why does Wireshark flag the retransmission of a single byte fragment as a keep-alive? A true keep-[alive is an ACK with no data, tcp.len==0.

asked 2018-11-13 17:58:09 +0000

SJZK
1 ●1 ●1 ●1

updated 2018-11-14 10:56:53 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●976 ●227 https://www.wireshark.org

e.g.:

time T  [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=1051295  ACK=101003 Win=263520 Len=1
time T+1.5000  [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=10512965  ACK=100003 Win=263520 Len=1
time T+3.000  [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=1051295  ACK=101003 Win=263520 Len=1
time T+6.000  [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=1051295  ACK=101003 Win=263520 Len=1
time T+12.000  [TCP Keep-Alive] srcport -> dstport [PSH,ACK] Seq=1051295  ACK=101003 Win=263520 Len=1

answered 2018-11-13 19:39:04 +0000

Jaap

13742 ●711 ●115

It may contain a garbage octet, see RFC1122:

"An implementation SHOULD send a keep-alive segment with no data; however, it MAY be configurable to send a keep-alive segment containing one garbage octet, for compatibility with erroneous TCP implementations."

edit flag offensive delete link

Comments

Unfortunately, the 1 byte in the "keep-alive"s is the actual 1 byte fragment, and the keep-alives are really retransmissions. The one byte fragment isn't ACK'd by the receiver until 22 seconds later. Since the word MAY is invoked, it would be more accurate to flag them as a retransmission, possible keep-alive instead of keep-alive, possible retransmission.

SJZK ( 2018-11-13 20:56:31 +0000 )edit

The sequence numbers should make the distinction possible, I assume, but I would have to look at a complete trace more carefully.

Jaap ( 2018-11-14 06:57:51 +0000 )edit

Can you provide us the whole trace? https://blog.packet-foo.com/2016/11/t...

Christian_R ( 2018-11-14 11:53:48 +0000 )edit

can't provide the actual trace, but here is a summary of the packets of interest:

Time Delta-Time Info Len Segment Seq# NextSeq# ACK#
17:24:42.819 0 Request, Data 1458 1400 3561752 3563152 335954 17:24:42.819 0 [PSH, ACK] 60 1 3563152 3563153 335954 17:24:44.251 1.43 [TCP Keep-Alive] 60 1 3563152 3563153 335954 17:24:47.253 3.00 [TCP Keep-Alive] 60 1 3563152 3563153 335954 17:24:53.253 6.00 [TCP Keep-Alive] 60 1 3563152 3563153 335954 17:25:05.261 12.00 [TCP Keep-Alive] 60 1 3563152 3563153 335954

SJZK ( 2018-11-14 15:17:03 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

why does Wireshark flag the retransmission of a single byte fragment as a keep-alive? A true keep-[alive is an ACK with no data, tcp.len==0.

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

why does Wireshark flag the retransmission of a single byte fragment as a keep-alive? A true keep-[alive is an ACK with no data, tcp.len==0. edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

why does Wireshark flag the retransmission of a single byte fragment as a keep-alive? A true keep-[alive is an ACK with no data, tcp.len==0.