On 12:34 AM 5/30/2006, Becky Vict wrote:
>Hello ethereal community.
>
>I need help in explaining the capture I get. I'm downloading a file from an FTP server and I'm noticing a weird thing which is - in the exact same timestamp I get data packet transmission from server and a dupack from client. In another instance, out-of-order from server is followed by dupack from client also in the same timestamp. And another instance which is even worse, TCP segment lost is followed by dupack and then retransmission all happening in the same timestamp (server-client-server). Even TCP window update comes in two, coming twice from client in the same timestamp (is this duplicated packet?)
>
>How is this possible? Is there something wrong?
>
>I'm using ethereal V 0.10.13 and winpcap 3.1.
>OS is XP Pro SP 1 both client and server.
>
>I hope I have given a clear picture of my problem.
Identifying a duplicate packet (due to a vpn client for example) is easy. Look at the IP ID field in the IP header. If they are the same, you have a cosmetic issue. Of course, every packet should be seen in twos. Form the sound of your situation, that may not be the case.
Do you have a sample capture that people can download from somewhere?
hsb
_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users