MSS dans le paquet par le MSS de la route si ce dernier est inférieur. Or la machine émettrice utilise la même formule de calcul pour définir le MSS initial, donc la valeur calculée par l'option --clamp-mss-to-pmtu sur la machine émettrice sera identique et cela n'aura aucun effet.

L'option --clamp-mss-to-pmtu a un effet lorsqu'elle fonctionne sur un routeur intermédiaire distinct, dont l'interface de sortie à un MTU inférieur au MTU de l'interface de sortie de la machine source, ce que cette dernière ne sait pas forcément à priori. Pour réduire le MSS sur la machine émettrice, il faut soit réduire le MTU de l'interface, soit créer une route pour la destination correspondante avec un MTU ou un MSS réduit, soit utiliser TCPMSS avec l'option "--set-mss <valeur>" pour fixer la valeur de MSS manuellement (de préférence combinée à la correspondance "-m tcpmss --mss <valeur>:<mtu>" pour ne pas augmenter le MSS s'il est déjà inférieur à la valeur maximum désirée).

Concernant la perte de paquets de 1% avec le ping flood, ce n'est pas un résultat anormal. Mais je ne suis pas certain qu'il soit pertinent. L'option -l spécifie le nombre de paquets envoyés sans attendre de réponse, alors que je pense que Niloo voulait plutôt spécifier la taille des paquets qui se règle avec l'option -s. De toute façon cibler Google n'a pas vraiment d'intérêt dans ce contexte ; il faudrait plutôt cibler l'adresse IP de la connexion mobile qui pose problème, ou faire le ping dans l'autre sens, de la connexion mobile vers le serveur.

_________________
Attention : contributeur méchant !
Pentium III 550 MHz, RAM 128 Mio, disque 4,3 Go. Debian Squeeze avec noyau Linux maison. On ne rit pas ! c'est mon nouveau serveur+routeur ADSL.

Haut

Thomas

Sujet du message: Re: Problème MTU / MSS ?

Posté: 14 Avr 2012 13:04

Nouvel utilisateur

Inscription: 12 Avr 2012 16:18
Messages: 17

@Niloo: Excuse c'était une erreur de frappe

@PascalHambourg: Merci pour ces précisions très détaillée

Donc j'ai passé mes serveurs en MTU 1300 (en ligne de commande avec ifconfig), mais problème y est toujours.
J'ai aussi remis les valeurs par défaut d'une débian pour /proc/sys/net/ipv4/tcp_*

Les utilisateurs qui ont eu un problème ce matin, avaient un MSS de 1460, 1360, 1452, 1300, ... En SSL et pas SSL. Par contre je ne vois pas d'érreur en ipv6 (je ne sais pas si ça joue ou que peu d'utilisateur sont en ipv6)

D'autres idées ???

Haut

PascalHambourg

Sujet du message: Re: Problème MTU / MSS ?

Posté: 14 Avr 2012 13:49

Contributeur

Inscription: 18 Déc 2007 00:11
Messages: 4783

Tu peux encore baisser le MTU de l'interface à 1280. En dessous, tu perds l'IPv6 qui exige un MTU de 1280 au moins. Pour le baisser en-dessous en IPv4, il faut soit modifier la route par défaut IPv4, soit jouer avec TCPMSS --set-mtu.

Mais la trace d'ethereal n'est pas très explicite concernant les [TCP segment of a reassembled PDU], il faudrait plus de détails sur ces paquets (fragments ?). En tout cas la taille maxi de paquet qu'on voit passer est 1202. La fin de la trace montre que le client indique avoir envoyé 8796 octets mais le serveur n'en a acquitté (donc reçu) que 1496.

_________________
Attention : contributeur méchant !
Pentium III 550 MHz, RAM 128 Mio, disque 4,3 Go. Debian Squeeze avec noyau Linux maison. On ne rit pas ! c'est mon nouveau serveur+routeur ADSL.

Haut

Thomas

Sujet du message: Re: Problème MTU / MSS ?

Posté: 14 Avr 2012 14:32

Nouvel utilisateur

Inscription: 12 Avr 2012 16:18
Messages: 17

Je n'ai pas trop envie de encore baisser la MTU car les utilisateurs qui ont des problèmes ont des MSS plus haut que le MTU.

Voilà le detail de la trame si tu vois quelquechose ??

Code:

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      5 23.196846   188.89.67.221         88.190.31.67          TCP      60     54828 > http [SYN] Seq=0 Win=49640 Len=0 MSS=1460               5

Frame 5: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
    Arrival Time: Mar 26, 2012 11:49:19.426786000 CEST
    Epoch Time: 1332755359.426786000 seconds
    [Time delta from previous captured frame: 23.196618000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 23.196846000 seconds]
    Frame Number: 5
    Frame Length: 60 bytes (480 bits)
    Capture Length: 60 bytes (480 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: Cisco_f6:94:7f (00:25:45:f6:94:7f), Dst: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
    Destination: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
    Trailer: 0000
Internet Protocol Version 4, Src: 188.89.67.221 (188.89.67.221), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 44
    Identification: 0xae0d (44557)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 49
    Protocol: TCP (6)
    Header checksum: 0x2387 [correct]
        [Good: True]
        [Bad: False]
    Source: 188.89.67.221 (188.89.67.221)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 54828 (54828), Dst Port: http (80), Seq: 0, Len: 0
    Source port: 54828 (54828)
    Destination port: http (80)
    [Stream index: 1]
    Sequence number: 0    (relative sequence number)
    Header length: 24 bytes
    Flags: 0x02 (SYN)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...0 .... = Acknowledgement: Not set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..1. = Syn: Set
            [Expert Info (Chat/Sequence): Connection establish request (SYN): server port http]
                [Message: Connection establish request (SYN): server port http]
                [Severity level: Chat]
                [Group: Sequence]
        .... .... ...0 = Fin: Not set
    Window size value: 49640
    [Calculated window size: 49640]
    Checksum: 0x9910 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (4 bytes)
        Maximum segment size: 1460 bytes

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      6 23.196967   88.190.31.67          188.89.67.221         TCP      58     http > 54828 [SYN, ACK] Seq=0 Ack=1 Win=5808 Len=0 MSS=1452     6

Frame 6: 58 bytes on wire (464 bits), 58 bytes captured (464 bits)
    Arrival Time: Mar 26, 2012 11:49:19.426907000 CEST
    Epoch Time: 1332755359.426907000 seconds
    [Time delta from previous captured frame: 0.000121000 seconds]
    [Time delta from previous displayed frame: 0.000121000 seconds]
    [Time since reference or first frame: 23.196967000 seconds]
    Frame Number: 6
    Frame Length: 58 bytes (464 bits)
    Capture Length: 58 bytes (464 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff), Dst: Cisco_f6:94:7f (00:25:45:f6:94:7f)
    Destination: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 88.190.31.67 (88.190.31.67), Dst: 188.89.67.221 (188.89.67.221)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 44
    Identification: 0x0000 (0)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: TCP (6)
    Header checksum: 0xc294 [correct]
        [Good: True]
        [Bad: False]
    Source: 88.190.31.67 (88.190.31.67)
    Destination: 188.89.67.221 (188.89.67.221)
Transmission Control Protocol, Src Port: http (80), Dst Port: 54828 (54828), Seq: 0, Ack: 1, Len: 0
    Source port: http (80)
    Destination port: 54828 (54828)
    [Stream index: 1]
    Sequence number: 0    (relative sequence number)
    Acknowledgement number: 1    (relative ack number)
    Header length: 24 bytes
    Flags: 0x12 (SYN, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..1. = Syn: Set
            [Expert Info (Chat/Sequence): Connection establish acknowledge (SYN+ACK): server port http]
                [Message: Connection establish acknowledge (SYN+ACK): server port http]
                [Severity level: Chat]
                [Group: Sequence]
        .... .... ...0 = Fin: Not set
    Window size value: 5808
    [Calculated window size: 5808]
    Checksum: 0x121e [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (4 bytes)
        Maximum segment size: 1452 bytes
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 5]
        [The RTT to ACK the segment was: 0.000121000 seconds]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      7 23.216133   188.89.67.221         88.190.31.67          TCP      60     54828 > http [ACK] Seq=1 Ack=1 Win=65535 Len=0                  7

Frame 7: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
    Arrival Time: Mar 26, 2012 11:49:19.446073000 CEST
    Epoch Time: 1332755359.446073000 seconds
    [Time delta from previous captured frame: 0.019166000 seconds]
    [Time delta from previous displayed frame: 0.019166000 seconds]
    [Time since reference or first frame: 23.216133000 seconds]
    Frame Number: 7
    Frame Length: 60 bytes (480 bits)
    Capture Length: 60 bytes (480 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: Cisco_f6:94:7f (00:25:45:f6:94:7f), Dst: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
    Destination: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
    Trailer: 0000
Internet Protocol Version 4, Src: 188.89.67.221 (188.89.67.221), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 44
    Identification: 0x0000 (0)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 40
    Protocol: TCP (6)
    Header checksum: 0xda94 [correct]
        [Good: True]
        [Bad: False]
    Source: 188.89.67.221 (188.89.67.221)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 54828 (54828), Dst Port: http (80), Seq: 1, Ack: 1, Len: 0
    Source port: 54828 (54828)
    Destination port: http (80)
    [Stream index: 1]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 1    (relative ack number)
    Header length: 24 bytes
    Flags: 0x10 (ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 65535
    [Calculated window size: 65535]
    [Window size scaling factor: -2 (no window scaling used)]
    Checksum: 0x2e7d [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (4 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        No-Operation (NOP)
        No-Operation (NOP)
        [Expert Info (Warn/Protocol): 4 NOP in a row - a router may have removed some options]
            [Message: 4 NOP in a row - a router may have removed some options]
            [Severity level: Warn]
            [Group: Protocol]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 6]
        [The RTT to ACK the segment was: 0.019166000 seconds]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      8 23.216824   188.89.67.221         88.190.31.67          TCP      401    [TCP segment of a reassembled PDU]                              8

Frame 8: 401 bytes on wire (3208 bits), 401 bytes captured (3208 bits)
    Arrival Time: Mar 26, 2012 11:49:19.446764000 CEST
    Epoch Time: 1332755359.446764000 seconds
    [Time delta from previous captured frame: 0.000691000 seconds]
    [Time delta from previous displayed frame: 0.000691000 seconds]
    [Time since reference or first frame: 23.216824000 seconds]
    Frame Number: 8
    Frame Length: 401 bytes (3208 bits)
    Capture Length: 401 bytes (3208 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: Cisco_f6:94:7f (00:25:45:f6:94:7f), Dst: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
    Destination: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 188.89.67.221 (188.89.67.221), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 387
    Identification: 0xae0e (44558)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 49
    Protocol: TCP (6)
    Header checksum: 0x222f [correct]
        [Good: True]
        [Bad: False]
    Source: 188.89.67.221 (188.89.67.221)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 54828 (54828), Dst Port: http (80), Seq: 1, Ack: 1, Len: 347
    Source port: 54828 (54828)
    Destination port: http (80)
    [Stream index: 1]
    Sequence number: 1    (relative sequence number)
    [Next sequence number: 348    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 49640
    [Calculated window size: 49640]
    [Window size scaling factor: -2 (no window scaling used)]
    Checksum: 0xba5e [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    [SEQ/ACK analysis]
        [Bytes in flight: 347]
    TCP segment data (347 bytes)

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      9 23.216952   88.190.31.67          188.89.67.221         TCP      54     http > 54828 [ACK] Seq=1 Ack=348 Win=6432 Len=0                 9

Frame 9: 54 bytes on wire (432 bits), 54 bytes captured (432 bits)
    Arrival Time: Mar 26, 2012 11:49:19.446892000 CEST
    Epoch Time: 1332755359.446892000 seconds
    [Time delta from previous captured frame: 0.000128000 seconds]
    [Time delta from previous displayed frame: 0.000128000 seconds]
    [Time since reference or first frame: 23.216952000 seconds]
    Frame Number: 9
    Frame Length: 54 bytes (432 bits)
    Capture Length: 54 bytes (432 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff), Dst: Cisco_f6:94:7f (00:25:45:f6:94:7f)
    Destination: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 88.190.31.67 (88.190.31.67), Dst: 188.89.67.221 (188.89.67.221)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 40
    Identification: 0x52de (21214)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: TCP (6)
    Header checksum: 0x6fba [correct]
        [Good: True]
        [Bad: False]
    Source: 88.190.31.67 (88.190.31.67)
    Destination: 188.89.67.221 (188.89.67.221)
Transmission Control Protocol, Src Port: http (80), Dst Port: 54828 (54828), Seq: 1, Ack: 348, Len: 0
    Source port: http (80)
    Destination port: 54828 (54828)
    [Stream index: 1]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 348    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 6432
    [Calculated window size: 6432]
    [Window size scaling factor: -2 (no window scaling used)]
    Checksum: 0x2608 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 8]
        [The RTT to ACK the segment was: 0.000128000 seconds]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     10 23.216967   188.89.67.221         88.190.31.67          TCP      1202   [TCP segment of a reassembled PDU]                              10

Frame 10: 1202 bytes on wire (9616 bits), 1202 bytes captured (9616 bits)
    Arrival Time: Mar 26, 2012 11:49:19.446907000 CEST
    Epoch Time: 1332755359.446907000 seconds
    [Time delta from previous captured frame: 0.000015000 seconds]
    [Time delta from previous displayed frame: 0.000015000 seconds]
    [Time since reference or first frame: 23.216967000 seconds]
    Frame Number: 10
    Frame Length: 1202 bytes (9616 bits)
    Capture Length: 1202 bytes (9616 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: Cisco_f6:94:7f (00:25:45:f6:94:7f), Dst: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
    Destination: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 188.89.67.221 (188.89.67.221), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 1188
    Identification: 0xae0f (44559)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 49
    Protocol: TCP (6)
    Header checksum: 0x1f0d [correct]
        [Good: True]
        [Bad: False]
    Source: 188.89.67.221 (188.89.67.221)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 54828 (54828), Dst Port: http (80), Seq: 348, Ack: 1, Len: 1148
    Source port: 54828 (54828)
    Destination port: http (80)
    [Stream index: 1]
    Sequence number: 348    (relative sequence number)
    [Next sequence number: 1496    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x18 (PSH, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 1... = Push: Set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 49640
    [Calculated window size: 49640]
    [Window size scaling factor: -2 (no window scaling used)]
    Checksum: 0xf650 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    [SEQ/ACK analysis]
        [Bytes in flight: 1148]
    TCP segment data (1148 bytes)

