Ethereal-users: Re: [Ethereal-users] Help Analysing Transaction

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Mon, 24 Oct 2005 17:58:21 -0700
ronnie sahlberg wrote:

No this is not legal. TTCP tried to experiment long time ago with this in order to reduce the cost of latency for small shortlived transactions but issues were found with this approach (data inside the syn segment) which essentially killed TTCP off.

In TCP it is not legal to transfer data in the SYN segment.

RFC 793 says:

  We have taken advantage of the numbering scheme to protect certain
  control information as well.  This is achieved by implicitly including
  some control flags in the sequence space so they can be retransmitted
  and acknowledged without confusion (i.e., one and only one copy of the
  control will be acted upon).  Control information is not physically
  carried in the segment data space.  Consequently, we must adopt rules
  for implicitly assigning sequence numbers to control.  The SYN and FIN
  are the only controls requiring this protection, and these controls
  are used only at connection opening and closing.  For sequence number
  purposes, the SYN is considered to occur before the first actual data
  octet of the segment in which it occurs, while the FIN is considered
  to occur after the last actual data octet in a segment in which it
  occurs.  The segment length (SEG.LEN) includes both data and sequence
  space occupying controls.  When a SYN is present then SEG.SEQ is the
  sequence number of the SYN.

Does "the SYN is considered to occur before the first actual data octet of the segment in which it occurs" then refer only to a SYN+ACK packet, not to an initial SYN from the connecting host?