Interesting TCP issue

[David S. Madole]

> From Steve Watt on Monday, January 01, 2007 4:37 PM
> 
> # tcpdump -vv -s 1500 -i dc0 -X net 213.244.128.0/18
> tcpdump: lestening on dc0, link-type EN10MB (Ethernet), capture size 1500
> bytes
> 13:18:13.607493 IP (tos 0x20, ttl  58, id 12896, offset 0, flags [DF],
> proto: TCP (6), length: 74) share.skype.net.50406 > wattres.watt.com.smtp:
> P, cksum 0x9297 (correct), 4072464914:4072464936(22) ack 1248591103 win 46
> <nop,nop,timestamp 2511885672 520058954>
>         0x0000:  4520 004a 3260 4000 3a06 c609 d5f4 aa50  E..J2`@.:......P
>         0x0010:  425d 8582 c4e6 0019 f2bc e212 4a6b fcff  B]..........Jk..
>         0x0020:  8018 002e 9297 0000 0101 080a 95b8 5568  ..............Uh
>         0x0030:  1eff 784a 4548 4c4f 2073 6861 7265 2e73  ..xJEHLO.share.s
>         0x0040:  6b79 7065 2e6e 6574 0d0a                 kype.net..
> 
> Interesting.  I presume it has something to do with the
> idiotically small window the remote server is advertising.  So I
> set net.inet.tcp.minmss down to 46, and that resulted in a RST
> being spit back to skype's server when its retransmit happened.

Are you sure the window is really that small and that window scaling was not negotiated at the start of the connection? The initial packets are not captured here so I can't tell.

Is it possible to get a really complete capture of a session including the initial handshake?

David