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     11 23.217067   88.190.31.67          188.89.67.221         TCP      54     http > 54828 [ACK] Seq=1 Ack=1496 Win=8036 Len=0                11

Frame 11: 54 bytes on wire (432 bits), 54 bytes captured (432 bits)
    Arrival Time: Mar 26, 2012 11:49:19.447007000 CEST
    Epoch Time: 1332755359.447007000 seconds
    [Time delta from previous captured frame: 0.000100000 seconds]
    [Time delta from previous displayed frame: 0.000100000 seconds]
    [Time since reference or first frame: 23.217067000 seconds]
    Frame Number: 11
    Frame Length: 54 bytes (432 bits)
    Capture Length: 54 bytes (432 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff), Dst: Cisco_f6:94:7f (00:25:45:f6:94:7f)
    Destination: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 88.190.31.67 (88.190.31.67), Dst: 188.89.67.221 (188.89.67.221)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 40
    Identification: 0x52df (21215)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: TCP (6)
    Header checksum: 0x6fb9 [correct]
        [Good: True]
        [Bad: False]
    Source: 88.190.31.67 (88.190.31.67)
    Destination: 188.89.67.221 (188.89.67.221)
Transmission Control Protocol, Src Port: http (80), Dst Port: 54828 (54828), Seq: 1, Ack: 1496, Len: 0
    Source port: http (80)
    Destination port: 54828 (54828)
    [Stream index: 1]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 1496    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 8036
    [Calculated window size: 8036]
    [Window size scaling factor: -2 (no window scaling used)]
    Checksum: 0x1b48 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 10]
        [The RTT to ACK the segment was: 0.000100000 seconds]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     12 45.559194   88.190.31.67          188.89.67.221         HTTP     373    HTTP/1.1 100 continue                                           12

Frame 12: 373 bytes on wire (2984 bits), 373 bytes captured (2984 bits)
    Arrival Time: Mar 26, 2012 11:49:41.789134000 CEST
    Epoch Time: 1332755381.789134000 seconds
    [Time delta from previous captured frame: 22.342127000 seconds]
    [Time delta from previous displayed frame: 22.342127000 seconds]
    [Time since reference or first frame: 45.559194000 seconds]
    Frame Number: 12
    Frame Length: 373 bytes (2984 bits)
    Capture Length: 373 bytes (2984 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp:http:data]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff), Dst: Cisco_f6:94:7f (00:25:45:f6:94:7f)
    Destination: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 88.190.31.67 (88.190.31.67), Dst: 188.89.67.221 (188.89.67.221)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 359
    Identification: 0x52e0 (21216)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: TCP (6)
    Header checksum: 0x6e79 [correct]
        [Good: True]
        [Bad: False]
    Source: 88.190.31.67 (88.190.31.67)
    Destination: 188.89.67.221 (188.89.67.221)
Transmission Control Protocol, Src Port: http (80), Dst Port: 54828 (54828), Seq: 1, Ack: 1496, Len: 319
    Source port: http (80)
    Destination port: 54828 (54828)
    [Stream index: 1]
    Sequence number: 1    (relative sequence number)
    [Next sequence number: 320    (relative sequence number)]
    Acknowledgement number: 1496    (relative ack number)
    Header length: 20 bytes
    Flags: 0x18 (PSH, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 1... = Push: Set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 8036
    [Calculated window size: 8036]
    [Window size scaling factor: -2 (no window scaling used)]
    Checksum: 0x7991 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    [SEQ/ACK analysis]
        [Bytes in flight: 319]
Hypertext Transfer Protocol
    HTTP/1.1 100 continue\r\n
        [Expert Info (Chat/Sequence): HTTP/1.1 100 continue\r\n]
            [Message: HTTP/1.1 100 continue\r\n]
            [Severity level: Chat]
            [Group: Sequence]
        Request Version: HTTP/1.1
        Status Code: 100
        Response Phrase: continue
    Date: Mon, 26 Mar 2012 09:49:19 GMT\r\n
    Server: Apache/2.2.16 (Debian)\r\n
    X-Powered-By: PHP/5.3.3-7+squeeze8\r\n
    Set-Cookie: PHPSESSID=hg29brcm6jtbpvuffpns0sk9l5; path=/\r\n
    Vary: Accept-Encoding\r\n
    Content-Encoding: gzip\r\n
    Content-Length: 20\r\n
        [Content length: 20]
    Connection: close\r\n
    Content-Type: text/html\r\n
    \r\n
    Content-encoded entity body (gzip): 20 bytes [Error: Decompression failed]
        Data (20 bytes)

0000  1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00   ................
0010  00 00 00 00                                       ....
            Data: 1f8b080000000000000303000000000000000000
            [Length: 20]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     13 45.559321   88.190.31.67          188.89.67.221         TCP      54     http > 54828 [FIN, ACK] Seq=320 Ack=1496 Win=8036 Len=0         13

Frame 13: 54 bytes on wire (432 bits), 54 bytes captured (432 bits)
    Arrival Time: Mar 26, 2012 11:49:41.789261000 CEST
    Epoch Time: 1332755381.789261000 seconds
    [Time delta from previous captured frame: 0.000127000 seconds]
    [Time delta from previous displayed frame: 0.000127000 seconds]
    [Time since reference or first frame: 45.559321000 seconds]
    Frame Number: 13
    Frame Length: 54 bytes (432 bits)
    Capture Length: 54 bytes (432 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff), Dst: Cisco_f6:94:7f (00:25:45:f6:94:7f)
    Destination: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 88.190.31.67 (88.190.31.67), Dst: 188.89.67.221 (188.89.67.221)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 40
    Identification: 0x52e1 (21217)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: TCP (6)
    Header checksum: 0x6fb7 [correct]
        [Good: True]
        [Bad: False]
    Source: 88.190.31.67 (88.190.31.67)
    Destination: 188.89.67.221 (188.89.67.221)
Transmission Control Protocol, Src Port: http (80), Dst Port: 54828 (54828), Seq: 320, Ack: 1496, Len: 0
    Source port: http (80)
    Destination port: 54828 (54828)
    [Stream index: 1]
    Sequence number: 320    (relative sequence number)
    Acknowledgement number: 1496    (relative ack number)
    Header length: 20 bytes
    Flags: 0x11 (FIN, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...1 = Fin: Set
            [Expert Info (Chat/Sequence): Connection finish (FIN)]
                [Message: Connection finish (FIN)]
                [Severity level: Chat]
                [Group: Sequence]
    Window size value: 8036
    [Calculated window size: 8036]
    [Window size scaling factor: -2 (no window scaling used)]
    Checksum: 0x1a08 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     14 45.578906   188.89.67.221         88.190.31.67          TCP      60     [TCP Previous segment lost] 54828 > http [ACK] Seq=8796 Ack=320 Win=49640 Len=0 14

Frame 14: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
    Arrival Time: Mar 26, 2012 11:49:41.808846000 CEST
    Epoch Time: 1332755381.808846000 seconds
    [Time delta from previous captured frame: 0.019585000 seconds]
    [Time delta from previous displayed frame: 0.019585000 seconds]
    [Time since reference or first frame: 45.578906000 seconds]
    Frame Number: 14
    Frame Length: 60 bytes (480 bits)
    Capture Length: 60 bytes (480 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: Bad TCP]
    [Coloring Rule String: tcp.analysis.flags]
Ethernet II, Src: Cisco_f6:94:7f (00:25:45:f6:94:7f), Dst: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
    Destination: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
    Trailer: 000000000000
Internet Protocol Version 4, Src: 188.89.67.221 (188.89.67.221), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 40
    Identification: 0xae17 (44567)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 49
    Protocol: TCP (6)
    Header checksum: 0x2381 [correct]
        [Good: True]
        [Bad: False]
    Source: 188.89.67.221 (188.89.67.221)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 54828 (54828), Dst Port: http (80), Seq: 8796, Ack: 320, Len: 0
    Source port: 54828 (54828)
    Destination port: http (80)
    [Stream index: 1]
    Sequence number: 8796    (relative sequence number)
    Acknowledgement number: 320    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 49640
    [Calculated window size: 49640]
    [Window size scaling factor: -2 (no window scaling used)]
    Checksum: 0x5b00 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 12]
        [The RTT to ACK the segment was: 0.019712000 seconds]
        [TCP Analysis Flags]
            [A segment before this frame was lost]
                [Expert Info (Warn/Sequence): Previous segment lost (common at capture start)]
                    [Message: Previous segment lost (common at capture start)]
                    [Severity level: Warn]
                    [Group: Sequence]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     15 45.579292   188.89.67.221         88.190.31.67          TCP      60     54828 > http [ACK] Seq=8796 Ack=321 Win=49640 Len=0             15

Frame 15: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
    Arrival Time: Mar 26, 2012 11:49:41.809232000 CEST
    Epoch Time: 1332755381.809232000 seconds
    [Time delta from previous captured frame: 0.000386000 seconds]
    [Time delta from previous displayed frame: 0.000386000 seconds]
    [Time since reference or first frame: 45.579292000 seconds]
    Frame Number: 15
    Frame Length: 60 bytes (480 bits)
    Capture Length: 60 bytes (480 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: Cisco_f6:94:7f (00:25:45:f6:94:7f), Dst: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
    Destination: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
    Trailer: 000000000000
Internet Protocol Version 4, Src: 188.89.67.221 (188.89.67.221), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 40
    Identification: 0xae18 (44568)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 49
    Protocol: TCP (6)
    Header checksum: 0x2380 [correct]
        [Good: True]
        [Bad: False]
    Source: 188.89.67.221 (188.89.67.221)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 54828 (54828), Dst Port: http (80), Seq: 8796, Ack: 321, Len: 0
    Source port: 54828 (54828)
    Destination port: http (80)
    [Stream index: 1]
    Sequence number: 8796    (relative sequence number)
    Acknowledgement number: 321    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 49640
    [Calculated window size: 49640]
    [Window size scaling factor: -2 (no window scaling used)]
    Checksum: 0x5aff [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 13]
        [The RTT to ACK the segment was: 0.019971000 seconds]

Haut

PascalHambourg

Sujet du message: Re: Problème MTU / MSS ?

Posté: 14 Avr 2012 14:58

Contributeur

Inscription: 18 Déc 2007 00:11
Messages: 4783

Thomas a écrit:

Je n'ai pas trop envie de encore baisser la MTU car les utilisateurs qui ont des problèmes ont des MSS plus haut que le MTU.

Le MTU ne sert qu'en émission (et pour calculer le MSS annoncé). Même avec un MTU à 1000, l'interface ethernet continue à accepter des paquets de 1500 octets. Mais si tu ne veux pas baisser le MTU tu peux directement diminuer le MSS annoncé par ton serveur, ce qui est le but recherché afin que les clients envoient des segments plus petits. Cela permettra de voir si le problème vient de la taille des paquets.

_________________
Attention : contributeur méchant !
Pentium III 550 MHz, RAM 128 Mio, disque 4,3 Go. Debian Squeeze avec noyau Linux maison. On ne rit pas ! c'est mon nouveau serveur+routeur ADSL.

Haut

Thomas

Sujet du message: Re: Problème MTU / MSS ?

Posté: 14 Avr 2012 15:07

Nouvel utilisateur

Inscription: 12 Avr 2012 16:18
Messages: 17

OK je ne savais pas cette différence. Et pour baisser le MSS je fais comment ? Avec iptables et POSTROUTING ? (Je sens que tu vas me dire que ça ne marchera que sur le routeur cette règle

)

Code:

iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o eth0 -j TCPMSS --set-mss 1000

Haut

PascalHambourg

Sujet du message: Re: Problème MTU / MSS ?

Posté: 14 Avr 2012 15:19

Contributeur

Inscription: 18 Déc 2007 00:11
Messages: 4783

Non, ça devrait marcher. A confirmer avec ethereal.

Bon, j'ai examiné la trace détaillé et les paquets marqués [TCP segment of a reassembled PDU] ne sont pas des fragments au sens IP (d'ailleurs les paquets ont le flag "ne pas fragmenter" activé), je pense qu'il s'agit de fragments de blocs de données au sens du protocole HTTP, qu'ethereal ne peut analyser tant qu'il n'a pas reçu le contenu entier de la requête POST.

Une seule chose est à peu près sûre : le client a envoyé des paquets que ton serveur n'a pas reçus. Je dirais 5 : 8796 - 1496 = 7300, or 7300 / 5 = 1460. Mais ça m'embête un peu, parce que si le client a envoyé 5 segments de 1460 octets, il a ignoré le MSS à 1452 annoncé par ton serveur...

_________________
Attention : contributeur méchant !
Pentium III 550 MHz, RAM 128 Mio, disque 4,3 Go. Debian Squeeze avec noyau Linux maison. On ne rit pas ! c'est mon nouveau serveur+routeur ADSL.

Haut

Thomas

Sujet du message: Re: Problème MTU / MSS ?

Posté: 14 Avr 2012 15:59

Nouvel utilisateur

Inscription: 12 Avr 2012 16:18
Messages: 17

Oui je viens de vérifier avec ethereal et la commande marche. J'ai mis un MSS de 1000 puis 576, mais j'ai encore des connexions qui ont des problèmes...

Je vais essayer de capturer une autre séquence d'erreurs...

Haut

PascalHambourg

Sujet du message: Re: Problème MTU / MSS ?

Posté: 14 Avr 2012 16:10

Contributeur

Inscription: 18 Déc 2007 00:11
Messages: 4783

Avec les captures tu pourras regarder si les clients tiennent compte du MSS réduit ou envoyent des segments plus gros (à condition qu'ils arrivent malgré tout).

_________________
Attention : contributeur méchant !
Pentium III 550 MHz, RAM 128 Mio, disque 4,3 Go. Debian Squeeze avec noyau Linux maison. On ne rit pas ! c'est mon nouveau serveur+routeur ADSL.

Haut

Thomas

Sujet du message: Re: Problème MTU / MSS ?

Posté: 14 Avr 2012 18:59

Nouvel utilisateur

Inscription: 12 Avr 2012 16:18
Messages: 17

Voilà je viens de capturer une autre séquence.
Le MSS est bien comme je l'ai configuré (576) par contre encore des paquest perdus ?

