|From: David Wuertele
|
|
|I'm using ethereal to analyze the http download of a large file, and I
|notice that once the client finishes its request, and starts sucking
|down packets, it sends nothing but Ack packets with the exact same
|sequence number. Here's a snippet:
[snip]
|Notice that everything from the client (169.254.242.55) has the same
|Sequence Number. Is that normal when the packet has nothing in it but
|a TCP Ack?
This is perfectly normal as the ACK refers to the last byte received at the
side sending the ACK (which is the last SEQ from the side receiving this
ACK). The HTTP protocol often operates in half-duplex mode where the client
sends an HTTP request, and waits for the response before sending the next
request. You can easily see this by noticing that the ACK sequence number
only increases at one side at a time (and the SEQ (and NextSEQ) sequence
number at the other side).
When using more elaborate full-duplex protocols running on top of TCP,
you'll see that the ACK sequences progress at both ends.
Regards,
Olivier