Re: snoop question

James Carlson wrote:
"Stuart" <bigdakine@xxxxxxx> writes:
when runing snoop -V

what is the meaning of the ID= field?

Is that simply the packet number or is it something else?

It's the IP Identification field. See RFC 791.


THis is going to sound stupid. I'm suspicious that along one of my
data parthways, packets are getting lost, discarded whatever. THe same
server also sends the data along an alternate route over which there
are no problems. THat is, there are no gaps in the data which are
timestamped, so I know precisely when I am missing something.

I'm not sure where exactly the problem is; however, given that over one
route there is not a problem, tends to rule out the server and my
client itself as the source of the dat gaps.

When running snoop -V -tr, I noticed that the ID field which seems to
normally increment by one, sometimes skips a few numbers, and I was
wondering if that was indicative of a problem.




Relevant Pages

  • Packet cap diff... for classic dhcp over winxp s/w bridge prob.
    ... the server simultaneously. ... DHCP Discover - Transaction ID 0xe5448fbb ... Time delta from previous packet: ... Time since reference or first frame: ...
  • [Full-disclosure] Quick Blind TCP Connection Spoofing with SYN Cookies
    ... TCP uses 32 bit Seq/Ack numbers in order to make sure that both sides of a connection can actually receive packets from each other. ... these numbers make it relatively hard to spoof the source address because successful spoofing requires guessing the correct initial sequence number which is generated by the server in a non-guessable way. ... This article shows that the effort required for guessing a valid ISN can be reduced from hours to minutes if the server uses TCP SYN Cookies, which are enabled by default for various Linux distributions including Ubuntu and Debian. ... The Client sends a SYN packet to the server in order to initiate a connection. ...
  • Interesting TCP behaviour with large sends/small buffers
    ... The server, upon connection, sends a configurable number of bytes to ... I set the client's receive buffer size to 1MBps, ... packet before sending the next packet. ... ACK, according to the delayed ACK algorithm - 50KB bytes means 34 MSS- ...
  • Re: How to terminate a socket in CLOSE_WAIT state
    ... FTP Server fixed for certain FTP clients who use both passive ... This was causing a PASSIVE opened socket to be left ... but instead expect the "half close" from the receiver. ... this sends a TCP/IP FIN packet to the ...
  • Re: Sockets class question - sending TCP data
    ... Announcement DEV02, Workstation, Server, SQL Server, NT Workstation, NT ... Time delta from previous packet: ... Receiver's Name: DYNAMICSYSTEMS(Local Master Browser) ... You say that you did this in a Java applet. ...