Code:

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     25 833.680189  88.12.46.10           88.190.31.67          TCP      74     46656 > http [SYN] Seq=0 Win=5840 Len=0 MSS=1452 SACK_PERM=1 TSval=1895576 TSecr=0 WS=2 25

Frame 25: 74 bytes on wire (592 bits), 74 bytes captured (592 bits)
    Arrival Time: Apr 14, 2012 18:17:57.840296000 CEST
    Epoch Time: 1334420277.840296000 seconds
    [Time delta from previous captured frame: 213.542470000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 833.680189000 seconds]
    Frame Number: 25
    Frame Length: 74 bytes (592 bits)
    Capture Length: 74 bytes (592 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: Cisco_f6:94:7f (00:25:45:f6:94:7f), Dst: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
    Destination: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 88.12.46.10 (88.12.46.10), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 60
    Identification: 0x5f1d (24349)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 54
    Protocol: TCP (6)
    Header checksum: 0xe787 [correct]
        [Good: True]
        [Bad: False]
    Source: 88.12.46.10 (88.12.46.10)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 46656 (46656), Dst Port: http (80), Seq: 0, Len: 0
    Source port: 46656 (46656)
    Destination port: http (80)
    [Stream index: 3]
    Sequence number: 0    (relative sequence number)
    Header length: 40 bytes
    Flags: 0x02 (SYN)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...0 .... = Acknowledgement: Not set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..1. = Syn: Set
            [Expert Info (Chat/Sequence): Connection establish request (SYN): server port http]
                [Message: Connection establish request (SYN): server port http]
                [Severity level: Chat]
                [Group: Sequence]
        .... .... ...0 = Fin: Not set
    Window size value: 5840
    [Calculated window size: 5840]
    Checksum: 0x022f [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (20 bytes)
        Maximum segment size: 1452 bytes
        TCP SACK Permitted Option: True
        Timestamps: TSval 1895576, TSecr 0
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 1895576
            Timestamp echo reply: 0
        No-Operation (NOP)
        Window scale: 1 (multiply by 2)
            Kind: Window Scale (3)
            Length: 3
            Shift count: 1
            [Multiplier: 2]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     26 833.680224  88.190.31.67          88.12.46.10           TCP      74     http > 46656 [SYN, ACK] Seq=0 Ack=1 Win=4992 Len=0 MSS=576 SACK_PERM=1 TSval=1213171761 TSecr=1895576 WS=128 26

Frame 26: 74 bytes on wire (592 bits), 74 bytes captured (592 bits)
    Arrival Time: Apr 14, 2012 18:17:57.840331000 CEST
    Epoch Time: 1334420277.840331000 seconds
    [Time delta from previous captured frame: 0.000035000 seconds]
    [Time delta from previous displayed frame: 0.000035000 seconds]
    [Time since reference or first frame: 833.680224000 seconds]
    Frame Number: 26
    Frame Length: 74 bytes (592 bits)
    Capture Length: 74 bytes (592 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff), Dst: Cisco_f6:94:7f (00:25:45:f6:94:7f)
    Destination: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 88.190.31.67 (88.190.31.67), Dst: 88.12.46.10 (88.12.46.10)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 60
    Identification: 0x0000 (0)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: TCP (6)
    Header checksum: 0x3ca5 [correct]
        [Good: True]
        [Bad: False]
    Source: 88.190.31.67 (88.190.31.67)
    Destination: 88.12.46.10 (88.12.46.10)
Transmission Control Protocol, Src Port: http (80), Dst Port: 46656 (46656), Seq: 0, Ack: 1, Len: 0
    Source port: http (80)
    Destination port: 46656 (46656)
    [Stream index: 3]
    Sequence number: 0    (relative sequence number)
    Acknowledgement number: 1    (relative ack number)
    Header length: 40 bytes
    Flags: 0x12 (SYN, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..1. = Syn: Set
            [Expert Info (Chat/Sequence): Connection establish acknowledge (SYN+ACK): server port http]
                [Message: Connection establish acknowledge (SYN+ACK): server port http]
                [Severity level: Chat]
                [Group: Sequence]
        .... .... ...0 = Fin: Not set
    Window size value: 4992
    [Calculated window size: 4992]
    Checksum: 0x7d52 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (20 bytes)
        Maximum segment size: 576 bytes
        TCP SACK Permitted Option: True
        Timestamps: TSval 1213171761, TSecr 1895576
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 1213171761
            Timestamp echo reply: 1895576
        No-Operation (NOP)
        Window scale: 7 (multiply by 128)
            Kind: Window Scale (3)
            Length: 3
            Shift count: 7
            [Multiplier: 128]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 25]
        [The RTT to ACK the segment was: 0.000035000 seconds]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     27 833.714025  88.12.46.10           88.190.31.67          TCP      66     46656 > http [ACK] Seq=1 Ack=1 Win=5840 Len=0 TSval=1895583 TSecr=1213171761 27

Frame 27: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
    Arrival Time: Apr 14, 2012 18:17:57.874132000 CEST
    Epoch Time: 1334420277.874132000 seconds
    [Time delta from previous captured frame: 0.033801000 seconds]
    [Time delta from previous displayed frame: 0.033801000 seconds]
    [Time since reference or first frame: 833.714025000 seconds]
    Frame Number: 27
    Frame Length: 66 bytes (528 bits)
    Capture Length: 66 bytes (528 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: Cisco_f6:94:7f (00:25:45:f6:94:7f), Dst: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
    Destination: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 88.12.46.10 (88.12.46.10), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 52
    Identification: 0x5f1e (24350)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 54
    Protocol: TCP (6)
    Header checksum: 0xe78e [correct]
        [Good: True]
        [Bad: False]
    Source: 88.12.46.10 (88.12.46.10)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 46656 (46656), Dst Port: http (80), Seq: 1, Ack: 1, Len: 0
    Source port: 46656 (46656)
    Destination port: http (80)
    [Stream index: 3]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 1    (relative ack number)
    Header length: 32 bytes
    Flags: 0x10 (ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 2920
    [Calculated window size: 5840]
    [Window size scaling factor: 2]
    Checksum: 0xb0bb [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 1895583, TSecr 1213171761
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 1895583
            Timestamp echo reply: 1213171761
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 26]
        [The RTT to ACK the segment was: 0.033801000 seconds]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     28 833.752469  88.12.46.10           88.190.31.67          TCP      300    [TCP segment of a reassembled PDU]                              28

Frame 28: 300 bytes on wire (2400 bits), 300 bytes captured (2400 bits)
    Arrival Time: Apr 14, 2012 18:17:57.912576000 CEST
    Epoch Time: 1334420277.912576000 seconds
    [Time delta from previous captured frame: 0.038444000 seconds]
    [Time delta from previous displayed frame: 0.038444000 seconds]
    [Time since reference or first frame: 833.752469000 seconds]
    Frame Number: 28
    Frame Length: 300 bytes (2400 bits)
    Capture Length: 300 bytes (2400 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: Cisco_f6:94:7f (00:25:45:f6:94:7f), Dst: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
    Destination: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 88.12.46.10 (88.12.46.10), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 286
    Identification: 0x5f1f (24351)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 54
    Protocol: TCP (6)
    Header checksum: 0xe6a3 [correct]
        [Good: True]
        [Bad: False]
    Source: 88.12.46.10 (88.12.46.10)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 46656 (46656), Dst Port: http (80), Seq: 1, Ack: 1, Len: 234
    Source port: 46656 (46656)
    Destination port: http (80)
    [Stream index: 3]
    Sequence number: 1    (relative sequence number)
    [Next sequence number: 235    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 32 bytes
    Flags: 0x18 (PSH, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 1... = Push: Set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 2920
    [Calculated window size: 5840]
    [Window size scaling factor: 2]
    Checksum: 0x6383 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 1895590, TSecr 1213171761
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 1895590
            Timestamp echo reply: 1213171761
    [SEQ/ACK analysis]
        [Bytes in flight: 234]
    TCP segment data (234 bytes)

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     29 833.752510  88.190.31.67          88.12.46.10           TCP      66     http > 46656 [ACK] Seq=1 Ack=235 Win=6144 Len=0 TSval=1213171779 TSecr=1895590 29

Frame 29: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
    Arrival Time: Apr 14, 2012 18:17:57.912617000 CEST
    Epoch Time: 1334420277.912617000 seconds
    [Time delta from previous captured frame: 0.000041000 seconds]
    [Time delta from previous displayed frame: 0.000041000 seconds]
    [Time since reference or first frame: 833.752510000 seconds]
    Frame Number: 29
    Frame Length: 66 bytes (528 bits)
    Capture Length: 66 bytes (528 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff), Dst: Cisco_f6:94:7f (00:25:45:f6:94:7f)
    Destination: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 88.190.31.67 (88.190.31.67), Dst: 88.12.46.10 (88.12.46.10)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 52
    Identification: 0xa811 (43025)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: TCP (6)
    Header checksum: 0x949b [correct]
        [Good: True]
        [Bad: False]
    Source: 88.190.31.67 (88.190.31.67)
    Destination: 88.12.46.10 (88.12.46.10)
Transmission Control Protocol, Src Port: http (80), Dst Port: 46656 (46656), Seq: 1, Ack: 235, Len: 0
    Source port: http (80)
    Destination port: 46656 (46656)
    [Stream index: 3]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 235    (relative ack number)
    Header length: 32 bytes
    Flags: 0x10 (ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 48
    [Calculated window size: 6144]
    [Window size scaling factor: 128]
    Checksum: 0xbaf0 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 1213171779, TSecr 1895590
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 1213171779
            Timestamp echo reply: 1895590
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 28]
        [The RTT to ACK the segment was: 0.000041000 seconds]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     30 833.759279  88.12.46.10           88.190.31.67          TCP      438    [TCP Previous segment lost] [TCP segment of a reassembled PDU]  30

Frame 30: 438 bytes on wire (3504 bits), 438 bytes captured (3504 bits)
    Arrival Time: Apr 14, 2012 18:17:57.919386000 CEST
    Epoch Time: 1334420277.919386000 seconds
    [Time delta from previous captured frame: 0.006769000 seconds]
    [Time delta from previous displayed frame: 0.006769000 seconds]
    [Time since reference or first frame: 833.759279000 seconds]
    Frame Number: 30
    Frame Length: 438 bytes (3504 bits)
    Capture Length: 438 bytes (3504 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: Bad TCP]
    [Coloring Rule String: tcp.analysis.flags]
Ethernet II, Src: Cisco_f6:94:7f (00:25:45:f6:94:7f), Dst: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
    Destination: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 88.12.46.10 (88.12.46.10), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 424
    Identification: 0x5f21 (24353)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 54
    Protocol: TCP (6)
    Header checksum: 0xe617 [correct]
        [Good: True]
        [Bad: False]
    Source: 88.12.46.10 (88.12.46.10)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 46656 (46656), Dst Port: http (80), Seq: 1675, Ack: 1, Len: 372
    Source port: 46656 (46656)
    Destination port: http (80)
    [Stream index: 3]
    Sequence number: 1675    (relative sequence number)
    [Next sequence number: 2047    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 32 bytes
    Flags: 0x18 (PSH, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 1... = Push: Set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 2920
    [Calculated window size: 5840]
    [Window size scaling factor: 2]
    Checksum: 0x2b1e [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 1895590, TSecr 1213171761
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 1895590
            Timestamp echo reply: 1213171761
    [SEQ/ACK analysis]
        [TCP Analysis Flags]
            [A segment before this frame was lost]
                [Expert Info (Warn/Sequence): Previous segment lost (common at capture start)]
                    [Message: Previous segment lost (common at capture start)]
                    [Severity level: Warn]
                    [Group: Sequence]
    TCP segment data (372 bytes)

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     31 833.759310  88.190.31.67          88.12.46.10           TCP      78     [TCP Dup ACK 29#1] http > 46656 [ACK] Seq=1 Ack=235 Win=6144 Len=0 TSval=1213171781 TSecr=1895590 SLE=1675 SRE=2047 31

Frame 31: 78 bytes on wire (624 bits), 78 bytes captured (624 bits)
    Arrival Time: Apr 14, 2012 18:17:57.919417000 CEST
    Epoch Time: 1334420277.919417000 seconds
    [Time delta from previous captured frame: 0.000031000 seconds]
    [Time delta from previous displayed frame: 0.000031000 seconds]
    [Time since reference or first frame: 833.759310000 seconds]
    Frame Number: 31
    Frame Length: 78 bytes (624 bits)
    Capture Length: 78 bytes (624 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: Bad TCP]
    [Coloring Rule String: tcp.analysis.flags]
Ethernet II, Src: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff), Dst: Cisco_f6:94:7f (00:25:45:f6:94:7f)
    Destination: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 88.190.31.67 (88.190.31.67), Dst: 88.12.46.10 (88.12.46.10)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 64
    Identification: 0xa812 (43026)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: TCP (6)
    Header checksum: 0x948e [correct]
        [Good: True]
        [Bad: False]
    Source: 88.190.31.67 (88.190.31.67)
    Destination: 88.12.46.10 (88.12.46.10)
Transmission Control Protocol, Src Port: http (80), Dst Port: 46656 (46656), Seq: 1, Ack: 235, Len: 0
    Source port: http (80)
    Destination port: 46656 (46656)
    [Stream index: 3]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 235    (relative ack number)
    Header length: 44 bytes
    Flags: 0x10 (ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 48
    [Calculated window size: 6144]
    [Window size scaling factor: 128]
    Checksum: 0x5ae8 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (24 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 1213171781, TSecr 1895590
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 1213171781
            Timestamp echo reply: 1895590
        No-Operation (NOP)
        No-Operation (NOP)
        SACK: 1675-2047
            left edge = 1675 (relative)
            right edge = 2047 (relative)
    [SEQ/ACK analysis]
        [TCP Analysis Flags]
            [This is a TCP duplicate ack]
        [Duplicate ACK #: 1]
        [Duplicate to the ACK in frame: 29]
            [Expert Info (Note/Sequence): Duplicate ACK (#1)]
                [Message: Duplicate ACK (#1)]
                [Severity level: Note]
                [Group: Sequence]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     32 853.997445  88.190.31.67          88.12.46.10           HTTP     404    HTTP/1.1 408 Request Timeout                                    32

