Re: newbie question about tcp three-way handshaking

[Shain Singh <shain.singh () gmail com>]

Have you got a two-way SPAN port setup for your capture?


On 22 January 2013 13:41, 温金超 <wenjinchao0418 () gmail com> wrote:

> Hi guys,
>
> Is should be *three-way handshaking* or not when trying to establishe a
> new connection?
> but I tcpdump following:
>
> 19:23:12.688758 IP 10.1.164.64.51350 > 10.13.220.4.80: S
> 3779651860:3779651860(0) win 8192 <mss 1260,nop,wscale 8,nop,nop,sackOK>
> *19:23:12.688776 IP 10.13.220.4.80 > 10.1.164.64.51350: S4133937230:4133937230(0)
> ack 3779651861 win 5840 <mss 1460,nop,nop,sackOK,nop,wscale 9>*
> *19:23:12.688779 IP 10.13.220.4.80 > 10.1.164.64.51350: S4133937230:4133937230(0)
> ack 3779651861 win 5840 <mss 1460,nop,nop,sackOK,nop,wscale 9>*
> 19:23:12.689716 IP 10.1.164.64.51350 > 10.13.220.4.80: . ack 1 win 260
>
> 10.13.220.4 ack twice for syn. any idea ?
>
> Thanks for any suggesstion.
>
> jinchao
>
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>              mailto:wireshark-users-request () wireshark org
> ?subject=unsubscribe



-- 
Shaineel Singh
e: shain.singh () gmail com
p: +61 422 921 951
w: http://buffet.shainsingh.com

--
"Too many have dispensed with generosity to practice charity" - Albert
Camus

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe