Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

asked 2018-11-13 17:58:09 +0000

SJZK gravatar image

why does Wireshark flag the retransmission of a single byte fragment as a keep-alive? A true keep-[alive is an ACK with no data, tcp.len==0.

time T [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=1051295 ACK=101003 Win=263520 Len=1 time T+1.5000 [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=10512965 ACK=100003 Win=263520 Len=1 time T+3.000 [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=1051295 ACK=101003 Win=263520 Len=1 time T+6.000 [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=1051295 ACK=101003 Win=263520 Len=1 time T+12.000 [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=1051295 ACK=101003 Win=263520 Len=1

click to hide/show revision 2
None

updated 2018-11-14 10:56:09 +0000

grahamb gravatar image

why does Wireshark flag the retransmission of a single byte fragment as a keep-alive? A true keep-[alive is an ACK with no data, tcp.len==0.

time T [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=1051295 ACK=101003 Win=263520 Len=1 time T+1.5000 [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=10512965 ACK=100003 Win=263520 Len=1 time T+3.000 [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=1051295 ACK=101003 Win=263520 Len=1 time T+6.000 [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=1051295 ACK=101003 Win=263520 Len=1 time T+12.000 [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=1051295 ACK=101003 Win=263520 Len=1

click to hide/show revision 3
None

updated 2018-11-14 10:56:34 +0000

grahamb gravatar image

why does Wireshark flag the retransmission of a single byte fragment as a keep-alive? A true keep-[alive is an ACK with no data, tcp.len==0.

time T [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=1051295 ACK=101003 Win=263520 Len=1 time T+1.5000 [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=10512965 ACK=100003 Win=263520 Len=1 time T+3.000 [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=1051295 ACK=101003 Win=263520 Len=1 time T+6.000 [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=1051295 ACK=101003 Win=263520 Len=1 time T+12.000 [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=1051295 ACK=101003 Win=263520 Len=1

click to hide/show revision 4
None

updated 2018-11-14 10:56:53 +0000

grahamb gravatar image

why does Wireshark flag the retransmission of a single byte fragment as a keep-alive? A true keep-[alive is an ACK with no data, tcp.len==0.

e.g.:

time T  [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=1051295  ACK=101003 Win=263520 Len=1
 time T+1.5000  [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=10512965  ACK=100003 Win=263520 Len=1
 time T+3.000  [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=1051295  ACK=101003 Win=263520 Len=1
 time T+6.000  [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=1051295  ACK=101003 Win=263520 Len=1
 time T+12.000  [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=1051295  ACK=101003 Win=263520 Len=1
Len=1