Frame 32: 404 bytes on wire (3232 bits), 404 bytes captured (3232 bits)
    Arrival Time: Apr 14, 2012 18:18:18.157552000 CEST
    Epoch Time: 1334420298.157552000 seconds
    [Time delta from previous captured frame: 20.238135000 seconds]
    [Time delta from previous displayed frame: 20.238135000 seconds]
    [Time since reference or first frame: 853.997445000 seconds]
    Frame Number: 32
    Frame Length: 404 bytes (3232 bits)
    Capture Length: 404 bytes (3232 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp:http:data]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff), Dst: Cisco_f6:94:7f (00:25:45:f6:94:7f)
    Destination: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 88.190.31.67 (88.190.31.67), Dst: 88.12.46.10 (88.12.46.10)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 390
    Identification: 0xa813 (43027)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: TCP (6)
    Header checksum: 0x9347 [correct]
        [Good: True]
        [Bad: False]
    Source: 88.190.31.67 (88.190.31.67)
    Destination: 88.12.46.10 (88.12.46.10)
Transmission Control Protocol, Src Port: http (80), Dst Port: 46656 (46656), Seq: 1, Ack: 235, Len: 326
    Source port: http (80)
    Destination port: 46656 (46656)
    [Stream index: 3]
    Sequence number: 1    (relative sequence number)
    [Next sequence number: 327    (relative sequence number)]
    Acknowledgement number: 235    (relative ack number)
    Header length: 44 bytes
    Flags: 0x18 (PSH, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 1... = Push: Set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 48
    [Calculated window size: 6144]
    [Window size scaling factor: 128]
    Checksum: 0xff8f [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (24 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 1213176840, TSecr 1895590
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 1213176840
            Timestamp echo reply: 1895590
        No-Operation (NOP)
        No-Operation (NOP)
        SACK: 1675-2047
            left edge = 1675 (relative)
            right edge = 2047 (relative)
    [SEQ/ACK analysis]
        [Bytes in flight: 326]
Hypertext Transfer Protocol
    HTTP/1.1 408 Request Timeout\r\n
        [Expert Info (Chat/Sequence): HTTP/1.1 408 Request Timeout\r\n]
            [Message: HTTP/1.1 408 Request Timeout\r\n]
            [Severity level: Chat]
            [Group: Sequence]
        Request Version: HTTP/1.1
        Status Code: 408
        Response Phrase: Request Timeout
    Date: Sat, 14 Apr 2012 16:17:57 GMT\r\n
    Server: Apache/2.2.16 (Debian)\r\n
    X-Powered-By: PHP/5.3.3-7+squeeze8\r\n
    Set-Cookie: PHPSESSID=gl7512acak07o1037ecrvo4lp2; path=/\r\n
    Vary: Accept-Encoding\r\n
    Content-Encoding: gzip\r\n
    Content-Length: 20\r\n
        [Content length: 20]
    Connection: close\r\n
    Content-Type: text/html\r\n
    \r\n
    Content-encoded entity body (gzip): 20 bytes [Error: Decompression failed]
        Data (20 bytes)

0000  1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00   ................
0010  00 00 00 00                                       ....
            Data: 1f8b080000000000000303000000000000000000
            [Length: 20]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     33 853.997500  88.190.31.67          88.12.46.10           TCP      78     http > 46656 [FIN, ACK] Seq=327 Ack=235 Win=6144 Len=0 TSval=1213176840 TSecr=1895590 SLE=1675 SRE=2047 33

Frame 33: 78 bytes on wire (624 bits), 78 bytes captured (624 bits)
    Arrival Time: Apr 14, 2012 18:18:18.157607000 CEST
    Epoch Time: 1334420298.157607000 seconds
    [Time delta from previous captured frame: 0.000055000 seconds]
    [Time delta from previous displayed frame: 0.000055000 seconds]
    [Time since reference or first frame: 853.997500000 seconds]
    Frame Number: 33
    Frame Length: 78 bytes (624 bits)
    Capture Length: 78 bytes (624 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff), Dst: Cisco_f6:94:7f (00:25:45:f6:94:7f)
    Destination: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 88.190.31.67 (88.190.31.67), Dst: 88.12.46.10 (88.12.46.10)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 64
    Identification: 0xa814 (43028)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: TCP (6)
    Header checksum: 0x948c [correct]
        [Good: True]
        [Bad: False]
    Source: 88.190.31.67 (88.190.31.67)
    Destination: 88.12.46.10 (88.12.46.10)
Transmission Control Protocol, Src Port: http (80), Dst Port: 46656 (46656), Seq: 327, Ack: 235, Len: 0
    Source port: http (80)
    Destination port: 46656 (46656)
    [Stream index: 3]
    Sequence number: 327    (relative sequence number)
    Acknowledgement number: 235    (relative ack number)
    Header length: 44 bytes
    Flags: 0x11 (FIN, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...1 = Fin: Set
            [Expert Info (Chat/Sequence): Connection finish (FIN)]
                [Message: Connection finish (FIN)]
                [Severity level: Chat]
                [Group: Sequence]
    Window size value: 48
    [Calculated window size: 6144]
    [Window size scaling factor: 128]
    Checksum: 0x45de [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (24 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 1213176840, TSecr 1895590
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 1213176840
            Timestamp echo reply: 1895590
        No-Operation (NOP)
        No-Operation (NOP)
        SACK: 1675-2047
            left edge = 1675 (relative)
            right edge = 2047 (relative)

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     34 854.043875  88.12.46.10           88.190.31.67          TCP      66     46656 > http [ACK] Seq=2047 Ack=327 Win=6912 Len=0 TSval=1899648 TSecr=1213176840 34

Frame 34: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
    Arrival Time: Apr 14, 2012 18:18:18.203982000 CEST
    Epoch Time: 1334420298.203982000 seconds
    [Time delta from previous captured frame: 0.046375000 seconds]
    [Time delta from previous displayed frame: 0.046375000 seconds]
    [Time since reference or first frame: 854.043875000 seconds]
    Frame Number: 34
    Frame Length: 66 bytes (528 bits)
    Capture Length: 66 bytes (528 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: Cisco_f6:94:7f (00:25:45:f6:94:7f), Dst: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
    Destination: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 88.12.46.10 (88.12.46.10), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 52
    Identification: 0x5f28 (24360)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 54
    Protocol: TCP (6)
    Header checksum: 0xe784 [correct]
        [Good: True]
        [Bad: False]
    Source: 88.12.46.10 (88.12.46.10)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 46656 (46656), Dst Port: http (80), Seq: 2047, Ack: 327, Len: 0
    Source port: 46656 (46656)
    Destination port: http (80)
    [Stream index: 3]
    Sequence number: 2047    (relative sequence number)
    Acknowledgement number: 327    (relative ack number)
    Header length: 32 bytes
    Flags: 0x10 (ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 3456
    [Calculated window size: 6912]
    [Window size scaling factor: 2]
    Checksum: 0x81a7 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 1899648, TSecr 1213176840
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 1899648
            Timestamp echo reply: 1213176840
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 32]
        [The RTT to ACK the segment was: 0.046430000 seconds]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     35 854.084740  88.12.46.10           88.190.31.67          TCP      66     46656 > http [ACK] Seq=2047 Ack=328 Win=6912 Len=0 TSval=1899657 TSecr=1213176840 35

Frame 35: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
    Arrival Time: Apr 14, 2012 18:18:18.244847000 CEST
    Epoch Time: 1334420298.244847000 seconds
    [Time delta from previous captured frame: 0.040865000 seconds]
    [Time delta from previous displayed frame: 0.040865000 seconds]
    [Time since reference or first frame: 854.084740000 seconds]
    Frame Number: 35
    Frame Length: 66 bytes (528 bits)
    Capture Length: 66 bytes (528 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: Cisco_f6:94:7f (00:25:45:f6:94:7f), Dst: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
    Destination: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 88.12.46.10 (88.12.46.10), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 52
    Identification: 0x5f29 (24361)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 54
    Protocol: TCP (6)
    Header checksum: 0xe783 [correct]
        [Good: True]
        [Bad: False]
    Source: 88.12.46.10 (88.12.46.10)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 46656 (46656), Dst Port: http (80), Seq: 2047, Ack: 328, Len: 0
    Source port: 46656 (46656)
    Destination port: http (80)
    [Stream index: 3]
    Sequence number: 2047    (relative sequence number)
    Acknowledgement number: 328    (relative ack number)
    Header length: 32 bytes
    Flags: 0x10 (ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 3456
    [Calculated window size: 6912]
    [Window size scaling factor: 2]
    Checksum: 0x819d [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 1899657, TSecr 1213176840
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 1899657
            Timestamp echo reply: 1213176840
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 33]
        [The RTT to ACK the segment was: 0.087240000 seconds]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     36 854.099020  88.12.46.10           88.190.31.67          TCP      66     46656 > http [FIN, ACK] Seq=2047 Ack=328 Win=6912 Len=0 TSval=1899659 TSecr=1213176840 36

Frame 36: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
    Arrival Time: Apr 14, 2012 18:18:18.259127000 CEST
    Epoch Time: 1334420298.259127000 seconds
    [Time delta from previous captured frame: 0.014280000 seconds]
    [Time delta from previous displayed frame: 0.014280000 seconds]
    [Time since reference or first frame: 854.099020000 seconds]
    Frame Number: 36
    Frame Length: 66 bytes (528 bits)
    Capture Length: 66 bytes (528 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: Cisco_f6:94:7f (00:25:45:f6:94:7f), Dst: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
    Destination: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 88.12.46.10 (88.12.46.10), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 52
    Identification: 0x5f2a (24362)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 54
    Protocol: TCP (6)
    Header checksum: 0xe782 [correct]
        [Good: True]
        [Bad: False]
    Source: 88.12.46.10 (88.12.46.10)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 46656 (46656), Dst Port: http (80), Seq: 2047, Ack: 328, Len: 0
    Source port: 46656 (46656)
    Destination port: http (80)
    [Stream index: 3]
    Sequence number: 2047    (relative sequence number)
    Acknowledgement number: 328    (relative ack number)
    Header length: 32 bytes
    Flags: 0x11 (FIN, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...1 = Fin: Set
            [Expert Info (Chat/Sequence): Connection finish (FIN)]
                [Message: Connection finish (FIN)]
                [Severity level: Chat]
                [Group: Sequence]
    Window size value: 3456
    [Calculated window size: 6912]
    [Window size scaling factor: 2]
    Checksum: 0x819a [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 1899659, TSecr 1213176840
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 1899659
            Timestamp echo reply: 1213176840

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     37 854.099041  88.190.31.67          88.12.46.10           TCP      78     [TCP Dup ACK 33#1] http > 46656 [ACK] Seq=328 Ack=235 Win=6144 Len=0 TSval=1213176866 TSecr=1895590 SLE=1675 SRE=2048 37

Frame 37: 78 bytes on wire (624 bits), 78 bytes captured (624 bits)
    Arrival Time: Apr 14, 2012 18:18:18.259148000 CEST
    Epoch Time: 1334420298.259148000 seconds
    [Time delta from previous captured frame: 0.000021000 seconds]
    [Time delta from previous displayed frame: 0.000021000 seconds]
    [Time since reference or first frame: 854.099041000 seconds]
    Frame Number: 37
    Frame Length: 78 bytes (624 bits)
    Capture Length: 78 bytes (624 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: Bad TCP]
    [Coloring Rule String: tcp.analysis.flags]
Ethernet II, Src: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff), Dst: Cisco_f6:94:7f (00:25:45:f6:94:7f)
    Destination: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 88.190.31.67 (88.190.31.67), Dst: 88.12.46.10 (88.12.46.10)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 64
    Identification: 0xa815 (43029)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: TCP (6)
    Header checksum: 0x948b [correct]
        [Good: True]
        [Bad: False]
    Source: 88.190.31.67 (88.190.31.67)
    Destination: 88.12.46.10 (88.12.46.10)
Transmission Control Protocol, Src Port: http (80), Dst Port: 46656 (46656), Seq: 328, Ack: 235, Len: 0
    Source port: http (80)
    Destination port: 46656 (46656)
    [Stream index: 3]
    Sequence number: 328    (relative sequence number)
    Acknowledgement number: 235    (relative ack number)
    Header length: 44 bytes
    Flags: 0x10 (ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 48
    [Calculated window size: 6144]
    [Window size scaling factor: 128]
    Checksum: 0x45c3 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (24 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 1213176866, TSecr 1895590
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 1213176866
            Timestamp echo reply: 1895590
        No-Operation (NOP)
        No-Operation (NOP)
        SACK: 1675-2048
            left edge = 1675 (relative)
            right edge = 2048 (relative)
    [SEQ/ACK analysis]
        [TCP Analysis Flags]
            [This is a TCP duplicate ack]
        [Duplicate ACK #: 1]
        [Duplicate to the ACK in frame: 33]
            [Expert Info (Note/Sequence): Duplicate ACK (#1)]
                [Message: Duplicate ACK (#1)]
                [Severity level: Note]
                [Group: Sequence]

Haut

PascalHambourg

Sujet du message: Re: Problème MTU / MSS ?

Posté: 14 Avr 2012 20:03

Contributeur

Inscription: 18 Déc 2007 00:11
Messages: 4783

A première vue, il manque 1440 octets (1675-235) de données entre les segments des paquets n° 28 et 30 émis par le client. Si ces données ont été envoyées dans un seul segment (sauf erreur c'est la taille de segment maximum que peut envoyer le client compte tenu du MSS qu'il a annoncé et des options), alors cela signifie qu'il n'a pas tenu compte du MSS annoncé par ton serveur. Dans ce cas, je ne vois pas trop quoi faire à part baisser la taille de fenêtre TCP à une valeur abominablement basse pour empêcher l'émetteur d'envoyer trop de données à la fois, ce qui induirait probablement des performances abominablement mauvaises aussi...

_________________
Attention : contributeur méchant !
Pentium III 550 MHz, RAM 128 Mio, disque 4,3 Go. Debian Squeeze avec noyau Linux maison. On ne rit pas ! c'est mon nouveau serveur+routeur ADSL.

Haut

Thomas

Sujet du message: Re: Problème MTU / MSS ?

Posté: 15 Avr 2012 11:39

Nouvel utilisateur

Inscription: 12 Avr 2012 16:18
Messages: 17

OK merci Pascal ...

Ce matin, un utilisateur a le même problème et ensuite je recois des [RST,ACK] toutes les 20 secondes.
Est-ce ça veut dire quelquechose ?

