iRTT Field Missing in Capture

asked 2019-09-26 18:53:42 +0000

Don
1 ●1 ●1 ●2

updated 2019-09-26 19:00:51 +0000

We have two Ethernet boards, one board perfectly accomplishes an FTP file transfer, the second does not and it eventually times out early on, mishandling the SYN SYN:ACK phase. We analyzed the two Wireshark captures and noticed that the good capture has the iRTT time stamp field included while the bad one does not. What is the significance of not seeing that iRTT in the bad capture? Is that indicative to why it fails the xfer? Would really appreciate a reply.. Thanks

I would like to attach the screen shot of the two captures but don't see Attach option here..

Comments

Put the captures on a public file share site and post the link in the question. That's how you can solve that.

Jaap ( 2019-09-26 18:59:44 +0000 )edit

add a comment

answered 2019-09-26 20:36:15 +0000

SYN-bit

18344 ●9 ●301 ●255 https://SYN-b.it

mishandling the SYN SYN:ACK phase.

If by "mishandling" you mean that there is no full 3-way handshake, then it is logical that there is no iRTT being shown, as Wireshark calculates the iRTT based on the timings in the 3-way handshake. If this is the case, the problem is in the faulty 3-way handshake and the missing iRTT is just a symptom.

edit flag offensive delete link

Comments

Hi, So it requires the SYN --> SYN:ACK --> ACK events to occur. We had assumed only the SYN --> SYN:ACK is required for the iRTT. Thanks for your reply and clarifying Don

Don ( 2019-09-26 22:09:34 +0000 )edit

Yes, Wireshark does need the final ack for the calculation, because it does not know if the capture was made near the client, near the server or somewhere in between. So the best approximation of the iRTT is the time difference between the SYN packet and the final ACK packet (regardless of where on the path the capture was made).

If this answered your question, could you click on the checkmark so it is marked as "answered"?

SYN-bit ( 2019-09-27 07:43:52 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

iRTT Field Missing in Capture

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

iRTT Field Missing in Capture edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

iRTT Field Missing in Capture