Here's something I coded up while on travel when I had issues with TCP
session closings.
It has some IPv6 issues (I was working with IPv4, but still tried to do
IPv6 stuff too)
It basically does a quick online summary of how well, each side
considers itself to be closed.
The issue I had hit was the receiver was responding to a fin with 2
packets (ack only, and fin-ack).
When the fin was lost, but the ack made it, another piece of software
was choking on it.
The output of this tap was used as an alternative for analyzing TCP
sessions.
(grep for "<->" worked well for grabbing the one line summaries)
I'm sure there is plenty of room for improvement...
Index: Makefile.nmake
===================================================================
RCS file: /cvsroot/ethereal/Makefile.nmake,v
retrieving revision 1.258
diff -r1.258 Makefile.nmake
335c335,336
< tap-rpcprogs.c
---
> tap-rpcprogs.c \
> tap-tcp_close.c
Attachment:
tap-tcp_close.c
Description: application/unknown-content-type-cfile
Index: Makefile.am
===================================================================
RCS file: /cvsroot/ethereal/Makefile.am,v
retrieving revision 1.521
diff -r1.521 Makefile.am
775c775,776
< tap-rpcprogs.c
---
> tap-rpcprogs.c \
> tap-tcp_close.c