Code:

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      1 0.000000    92.157.22.194         88.190.31.67          TCP      60     56370 > http [RST, ACK] Seq=1 Ack=1 Win=65535 Len=0             1

Frame 1: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
    Arrival Time: Apr 15, 2012 11:12:23.858602000 CEST
    Epoch Time: 1334481143.858602000 seconds
    [Time delta from previous captured frame: 0.000000000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 0.000000000 seconds]
    Frame Number: 1
    Frame Length: 60 bytes (480 bits)
    Capture Length: 60 bytes (480 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: TCP RST]
    [Coloring Rule String: tcp.flags.reset eq 1]
Ethernet II, Src: Cisco_f6:94:7f (00:25:45:f6:94:7f), Dst: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
    Destination: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
    Trailer: 000000000000
Internet Protocol Version 4, Src: 92.157.22.194 (92.157.22.194), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 40
    Identification: 0xe0f8 (57592)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 52
    Protocol: TCP (6)
    Header checksum: 0x7a77 [correct]
        [Good: True]
        [Bad: False]
    Source: 92.157.22.194 (92.157.22.194)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 56370 (56370), Dst Port: http (80), Seq: 1, Ack: 1, Len: 0
    Source port: 56370 (56370)
    Destination port: http (80)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x14 (RST, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .1.. = Reset: Set
            [Expert Info (Chat/Sequence): Connection reset (RST)]
                [Message: Connection reset (RST)]
                [Severity level: Chat]
                [Group: Sequence]
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 65535
    [Calculated window size: 65535]
    [Window size scaling factor: -1 (unknown)]
    Checksum: 0x8951 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      2 20.321973   92.157.22.194         88.190.31.67          TCP      60     56371 > http [RST, ACK] Seq=1 Ack=1 Win=65535 Len=0             2

Frame 2: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
    Arrival Time: Apr 15, 2012 11:12:44.180575000 CEST
    Epoch Time: 1334481164.180575000 seconds
    [Time delta from previous captured frame: 20.321973000 seconds]
    [Time delta from previous displayed frame: 20.321973000 seconds]
    [Time since reference or first frame: 20.321973000 seconds]
    Frame Number: 2
    Frame Length: 60 bytes (480 bits)
    Capture Length: 60 bytes (480 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: TCP RST]
    [Coloring Rule String: tcp.flags.reset eq 1]
Ethernet II, Src: Cisco_f6:94:7f (00:25:45:f6:94:7f), Dst: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
    Destination: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
    Trailer: 000000000000
Internet Protocol Version 4, Src: 92.157.22.194 (92.157.22.194), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 40
    Identification: 0x51c4 (20932)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 52
    Protocol: TCP (6)
    Header checksum: 0x09ac [correct]
        [Good: True]
        [Bad: False]
    Source: 92.157.22.194 (92.157.22.194)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 56371 (56371), Dst Port: http (80), Seq: 1, Ack: 1, Len: 0
    Source port: 56371 (56371)
    Destination port: http (80)
    [Stream index: 1]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x14 (RST, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .1.. = Reset: Set
            [Expert Info (Chat/Sequence): Connection reset (RST)]
                [Message: Connection reset (RST)]
                [Severity level: Chat]
                [Group: Sequence]
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 65535
    [Calculated window size: 65535]
    [Window size scaling factor: -1 (unknown)]
    Checksum: 0x56a6 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      3 40.942129   92.157.22.194         88.190.31.67          TCP      60     56384 > http [RST, ACK] Seq=1 Ack=1 Win=65535 Len=0             3

Frame 3: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
    Arrival Time: Apr 15, 2012 11:13:04.800731000 CEST
    Epoch Time: 1334481184.800731000 seconds
    [Time delta from previous captured frame: 20.620156000 seconds]
    [Time delta from previous displayed frame: 20.620156000 seconds]
    [Time since reference or first frame: 40.942129000 seconds]
    Frame Number: 3
    Frame Length: 60 bytes (480 bits)
    Capture Length: 60 bytes (480 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: TCP RST]
    [Coloring Rule String: tcp.flags.reset eq 1]
Ethernet II, Src: Cisco_f6:94:7f (00:25:45:f6:94:7f), Dst: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
    Destination: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
    Trailer: 000000000000
Internet Protocol Version 4, Src: 92.157.22.194 (92.157.22.194), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 40
    Identification: 0xad9d (44445)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 52
    Protocol: TCP (6)
    Header checksum: 0xadd2 [correct]
        [Good: True]
        [Bad: False]
    Source: 92.157.22.194 (92.157.22.194)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 56384 (56384), Dst Port: http (80), Seq: 1, Ack: 1, Len: 0
    Source port: 56384 (56384)
    Destination port: http (80)
    [Stream index: 2]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x14 (RST, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .1.. = Reset: Set
            [Expert Info (Chat/Sequence): Connection reset (RST)]
                [Message: Connection reset (RST)]
                [Severity level: Chat]
                [Group: Sequence]
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 65535
    [Calculated window size: 65535]
    [Window size scaling factor: -1 (unknown)]
    Checksum: 0x075e [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      4 61.260952   92.157.22.194         88.190.31.67          TCP      60     56385 > http [RST, ACK] Seq=1 Ack=1 Win=65535 Len=0             4

Frame 4: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
    Arrival Time: Apr 15, 2012 11:13:25.119554000 CEST
    Epoch Time: 1334481205.119554000 seconds
    [Time delta from previous captured frame: 20.318823000 seconds]
    [Time delta from previous displayed frame: 20.318823000 seconds]
    [Time since reference or first frame: 61.260952000 seconds]
    Frame Number: 4
    Frame Length: 60 bytes (480 bits)
    Capture Length: 60 bytes (480 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: TCP RST]
    [Coloring Rule String: tcp.flags.reset eq 1]
Ethernet II, Src: Cisco_f6:94:7f (00:25:45:f6:94:7f), Dst: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
    Destination: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
    Trailer: 000000000000
Internet Protocol Version 4, Src: 92.157.22.194 (92.157.22.194), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 40
    Identification: 0x40bf (16575)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 52
    Protocol: TCP (6)
    Header checksum: 0x1ab1 [correct]
        [Good: True]
        [Bad: False]
    Source: 92.157.22.194 (92.157.22.194)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 56385 (56385), Dst Port: http (80), Seq: 1, Ack: 1, Len: 0
    Source port: 56385 (56385)
    Destination port: http (80)
    [Stream index: 3]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x14 (RST, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .1.. = Reset: Set
            [Expert Info (Chat/Sequence): Connection reset (RST)]
                [Message: Connection reset (RST)]
                [Severity level: Chat]
                [Group: Sequence]
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 65535
    [Calculated window size: 65535]
    [Window size scaling factor: -1 (unknown)]
    Checksum: 0x6857 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      5 81.783860   92.157.22.194         88.190.31.67          TCP      60     56406 > http [RST, ACK] Seq=1 Ack=1 Win=65535 Len=0             5

Frame 5: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
    Arrival Time: Apr 15, 2012 11:13:45.642462000 CEST
    Epoch Time: 1334481225.642462000 seconds
    [Time delta from previous captured frame: 20.522908000 seconds]
    [Time delta from previous displayed frame: 20.522908000 seconds]
    [Time since reference or first frame: 81.783860000 seconds]
    Frame Number: 5
    Frame Length: 60 bytes (480 bits)
    Capture Length: 60 bytes (480 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: TCP RST]
    [Coloring Rule String: tcp.flags.reset eq 1]
Ethernet II, Src: Cisco_f6:94:7f (00:25:45:f6:94:7f), Dst: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
    Destination: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
    Trailer: 000000000000
Internet Protocol Version 4, Src: 92.157.22.194 (92.157.22.194), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 40
    Identification: 0x7fe3 (32739)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 52
    Protocol: TCP (6)
    Header checksum: 0xdb8c [correct]
        [Good: True]
        [Bad: False]
    Source: 92.157.22.194 (92.157.22.194)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 56406 (56406), Dst Port: http (80), Seq: 1, Ack: 1, Len: 0
    Source port: 56406 (56406)
    Destination port: http (80)
    [Stream index: 4]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x14 (RST, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .1.. = Reset: Set
            [Expert Info (Chat/Sequence): Connection reset (RST)]
                [Message: Connection reset (RST)]
                [Severity level: Chat]
                [Group: Sequence]
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 65535
    [Calculated window size: 65535]
    [Window size scaling factor: -1 (unknown)]
    Checksum: 0x252c [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      6 102.302242  92.157.22.194         88.190.31.67          TCP      60     56407 > http [RST, ACK] Seq=1 Ack=1 Win=65535 Len=0             6

Frame 6: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
    Arrival Time: Apr 15, 2012 11:14:06.160844000 CEST
    Epoch Time: 1334481246.160844000 seconds
    [Time delta from previous captured frame: 20.518382000 seconds]
    [Time delta from previous displayed frame: 20.518382000 seconds]
    [Time since reference or first frame: 102.302242000 seconds]
    Frame Number: 6
    Frame Length: 60 bytes (480 bits)
    Capture Length: 60 bytes (480 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: TCP RST]
    [Coloring Rule String: tcp.flags.reset eq 1]
Ethernet II, Src: Cisco_f6:94:7f (00:25:45:f6:94:7f), Dst: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
    Destination: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
    Trailer: 000000000000
Internet Protocol Version 4, Src: 92.157.22.194 (92.157.22.194), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 40
    Identification: 0x7bb7 (31671)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 52
    Protocol: TCP (6)
    Header checksum: 0xdfb8 [correct]
        [Good: True]
        [Bad: False]
    Source: 92.157.22.194 (92.157.22.194)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 56407 (56407), Dst Port: http (80), Seq: 1, Ack: 1, Len: 0
    Source port: 56407 (56407)
    Destination port: http (80)
    [Stream index: 5]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x14 (RST, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .1.. = Reset: Set
            [Expert Info (Chat/Sequence): Connection reset (RST)]
                [Message: Connection reset (RST)]
                [Severity level: Chat]
                [Group: Sequence]
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 65535
    [Calculated window size: 65535]
    [Window size scaling factor: -1 (unknown)]
    Checksum: 0x7898 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      7 122.620321  92.157.22.194         88.190.31.67          TCP      60     56410 > http [RST, ACK] Seq=1 Ack=1 Win=65535 Len=0             7

Frame 7: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
    Arrival Time: Apr 15, 2012 11:14:26.478923000 CEST
    Epoch Time: 1334481266.478923000 seconds
    [Time delta from previous captured frame: 20.318079000 seconds]
    [Time delta from previous displayed frame: 20.318079000 seconds]
    [Time since reference or first frame: 122.620321000 seconds]
    Frame Number: 7
    Frame Length: 60 bytes (480 bits)
    Capture Length: 60 bytes (480 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: TCP RST]
    [Coloring Rule String: tcp.flags.reset eq 1]
Ethernet II, Src: Cisco_f6:94:7f (00:25:45:f6:94:7f), Dst: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
    Destination: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        Address: Dell_e4:4a:ff (bc:30:5b:e4:4a:ff)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        Address: Cisco_f6:94:7f (00:25:45:f6:94:7f)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
    Trailer: 000000000000
Internet Protocol Version 4, Src: 92.157.22.194 (92.157.22.194), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 40
    Identification: 0x18d9 (6361)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 52
    Protocol: TCP (6)
    Header checksum: 0x4297 [correct]
        [Good: True]
        [Bad: False]
    Source: 92.157.22.194 (92.157.22.194)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 56410 (56410), Dst Port: http (80), Seq: 1, Ack: 1, Len: 0
    Source port: 56410 (56410)
    Destination port: http (80)
    [Stream index: 6]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x14 (RST, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .1.. = Reset: Set
            [Expert Info (Chat/Sequence): Connection reset (RST)]
                [Message: Connection reset (RST)]
                [Severity level: Chat]
                [Group: Sequence]
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 65535
    [Calculated window size: 65535]
    [Window size scaling factor: -1 (unknown)]
    Checksum: 0x4441 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]

Haut

PascalHambourg

Sujet du message: Re: Problème MTU / MSS ?

Posté: 15 Avr 2012 12:30

Contributeur

Inscription: 18 Déc 2007 00:11
Messages: 4783

Quand on voit passer un RST, c'est que la connexion TCP est interrompue. Si problème il y a, il s'est passé avant.

Je note juste que 92.157.22.194 est une adresse de connexion ADSL Orange, pas de téléphonie mobile.

_________________
Attention : contributeur méchant !
Pentium III 550 MHz, RAM 128 Mio, disque 4,3 Go. Debian Squeeze avec noyau Linux maison. On ne rit pas ! c'est mon nouveau serveur+routeur ADSL.

Haut

Thomas

Sujet du message: Re: Problème MTU / MSS ?

Posté: 15 Avr 2012 14:34

Nouvel utilisateur

Inscription: 12 Avr 2012 16:18
Messages: 17

Oui tu as raison ce n'est pas un téléphone, il a synchronisé son Thunderbird de son ordinateur.
Je vais essayé de prendre contact avec lui. A ton avis quels tests je peux lui demander de faire ? Il faut capturer les données qui sont envoyés au serveur et comparer avec ce que je captures sur le serveur ?

Oui les RST sont envoyés après le problème.

Haut

PascalHambourg

Sujet du message: Re: Problème MTU / MSS ?

Posté: 15 Avr 2012 15:08

Contributeur

Inscription: 18 Déc 2007 00:11
Messages: 4783

Une capture de paquets de son côté serait l'idéal.
Tu pourrais aussi lui demander de diminuer le MTU de son ordinateur pour tester si ça fait une différence.
Mais autant je peux envisager que les piles TCP/IP des OS de téléphone mobile se comportent de façon un peu "exotique", autant je serais surpris que celles des OS d'ordinateur les plus répandus ne respectent pas le MSS envoyé par l'autre côté.

_________________
Attention : contributeur méchant !
Pentium III 550 MHz, RAM 128 Mio, disque 4,3 Go. Debian Squeeze avec noyau Linux maison. On ne rit pas ! c'est mon nouveau serveur+routeur ADSL.

Haut

Thomas

Sujet du message: Re: Problème MTU / MSS ?

Posté: 15 Avr 2012 18:53

Nouvel utilisateur

Inscription: 12 Avr 2012 16:18
Messages: 17

Voilà je viens de les récupérer (j'ai trop de la chance que l'utilisateur ait pu le faire !)

