Ask Your Question

Crosses on TCPtrace graph meaning

asked 2018-07-18 13:09:34 +0000

Hi all,

could you please tell me what is the meaning of these little crosses on top of TCP segments? I'm using latest v2.6.2rc0-166. Is it some new feature?


image description

edit retag flag offensive close merge delete

1 Answer

Sort by » oldest newest most voted

answered 2018-07-18 15:43:39 +0000

cmaynard gravatar image

updated 2018-07-18 16:30:58 +0000

grahamb gravatar image

Looking at the tcp_stream_dialog.cpp source code, the comment on line 288 and following lines of code indicate that they are representative of a TCP zero window condition. You should be able to verify that.

Note that the use of these crosses to depict a TCP zero window condition seems to differ from the tcptrace's use of these "Little crosses", which are described in the Time Sequence Graph section of the tcptrace manual as follows:

Little crosses (x) These are segments sent with zero TCP data payload (the down and up arrows of the segment coincide, giving rise to a cross).

edit flag offensive delete link more


Hi Christopher, thanks, you're exactly right!

This is a trace from today's post.

I just checked it and verified exact match of crosses to zero window packets. Never seen a sequence of fully loaded zero window packets before.

BR, Vlad.

Packet_vlad gravatar imagePacket_vlad ( 2018-07-18 16:38:51 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-07-18 13:09:34 +0000

Seen: 912 times

Last updated: Jul 18 '18