Donc les paquets sont retransmis plusieurs fois, et le serveur ne les reçoit pas...
Le MSS n'est pas le même dans la trame 1 et 2 (MSS configuré avec iptables=576). Est-ce que c'est Orange qui les modifie ???

Coté client: (le fichier en entier ici: http://www.memotoo.com/capture_ethereal_2012-04-15_client1.txt)

Code:

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      1 0.000000    192.168.0.1          88.190.31.67          TCP      78     50376 > http [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=8 TSval=622344802 TSecr=0 SACK_PERM=1 1

Frame 1: 78 bytes on wire (624 bits), 78 bytes captured (624 bits)
    Arrival Time: Apr 15, 2012 18:03:47.375838000 CEST
    Epoch Time: 1334505827.375838000 seconds
    [Time delta from previous captured frame: 0.000000000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 0.000000000 seconds]
    Frame Number: 1
    Frame Length: 78 bytes (624 bits)
    Capture Length: 78 bytes (624 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Internet Protocol Version 4, Src: 192.168.0.1 (192.168.0.1), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 64
    Identification: 0xb72c (46892)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: TCP (6)
    Header checksum: 0x497f [correct]
        [Good: True]
        [Bad: False]
    Source: 192.168.0.1 (192.168.0.1)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 50376 (50376), Dst Port: http (80), Seq: 0, Len: 0
    Source port: 50376 (50376)
    Destination port: http (80)
    [Stream index: 0]
    Sequence number: 0    (relative sequence number)
    Header length: 44 bytes
    Flags: 0x02 (SYN)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...0 .... = Acknowledgement: Not set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..1. = Syn: Set
            [Expert Info (Chat/Sequence): Connection establish request (SYN): server port http]
                [Message: Connection establish request (SYN): server port http]
                [Severity level: Chat]
                [Group: Sequence]
        .... .... ...0 = Fin: Not set
    Window size value: 65535
    [Calculated window size: 65535]
    Checksum: 0x2ed7 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (24 bytes)
        Maximum segment size: 1460 bytes
        No-Operation (NOP)
        Window scale: 3 (multiply by 8)
            Kind: Window Scale (3)
            Length: 3
            Shift count: 3
            [Multiplier: 8]
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 622344802, TSecr 0
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 622344802
            Timestamp echo reply: 0
        TCP SACK Permitted Option: True
        End of Option List (EOL)

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      2 0.047724    88.190.31.67          192.168.0.1          TCP      74     http > 50376 [SYN, ACK] Seq=0 Ack=1 Win=4992 Len=0 MSS=1452 SACK_PERM=1 TSval=1234556598 TSecr=622344802 WS=128 2

Frame 2: 74 bytes on wire (592 bits), 74 bytes captured (592 bits)
    Arrival Time: Apr 15, 2012 18:03:47.423562000 CEST
    Epoch Time: 1334505827.423562000 seconds
    [Time delta from previous captured frame: 0.047724000 seconds]
    [Time delta from previous displayed frame: 0.047724000 seconds]
    [Time since reference or first frame: 0.047724000 seconds]
    Frame Number: 2
    Frame Length: 74 bytes (592 bits)
    Capture Length: 74 bytes (592 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Internet Protocol Version 4, Src: 88.190.31.67 (88.190.31.67), Dst: 192.168.0.1 (192.168.0.1)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 60
    Identification: 0x0000 (0)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 51
    Protocol: TCP (6)
    Header checksum: 0x0db0 [correct]
        [Good: True]
        [Bad: False]
    Source: 88.190.31.67 (88.190.31.67)
    Destination: 192.168.0.1 (192.168.0.1)
Transmission Control Protocol, Src Port: http (80), Dst Port: 50376 (50376), Seq: 0, Ack: 1, Len: 0
    Source port: http (80)
    Destination port: 50376 (50376)
    [Stream index: 0]
    Sequence number: 0    (relative sequence number)
    Acknowledgement number: 1    (relative ack number)
    Header length: 40 bytes
    Flags: 0x12 (SYN, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..1. = Syn: Set
            [Expert Info (Chat/Sequence): Connection establish acknowledge (SYN+ACK): server port http]
                [Message: Connection establish acknowledge (SYN+ACK): server port http]
                [Severity level: Chat]
                [Group: Sequence]
        .... .... ...0 = Fin: Not set
    Window size value: 4992
    [Calculated window size: 4992]
    Checksum: 0x7106 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (20 bytes)
        Maximum segment size: 1452 bytes
        TCP SACK Permitted Option: True
        Timestamps: TSval 1234556598, TSecr 622344802
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 1234556598
            Timestamp echo reply: 622344802
        No-Operation (NOP)
        Window scale: 7 (multiply by 128)
            Kind: Window Scale (3)
            Length: 3
            Shift count: 7
            [Multiplier: 128]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 1]
        [The RTT to ACK the segment was: 0.047724000 seconds]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      3 0.047767    192.168.0.1          88.190.31.67          TCP      66     50376 > http [ACK] Seq=1 Ack=1 Win=524280 Len=0 TSval=622344803 TSecr=1234556598 3

Frame 3: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
    Arrival Time: Apr 15, 2012 18:03:47.423605000 CEST
    Epoch Time: 1334505827.423605000 seconds
    [Time delta from previous captured frame: 0.000043000 seconds]
    [Time delta from previous displayed frame: 0.000043000 seconds]
    [Time since reference or first frame: 0.047767000 seconds]
    Frame Number: 3
    Frame Length: 66 bytes (528 bits)
    Capture Length: 66 bytes (528 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Internet Protocol Version 4, Src: 192.168.0.1 (192.168.0.1), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 52
    Identification: 0xd26c (53868)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: TCP (6)
    Header checksum: 0x2e4b [correct]
        [Good: True]
        [Bad: False]
    Source: 192.168.0.1 (192.168.0.1)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 50376 (50376), Dst Port: http (80), Seq: 1, Ack: 1, Len: 0
    Source port: 50376 (50376)
    Destination port: http (80)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 1    (relative ack number)
    Header length: 32 bytes
    Flags: 0x10 (ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 65535
    [Calculated window size: 524280]
    [Window size scaling factor: 8]
    Checksum: 0xb349 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 622344803, TSecr 1234556598
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 622344803
            Timestamp echo reply: 1234556598
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2]
        [The RTT to ACK the segment was: 0.000043000 seconds]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      4 0.047878    192.168.0.1          88.190.31.67          TCP      548    [TCP segment of a reassembled PDU]                              4

Frame 4: 548 bytes on wire (4384 bits), 548 bytes captured (4384 bits)
    Arrival Time: Apr 15, 2012 18:03:47.423716000 CEST
    Epoch Time: 1334505827.423716000 seconds
    [Time delta from previous captured frame: 0.000111000 seconds]
    [Time delta from previous displayed frame: 0.000111000 seconds]
    [Time since reference or first frame: 0.047878000 seconds]
    Frame Number: 4
    Frame Length: 548 bytes (4384 bits)
    Capture Length: 548 bytes (4384 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Internet Protocol Version 4, Src: 192.168.0.1 (192.168.0.1), Dst: 88.190.31.67 (88.190.31.67)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 534
    Identification: 0x8411 (33809)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: TCP (6)
    Header checksum: 0x7ac4 [correct]
        [Good: True]
        [Bad: False]
    Source: 192.168.0.1 (192.168.0.1)
    Destination: 88.190.31.67 (88.190.31.67)
Transmission Control Protocol, Src Port: 50376 (50376), Dst Port: http (80), Seq: 1, Ack: 1, Len: 482
    Source port: 50376 (50376)
    Destination port: http (80)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    [Next sequence number: 483    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 32 bytes
    Flags: 0x18 (PSH, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 1... = Push: Set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 65535
    [Calculated window size: 524280]
    [Window size scaling factor: 8]
    Checksum: 0xc9d5 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 622344803, TSecr 1234556598
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 622344803
            Timestamp echo reply: 1234556598
    [SEQ/ACK analysis]
        [Bytes in flight: 482]
    TCP segment data (482 bytes)

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      5 0.103071    88.190.31.67          192.168.0.1          TCP      66     http > 50376 [ACK] Seq=1 Ack=483 Win=6144 Len=0 TSval=1234556611 TSecr=622344803 5

Frame 5: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
    Arrival Time: Apr 15, 2012 18:03:47.478909000 CEST
    Epoch Time: 1334505827.478909000 seconds
    [Time delta from previous captured frame: 0.055193000 seconds]
    [Time delta from previous displayed frame: 0.055193000 seconds]
    [Time since reference or first frame: 0.103071000 seconds]
    Frame Number: 5
    Frame Length: 66 bytes (528 bits)
    Capture Length: 66 bytes (528 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Internet Protocol Version 4, Src: 88.190.31.67 (88.190.31.67), Dst: 192.168.0.1 (192.168.0.1)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 52
    Identification: 0xbb0a (47882)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 51
    Protocol: TCP (6)
    Header checksum: 0x52ad [correct]
        [Good: True]
        [Bad: False]
    Source: 88.190.31.67 (88.190.31.67)
    Destination: 192.168.0.1 (192.168.0.1)
Transmission Control Protocol, Src Port: http (80), Dst Port: 50376 (50376), Seq: 1, Ack: 483, Len: 0
    Source port: http (80)
    Destination port: 50376 (50376)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 483    (relative ack number)
    Header length: 32 bytes
    Flags: 0x10 (ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 48
    [Calculated window size: 6144]
    [Window size scaling factor: 128]
    Checksum: 0xb12a [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 1234556611, TSecr 622344803
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 1234556611
            Timestamp echo reply: 622344803
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 4]
        [The RTT to ACK the segment was: 0.055193000 seconds]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      6 0.103116    192.168.0.1          88.190.31.67          HTTP     1373   POST / HTTP/1.1  (application/vnd.syncml+xml)                   6

Frame 6: 1373 bytes on wire (10984 bits), 1373 bytes captured (10984 bits)
    Arrival Time: Apr 15, 2012 18:03:47.478954000 CEST
    Epoch Time: 1334505827.478954000 seconds
    [Time delta from previous captured frame: 0.000045000 seconds]
    [Time delta from previous displayed frame: 0.000045000 seconds]
    [Time since reference or first frame: 0.103116000 seconds]
    Frame Number: 6
    Frame Length: 1373 bytes (10984 bits)
    Capture Length: 1373 bytes (10984 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp:http:media]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Transmission Control Protocol, Src Port: 50376 (50376), Dst Port: http (80), Seq: 483, Ack: 1, Len: 1307
    Source port: 50376 (50376)
    Destination port: http (80)
    [Stream index: 0]
    Sequence number: 483    (relative sequence number)
    [Next sequence number: 1790    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 32 bytes
    Flags: 0x18 (PSH, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 1... = Push: Set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 65535
    [Calculated window size: 524280]
    [Window size scaling factor: 8]
    Checksum: 0xb6cd [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 622344803, TSecr 1234556611
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 622344803
            Timestamp echo reply: 1234556611
    [SEQ/ACK analysis]
        [Bytes in flight: 1307]
    TCP segment data (1307 bytes)
[11 Reassembled TCP Segments (1789 bytes): #4(482), #6(1307), #7(1307), #8(1307), #9(1307), #10(1307), #19(1307), #22(1307), #23(1307), #24(1307), #25(1307)]
    [Frame: 4, payload: 0-481 (482 bytes)]
    [Frame: 6, payload: 482-1788 (1307 bytes)]
    [Frame: 7, payload: 482-1788 (1307 bytes)]
        [Segment overlap: True]
    [Frame: 8, payload: 482-1788 (1307 bytes)]
        [Segment overlap: True]
    [Frame: 9, payload: 482-1788 (1307 bytes)]
        [Segment overlap: True]
    [Frame: 10, payload: 482-1788 (1307 bytes)]
        [Segment overlap: True]
    [Frame: 19, payload: 482-1788 (1307 bytes)]
        [Segment overlap: True]
    [Frame: 22, payload: 482-1788 (1307 bytes)]
        [Segment overlap: True]
    [Frame: 23, payload: 482-1788 (1307 bytes)]
        [Segment overlap: True]
    [Frame: 24, payload: 482-1788 (1307 bytes)]
        [Segment overlap: True]
    [Frame: 25, payload: 482-1788 (1307 bytes)]
        [Segment overlap: True]
    [Segment count: 11]
    [Reassembled TCP length: 1789]
Hypertext Transfer Protocol
    POST / HTTP/1.1\r\n
        [Expert Info (Chat/Sequence): POST / HTTP/1.1\r\n]
            [Message: POST / HTTP/1.1\r\n]
            [Severity level: Chat]
            [Group: Sequence]
        Request Method: POST
        Request URI: /
        Request Version: HTTP/1.1
    Host: sync.memotoo.com\r\n
    User-Agent: Funambol Mozilla Sync Client v0.9.1\r\n
    Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\n
    Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3\r\n
    Accept-Encoding: gzip,deflate\r\n
    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n
    Keep-Alive: 300\r\n
    Connection: keep-alive\r\n
    Content-Type: application/vnd.syncml+xml\r\n
    Content-Length: 1307\r\n
        [Content length: 1307]
    Pragma: no-cache\r\n
    Cache-Control: no-cache\r\n
    \r\n
    [Full request URI: http://sync.memotoo.com/]
Media Type
    Media Type: application/vnd.syncml+xml (1307 bytes)

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      7 1.045730    192.168.0.1          88.190.31.67          TCP      1373   [TCP Retransmission] [TCP segment of a reassembled PDU]         7

Frame 7: 1373 bytes on wire (10984 bits), 1373 bytes captured (10984 bits)
    Arrival Time: Apr 15, 2012 18:03:48.421568000 CEST
    Epoch Time: 1334505828.421568000 seconds
    [Time delta from previous captured frame: 0.942614000 seconds]
    [Time delta from previous displayed frame: 0.942614000 seconds]
    [Time since reference or first frame: 1.045730000 seconds]
    Frame Number: 7
    Frame Length: 1373 bytes (10984 bits)
    Capture Length: 1373 bytes (10984 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: Bad TCP]
    [Coloring Rule String: tcp.analysis.flags]
Transmission Control Protocol, Src Port: 50376 (50376), Dst Port: http (80), Seq: 483, Ack: 1, Len: 1307
    Source port: 50376 (50376)
    Destination port: http (80)
    [Stream index: 0]
    Sequence number: 483    (relative sequence number)
    [Next sequence number: 1790    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 32 bytes
    Flags: 0x18 (PSH, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 1... = Push: Set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 65535
    [Calculated window size: 524280]
    [Window size scaling factor: 8]
    Checksum: 0xb6c4 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 622344812, TSecr 1234556611
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 622344812
            Timestamp echo reply: 1234556611
    [SEQ/ACK analysis]
        [Bytes in flight: 1307]
        [TCP Analysis Flags]
            [This frame is a (suspected) retransmission]
                [Expert Info (Note/Sequence): Retransmission (suspected)]
                    [Message: Retransmission (suspected)]
                    [Severity level: Note]
                    [Group: Sequence]
            [The RTO for this segment was: 0.942614000 seconds]
            [RTO based on delta from frame: 6]
    [Reassembled PDU in frame: 6]
    TCP segment data (1307 bytes)

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      8 3.048021    192.168.0.1          88.190.31.67          TCP      1373   [TCP Retransmission] [TCP segment of a reassembled PDU]         8

Frame 8: 1373 bytes on wire (10984 bits), 1373 bytes captured (10984 bits)
    Arrival Time: Apr 15, 2012 18:03:50.423859000 CEST
    Epoch Time: 1334505830.423859000 seconds
    [Time delta from previous captured frame: 2.002291000 seconds]
    [Time delta from previous displayed frame: 2.002291000 seconds]
    [Time since reference or first frame: 3.048021000 seconds]
    Frame Number: 8
    Frame Length: 1373 bytes (10984 bits)
    Capture Length: 1373 bytes (10984 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: Bad TCP]
    [Coloring Rule String: tcp.analysis.flags]
Transmission Control Protocol, Src Port: 50376 (50376), Dst Port: http (80), Seq: 483, Ack: 1, Len: 1307
    Source port: 50376 (50376)
    Destination port: http (80)
    [Stream index: 0]
    Sequence number: 483    (relative sequence number)
    [Next sequence number: 1790    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 32 bytes
    Flags: 0x18 (PSH, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 1... = Push: Set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 65535
    [Calculated window size: 524280]
    [Window size scaling factor: 8]
    Checksum: 0xb6b0 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 622344832, TSecr 1234556611
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 622344832
            Timestamp echo reply: 1234556611
    [SEQ/ACK analysis]
        [Bytes in flight: 1307]
        [TCP Analysis Flags]
            [This frame is a (suspected) retransmission]
                [Expert Info (Note/Sequence): Retransmission (suspected)]
                    [Message: Retransmission (suspected)]
                    [Severity level: Note]
                    [Group: Sequence]
            [The RTO for this segment was: 2.944905000 seconds]
            [RTO based on delta from frame: 6]
    [Reassembled PDU in frame: 6]
    TCP segment data (1307 bytes)

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      9 7.050827    192.168.0.1          88.190.31.67          TCP      1373   [TCP Retransmission] [TCP segment of a reassembled PDU]         9

Frame 9: 1373 bytes on wire (10984 bits), 1373 bytes captured (10984 bits)
    Arrival Time: Apr 15, 2012 18:03:54.426665000 CEST
    Epoch Time: 1334505834.426665000 seconds
    [Time delta from previous captured frame: 4.002806000 seconds]
    [Time delta from previous displayed frame: 4.002806000 seconds]
    [Time since reference or first frame: 7.050827000 seconds]
    Frame Number: 9
    Frame Length: 1373 bytes (10984 bits)
    Capture Length: 1373 bytes (10984 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: Bad TCP]
    [Coloring Rule String: tcp.analysis.flags]
Transmission Control Protocol, Src Port: 50376 (50376), Dst Port: http (80), Seq: 483, Ack: 1, Len: 1307
    Source port: 50376 (50376)
    Destination port: http (80)
    [Stream index: 0]
    Sequence number: 483    (relative sequence number)
    [Next sequence number: 1790    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 32 bytes
    Flags: 0x18 (PSH, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 1... = Push: Set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 65535
    [Calculated window size: 524280]
    [Window size scaling factor: 8]
    Checksum: 0xb688 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 622344872, TSecr 1234556611
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 622344872
            Timestamp echo reply: 1234556611
    [SEQ/ACK analysis]
        [Bytes in flight: 1307]
        [TCP Analysis Flags]
            [This frame is a (suspected) retransmission]
                [Expert Info (Note/Sequence): Retransmission (suspected)]
                    [Message: Retransmission (suspected)]
                    [Severity level: Note]
                    [Group: Sequence]
            [The RTO for this segment was: 6.947711000 seconds]
            [RTO based on delta from frame: 6]
    [Reassembled PDU in frame: 6]
    TCP segment data (1307 bytes)

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     10 15.056194   192.168.0.1          88.190.31.67          TCP      1373   [TCP Retransmission] [TCP segment of a reassembled PDU]         10

Frame 10: 1373 bytes on wire (10984 bits), 1373 bytes captured (10984 bits)
    Arrival Time: Apr 15, 2012 18:04:02.432032000 CEST
    Epoch Time: 1334505842.432032000 seconds
    [Time delta from previous captured frame: 8.005367000 seconds]
    [Time delta from previous displayed frame: 8.005367000 seconds]
    [Time since reference or first frame: 15.056194000 seconds]
    Frame Number: 10
    Frame Length: 1373 bytes (10984 bits)
    Capture Length: 1373 bytes (10984 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: Bad TCP]
    [Coloring Rule String: tcp.analysis.flags]
Transmission Control Protocol, Src Port: 50376 (50376), Dst Port: http (80), Seq: 483, Ack: 1, Len: 1307
    Source port: 50376 (50376)
    Destination port: http (80)
    [Stream index: 0]
    Sequence number: 483    (relative sequence number)
    [Next sequence number: 1790    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 32 bytes
    Flags: 0x18 (PSH, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 1... = Push: Set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 65535
    [Calculated window size: 524280]
    [Window size scaling factor: 8]
    Checksum: 0xb638 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 622344952, TSecr 1234556611
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 622344952
            Timestamp echo reply: 1234556611
    [SEQ/ACK analysis]
        [Bytes in flight: 1307]
        [TCP Analysis Flags]
            [This frame is a (suspected) retransmission]
                [Expert Info (Note/Sequence): Retransmission (suspected)]
                    [Message: Retransmission (suspected)]
                    [Severity level: Note]
                    [Group: Sequence]
            [The RTO for this segment was: 14.953078000 seconds]
            [RTO based on delta from frame: 6]
    [Reassembled PDU in frame: 6]
    TCP segment data (1307 bytes)

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     11 20.359684   88.190.31.67          192.168.0.1          HTTP     392    HTTP/1.1 408 Request Timeout                                    11

Frame 11: 392 bytes on wire (3136 bits), 392 bytes captured (3136 bits)
    Arrival Time: Apr 15, 2012 18:04:07.735522000 CEST
    Epoch Time: 1334505847.735522000 seconds
    [Time delta from previous captured frame: 5.303490000 seconds]
    [Time delta from previous displayed frame: 5.303490000 seconds]
    [Time since reference or first frame: 20.359684000 seconds]
    Frame Number: 11
    Frame Length: 392 bytes (3136 bits)
    Capture Length: 392 bytes (3136 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp:http:data]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Transmission Control Protocol, Src Port: http (80), Dst Port: 50376 (50376), Seq: 1, Ack: 483, Len: 326
    Source port: http (80)
    Destination port: 50376 (50376)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    [Next sequence number: 327    (relative sequence number)]
    Acknowledgement number: 483    (relative ack number)
    Header length: 32 bytes
    Flags: 0x18 (PSH, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 1... = Push: Set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 48
    [Calculated window size: 6144]
    [Window size scaling factor: 128]
    Checksum: 0x2c16 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 1234561620, TSecr 622344803
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 1234561620
            Timestamp echo reply: 622344803
    [SEQ/ACK analysis]
        [Bytes in flight: 326]
Hypertext Transfer Protocol
    HTTP/1.1 408 Request Timeout\r\n
        [Expert Info (Chat/Sequence): HTTP/1.1 408 Request Timeout\r\n]
            [Message: HTTP/1.1 408 Request Timeout\r\n]
            [Severity level: Chat]
            [Group: Sequence]
        Request Version: HTTP/1.1
        Status Code: 408
        Response Phrase: Request Timeout
    Date: Sun, 15 Apr 2012 16:03:37 GMT\r\n
    Server: Apache/2.2.16 (Debian)\r\n
    X-Powered-By: PHP/5.3.3-7+squeeze8\r\n
    Set-Cookie: PHPSESSID=gqrikpeq1ctv6381p5n1kt0o10; path=/\r\n
    Vary: Accept-Encoding\r\n
    Content-Encoding: gzip\r\n
    Content-Length: 20\r\n
        [Content length: 20]
    Connection: close\r\n
    Content-Type: text/html\r\n
    \r\n
    Content-encoded entity body (gzip): 20 bytes [Error: Decompression failed]
        Data (20 bytes)

0000  1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00   ................
0010  00 00 00 00                                       ....
            Data: 1f8b080000000000000303000000000000000000
            [Length: 20]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
     12 20.359733   192.168.0.1          88.190.31.67          TCP      66     50376 > http [ACK] Seq=1790 Ack=327 Win=524280 Len=0 TSval=622345005 TSecr=1234561620 12

Coté serveur: (le fichier en entier ici: http://www.memotoo.com/capture_ethereal_2012-04-15_memotoo1.txt)

Code:

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      1 0.000000    92.157.22.194         88.190.31.67          TCP      78     50376 > http [SYN] Seq=0 Win=65535 Len=0 MSS=1452 WS=8 TSval=622344802 TSecr=0 SACK_PERM=1 1

Frame 1: 78 bytes on wire (624 bits), 78 bytes captured (624 bits)
    Arrival Time: Apr 15, 2012 18:03:37.186863000 CEST
    Epoch Time: 1334505817.186863000 seconds
    [Time delta from previous captured frame: 0.000000000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 0.000000000 seconds]
    Frame Number: 1
    Frame Length: 78 bytes (624 bits)
    Capture Length: 78 bytes (624 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Transmission Control Protocol, Src Port: 50376 (50376), Dst Port: http (80), Seq: 0, Len: 0
    Source port: 50376 (50376)
    Destination port: http (80)
    [Stream index: 0]
    Sequence number: 0    (relative sequence number)
    Header length: 44 bytes
    Flags: 0x02 (SYN)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...0 .... = Acknowledgement: Not set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..1. = Syn: Set
            [Expert Info (Chat/Sequence): Connection establish request (SYN): server port http]
                [Message: Connection establish request (SYN): server port http]
                [Severity level: Chat]
                [Group: Sequence]
        .... .... ...0 = Fin: Not set
    Window size value: 65535
    [Calculated window size: 65535]
    Checksum: 0x7d8b [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (24 bytes)
        Maximum segment size: 1452 bytes
        No-Operation (NOP)
        Window scale: 3 (multiply by 8)
            Kind: Window Scale (3)
            Length: 3
            Shift count: 3
            [Multiplier: 8]
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 622344802, TSecr 0
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 622344802
            Timestamp echo reply: 0
        TCP SACK Permitted Option: True
        End of Option List (EOL)

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      2 0.000048    88.190.31.67          92.157.22.194         TCP      74     http > 50376 [SYN, ACK] Seq=0 Ack=1 Win=4992 Len=0 MSS=576 SACK_PERM=1 TSval=1234556598 TSecr=622344802 WS=128 2

Frame 2: 74 bytes on wire (592 bits), 74 bytes captured (592 bits)
    Arrival Time: Apr 15, 2012 18:03:37.186911000 CEST
    Epoch Time: 1334505817.186911000 seconds
    [Time delta from previous captured frame: 0.000048000 seconds]
    [Time delta from previous displayed frame: 0.000048000 seconds]
    [Time since reference or first frame: 0.000048000 seconds]
    Frame Number: 2
    Frame Length: 74 bytes (592 bits)
    Capture Length: 74 bytes (592 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Transmission Control Protocol, Src Port: http (80), Dst Port: 50376 (50376), Seq: 0, Ack: 1, Len: 0
    Source port: http (80)
    Destination port: 50376 (50376)
    [Stream index: 0]
    Sequence number: 0    (relative sequence number)
    Acknowledgement number: 1    (relative ack number)
    Header length: 40 bytes
    Flags: 0x12 (SYN, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..1. = Syn: Set
            [Expert Info (Chat/Sequence): Connection establish acknowledge (SYN+ACK): server port http]
                [Message: Connection establish acknowledge (SYN+ACK): server port http]
                [Severity level: Chat]
                [Group: Sequence]
        .... .... ...0 = Fin: Not set
    Window size value: 4992
    [Calculated window size: 4992]
    Checksum: 0xc31e [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (20 bytes)
        Maximum segment size: 576 bytes
        TCP SACK Permitted Option: True
        Timestamps: TSval 1234556598, TSecr 622344802
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 1234556598
            Timestamp echo reply: 622344802
        No-Operation (NOP)
        Window scale: 7 (multiply by 128)
            Kind: Window Scale (3)
            Length: 3
            Shift count: 7
            [Multiplier: 128]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 1]
        [The RTT to ACK the segment was: 0.000048000 seconds]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      3 0.044746    92.157.22.194         88.190.31.67          TCP      66     50376 > http [ACK] Seq=1 Ack=1 Win=524280 Len=0 TSval=622344803 TSecr=1234556598 3

Frame 3: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
    Arrival Time: Apr 15, 2012 18:03:37.231609000 CEST
    Epoch Time: 1334505817.231609000 seconds
    [Time delta from previous captured frame: 0.044698000 seconds]
    [Time delta from previous displayed frame: 0.044698000 seconds]
    [Time since reference or first frame: 0.044746000 seconds]
    Frame Number: 3
    Frame Length: 66 bytes (528 bits)
    Capture Length: 66 bytes (528 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Transmission Control Protocol, Src Port: 50376 (50376), Dst Port: http (80), Seq: 1, Ack: 1, Len: 0
    Source port: 50376 (50376)
    Destination port: http (80)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 1    (relative ack number)
    Header length: 32 bytes
    Flags: 0x10 (ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 65535
    [Calculated window size: 524280]
    [Window size scaling factor: 8]
    Checksum: 0x01f6 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 622344803, TSecr 1234556598
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 622344803
            Timestamp echo reply: 1234556598
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2]
        [The RTT to ACK the segment was: 0.044698000 seconds]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      4 0.054763    92.157.22.194         88.190.31.67          TCP      548    [TCP segment of a reassembled PDU]                              4

Frame 4: 548 bytes on wire (4384 bits), 548 bytes captured (4384 bits)
    Arrival Time: Apr 15, 2012 18:03:37.241626000 CEST
    Epoch Time: 1334505817.241626000 seconds
    [Time delta from previous captured frame: 0.010017000 seconds]
    [Time delta from previous displayed frame: 0.010017000 seconds]
    [Time since reference or first frame: 0.054763000 seconds]
    Frame Number: 4
    Frame Length: 548 bytes (4384 bits)
    Capture Length: 548 bytes (4384 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Transmission Control Protocol, Src Port: 50376 (50376), Dst Port: http (80), Seq: 1, Ack: 1, Len: 482
    Source port: 50376 (50376)
    Destination port: http (80)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    [Next sequence number: 483    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 32 bytes
    Flags: 0x18 (PSH, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 1... = Push: Set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 65535
    [Calculated window size: 524280]
    [Window size scaling factor: 8]
    Checksum: 0x1882 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 622344803, TSecr 1234556598
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 622344803
            Timestamp echo reply: 1234556598
    [SEQ/ACK analysis]
        [Bytes in flight: 482]
    TCP segment data (482 bytes)

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      5 0.054801    88.190.31.67          92.157.22.194         TCP      66     http > 50376 [ACK] Seq=1 Ack=483 Win=6144 Len=0 TSval=1234556611 TSecr=622344803 5

Frame 5: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
    Arrival Time: Apr 15, 2012 18:03:37.241664000 CEST
    Epoch Time: 1334505817.241664000 seconds
    [Time delta from previous captured frame: 0.000038000 seconds]
    [Time delta from previous displayed frame: 0.000038000 seconds]
    [Time since reference or first frame: 0.054801000 seconds]
    Frame Number: 5
    Frame Length: 66 bytes (528 bits)
    Capture Length: 66 bytes (528 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Transmission Control Protocol, Src Port: http (80), Dst Port: 50376 (50376), Seq: 1, Ack: 483, Len: 0
    Source port: http (80)
    Destination port: 50376 (50376)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 483    (relative ack number)
    Header length: 32 bytes
    Flags: 0x10 (ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 48
    [Calculated window size: 6144]
    [Window size scaling factor: 128]
    Checksum: 0xffd6 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 1234556611, TSecr 622344803
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 1234556611
            Timestamp echo reply: 622344803
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 4]
        [The RTT to ACK the segment was: 0.000038000 seconds]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      6 20.090564   88.190.31.67          92.157.22.194         HTTP     392    HTTP/1.1 408 Request Timeout                                    6

Frame 6: 392 bytes on wire (3136 bits), 392 bytes captured (3136 bits)
    Arrival Time: Apr 15, 2012 18:03:57.277427000 CEST
    Epoch Time: 1334505837.277427000 seconds
    [Time delta from previous captured frame: 20.035763000 seconds]
    [Time delta from previous displayed frame: 20.035763000 seconds]
    [Time since reference or first frame: 20.090564000 seconds]
    Frame Number: 6
    Frame Length: 392 bytes (3136 bits)
    Capture Length: 392 bytes (3136 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp:http:data]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Transmission Control Protocol, Src Port: http (80), Dst Port: 50376 (50376), Seq: 1, Ack: 483, Len: 326
    Source port: http (80)
    Destination port: 50376 (50376)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    [Next sequence number: 327    (relative sequence number)]
    Acknowledgement number: 483    (relative ack number)
    Header length: 32 bytes
    Flags: 0x18 (PSH, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 1... = Push: Set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 48
    [Calculated window size: 6144]
    [Window size scaling factor: 128]
    Checksum: 0xeccc [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 1234561620, TSecr 622344803
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 1234561620
            Timestamp echo reply: 622344803
    [SEQ/ACK analysis]
        [Bytes in flight: 326]
Hypertext Transfer Protocol
    HTTP/1.1 408 Request Timeout\r\n
        [Expert Info (Chat/Sequence): HTTP/1.1 408 Request Timeout\r\n]
            [Message: HTTP/1.1 408 Request Timeout\r\n]
            [Severity level: Chat]
            [Group: Sequence]
        Request Version: HTTP/1.1
        Status Code: 408
        Response Phrase: Request Timeout
    Date: Sun, 15 Apr 2012 16:03:37 GMT\r\n
    Server: Apache/2.2.16 (Debian)\r\n
    X-Powered-By: PHP/5.3.3-7+squeeze8\r\n
    Set-Cookie: PHPSESSID=gqrikpeq1ctv6381p5n1kt0o10; path=/\r\n
    Vary: Accept-Encoding\r\n
    Content-Encoding: gzip\r\n
    Content-Length: 20\r\n
        [Content length: 20]
    Connection: close\r\n
    Content-Type: text/html\r\n
    \r\n
    Content-encoded entity body (gzip): 20 bytes [Error: Decompression failed]
        Data (20 bytes)

0000  1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00   ................
0010  00 00 00 00                                       ....
            Data: 1f8b080000000000000303000000000000000000
            [Length: 20]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      7 20.090622   88.190.31.67          92.157.22.194         TCP      66     http > 50376 [FIN, ACK] Seq=327 Ack=483 Win=6144 Len=0 TSval=1234561620 TSecr=622344803 7

Frame 7: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
    Arrival Time: Apr 15, 2012 18:03:57.277485000 CEST
    Epoch Time: 1334505837.277485000 seconds
    [Time delta from previous captured frame: 0.000058000 seconds]
    [Time delta from previous displayed frame: 0.000058000 seconds]
    [Time since reference or first frame: 20.090622000 seconds]
    Frame Number: 7
    Frame Length: 66 bytes (528 bits)
    Capture Length: 66 bytes (528 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Transmission Control Protocol, Src Port: http (80), Dst Port: 50376 (50376), Seq: 327, Ack: 483, Len: 0
    Source port: http (80)
    Destination port: 50376 (50376)
    [Stream index: 0]
    Sequence number: 327    (relative sequence number)
    Acknowledgement number: 483    (relative ack number)
    Header length: 32 bytes
    Flags: 0x11 (FIN, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...1 = Fin: Set
            [Expert Info (Chat/Sequence): Connection finish (FIN)]
                [Message: Connection finish (FIN)]
                [Severity level: Chat]
                [Group: Sequence]
    Window size value: 48
    [Calculated window size: 6144]
    [Window size scaling factor: 128]
    Checksum: 0xeafe [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 1234561620, TSecr 622344803
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 1234561620
            Timestamp echo reply: 622344803

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      8 20.339864   88.190.31.67          92.157.22.194         HTTP     392    [TCP Retransmission] HTTP/1.1 408 Request Timeout               8

Frame 8: 392 bytes on wire (3136 bits), 392 bytes captured (3136 bits)
    Arrival Time: Apr 15, 2012 18:03:57.526727000 CEST
    Epoch Time: 1334505837.526727000 seconds
    [Time delta from previous captured frame: 0.249242000 seconds]
    [Time delta from previous displayed frame: 0.249242000 seconds]
    [Time since reference or first frame: 20.339864000 seconds]
    Frame Number: 8
    Frame Length: 392 bytes (3136 bits)
    Capture Length: 392 bytes (3136 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp:http:data]
    [Coloring Rule Name: Bad TCP]
    [Coloring Rule String: tcp.analysis.flags]
Transmission Control Protocol, Src Port: http (80), Dst Port: 50376 (50376), Seq: 1, Ack: 483, Len: 326
    Source port: http (80)
    Destination port: 50376 (50376)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    [Next sequence number: 327    (relative sequence number)]
    Acknowledgement number: 483    (relative ack number)
    Header length: 32 bytes
    Flags: 0x18 (PSH, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgement: Set
        .... .... 1... = Push: Set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 48
    [Calculated window size: 6144]
    [Window size scaling factor: 128]
    Checksum: 0xeccc [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Options: (12 bytes)
        No-Operation (NOP)
        No-Operation (NOP)
        Timestamps: TSval 1234561683, TSecr 622344803
            Kind: Timestamp (8)
            Length: 10
            Timestamp value: 1234561683
            Timestamp echo reply: 622344803
    [SEQ/ACK analysis]
        [Bytes in flight: 327]
        [TCP Analysis Flags]
            [This frame is a (suspected) retransmission]
                [Expert Info (Note/Sequence): Retransmission (suspected)]
                    [Message: Retransmission (suspected)]
                    [Severity level: Note]
                    [Group: Sequence]
            [The RTO for this segment was: 0.249242000 seconds]
            [RTO based on delta from frame: 7]
Hypertext Transfer Protocol
    HTTP/1.1 408 Request Timeout\r\n
        [Expert Info (Chat/Sequence): HTTP/1.1 408 Request Timeout\r\n]
            [Message: HTTP/1.1 408 Request Timeout\r\n]
            [Severity level: Chat]
            [Group: Sequence]
        Request Version: HTTP/1.1
        Status Code: 408
        Response Phrase: Request Timeout
    Date: Sun, 15 Apr 2012 16:03:37 GMT\r\n
    Server: Apache/2.2.16 (Debian)\r\n
    X-Powered-By: PHP/5.3.3-7+squeeze8\r\n
    Set-Cookie: PHPSESSID=gqrikpeq1ctv6381p5n1kt0o10; path=/\r\n
    Vary: Accept-Encoding\r\n
    Content-Encoding: gzip\r\n
    Content-Length: 20\r\n
        [Content length: 20]
    Connection: close\r\n
    Content-Type: text/html\r\n
    \r\n
    Content-encoded entity body (gzip): 20 bytes [Error: Decompression failed]
        Data (20 bytes)

0000  1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00   ................
0010  00 00 00 00                                       ....
            Data: 1f8b080000000000000303000000000000000000
            [Length: 20]

No.     Time        Source                Destination           Protocol Length Info                                                            New Column
      9 20.357020   92.157.22.194         88.190.31.67          TCP      66     [TCP Previous segment lost] 50376 > http [ACK] Seq=1790 Ack=327 Win=524280 Len=0 TSval=622345005 TSecr=1234561620 9

Haut

PascalHambourg

Sujet du message: Re: Problème MTU / MSS ?

Posté: 15 Avr 2012 20:05

Contributeur

Inscription: 18 Déc 2007 00:11
Messages: 4783

Visiblement, il y a un équipement quelque part sur le chemin qui réécrit aveuglément le MSS à 1452 dans les deux sens, que la valeur originelle soit supérieure ou inférieure !
Et ce sont bien de gros segments (~1300 octets) qui sont perdus entre le client et ton serveur.
En tout cas si j'essaie depuis ma connexion je reçois bien le MSS à 576, donc a priori le responsable de ce tripatouillage n'est pas un équipement du côté de ton hébergeur. En revanche les pings de plus de 1300 octets ne passent pas (je ne sais pas si c'est à l'aller ou au retour, je ne sais pas si ça ne concerne que le ping). Et si je fragmente à 1300 ou en-dessous, alors la reponse me parvient aussi fragmentée à 1300 !

_________________
Attention : contributeur méchant !
Pentium III 550 MHz, RAM 128 Mio, disque 4,3 Go. Debian Squeeze avec noyau Linux maison. On ne rit pas ! c'est mon nouveau serveur+routeur ADSL.

Haut

Thomas

Sujet du message: Re: Problème MTU / MSS ?

Posté: 16 Avr 2012 09:28

Nouvel utilisateur

Inscription: 12 Avr 2012 16:18
Messages: 17

Oui je suis d'accord avec toi, il y a un équipement qui ré-écrit le MTU à 1452 car aussi c'est ça que je reçois sur le serveur alors que le client envoie un MTU de 1460.

Les ping ont peut être des problèmes à cause de règles iptables que j'ai mis.
Quelles commande utilises-tu ping pour tester ?
Veux-tu que je vérifies une configuration de mon serveur ?

Haut

PascalHambourg

Sujet du message: Re: Problème MTU / MSS ?

Posté: 16 Avr 2012 09:50

Contributeur

Inscription: 18 Déc 2007 00:11
Messages: 4783

Code:

ping -s <taille-28> 88.190.31.67

(il faut compter 28 octets pour l'en-tête IP+ICMP)
Un traceroute en ICMP avec une taille supérieure à 1300 s'arrête sur le dernier routeur, mais cela ne permet pas de savoir si c'est ce routeur qui bloque ou ton serveur qui ne répond pas.

Code:

traceroute -I 88.190.31.67 <taille>

Tu peux faire la même chose et faire une capture sur le serveur pour vérifier si les paquets qui n'ont pas de réponse arrivent.

_________________
Attention : contributeur méchant !
Pentium III 550 MHz, RAM 128 Mio, disque 4,3 Go. Debian Squeeze avec noyau Linux maison. On ne rit pas ! c'est mon nouveau serveur+routeur ADSL.

Haut

Thomas

Sujet du message: Re: Problème MTU / MSS ?

Posté: 16 Avr 2012 11:10

Nouvel utilisateur

Inscription: 12 Avr 2012 16:18
Messages: 17

Avec cette commande, les paquets n'arrivent pas:

Code:

traceroute -I 88.190.31.67 1300

Avec cette commande, les paquets arrivent:

Code:

traceroute -I 88.190.31.67 1200

Par contre si j'augmentes le MTU à 1500, les paquets arrivent. (j'ai fait ce test sur un autre serveur)

Veux-tu que je testes autre chose ?

Haut

Page 1 sur 2

[ 39 messages ]

Aller à la page 1, 2 Suivante

Index du forum » Forums d'aide » Support Debian

Qui est en ligne

Utilisateurs parcourant ce forum: Aucun utilisateur enregistré et 1 invité

Vous ne pouvez pas poster de nouveaux sujets
Vous ne pouvez pas répondre aux sujets
Vous ne pouvez pas éditer vos messages
Vous ne pouvez pas supprimer vos messages
Vous ne pouvez pas joindre des fichiers

Flux RSS

Liste des flux
Powered by phpBB® Forum Software © phpBB Group
Traduction par: phpBB-fr.com
SEO
[ Time : 0.330s | 15 Queries | GZIP : Off ]

Forum debian-fr.org

Problème MTU / MSS ?

Qui est en ligne