Ask Your Question

Revision history [back]

v4.0.0 TCP ACKed unseen segment

Hi experts,

For the TCP Analysis , Version 4.0.0 vs 3.6.8 , why is there such a difference?

4.0.0 : [TCP ACKed unseen segment] count 7

3.6.8 :[TCP ACKed unseen segment] count 3

Version 4.0.0 (v4.0.0-0-g0cbe09cd796b)

No. Time Source Destination Protocol Stream Seq NextSeq Ack Length Info

1 19:59:17.739060000 10.0.0.1 172.16.0.1 TCP 0 0 1 0 66 50000 → 445 [SYN] Seq=0 Win=8192 Len=0 MSS=1418 WS=256 SACK_PERM

2 19:59:17.744753000 172.16.0.1 10.0.0.1 TCP 0 0 1 1 66 445 → 50000 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM

3 19:59:17.744869000 10.0.0.1 172.16.0.1 TCP 0 1 1 1 60 50000 → 445 [ACK] Seq=1 Ack=1 Win=66560 Len=0

4 20:00:14.600295000 10.0.0.1 172.16.0.1 TCP 0 20037 20289 23628 306 [ ] [TCP Previous segment not captured] 50000 → 445 [PSH, ACK] Seq=20037 Ack=23628 Win=66048 Len=252

5 20:00:14.606207000 172.16.0.1 10.0.0.1 TCP 0 23628 23816 20289 242 [TCP ACKed unseen segment] [TCP Previous segment not captured] 445 → 50000 [PSH, ACK] Seq=23628 Ack=20289 Win=131840 Len=188

6 20:00:14.606690000 10.0.0.1 172.16.0.1 TCP 0 20289 20510 23816 275 [TCP ACKed unseen segment] 50000 → 445 [PSH, ACK] Seq=20289 Ack=23816 Win=65792 Len=221

7 20:00:14.612473000 172.16.0.1 10.0.0.1 TCP 0 23816 24020 20510 258 [TCP ACKed unseen segment] 445 → 50000 [PSH, ACK] Seq=23816 Ack=20510 Win=131584 Len=204

8 20:00:14.612488000 10.0.0.1 172.16.0.1 TCP 0 20510 20618 24020 162 [TCP ACKed unseen segment] 50000 → 445 [PSH, ACK] Seq=20510 Ack=24020 Win=65536 Len=108

9 20:00:14.618430000 172.16.0.1 10.0.0.1 TCP 0 24020 24128 20618 162 [TCP ACKed unseen segment] 445 → 50000 [PSH, ACK] Seq=24020 Ack=20618 Win=131328 Len=108

10 20:00:14.618733000 10.0.0.1 172.16.0.1 TCP 0 20618 20710 24128 146 [TCP ACKed unseen segment] 50000 → 445 [PSH, ACK] Seq=20618 Ack=24128 Win=65536 Len=92

Version 3.6.8 (v3.6.8-0-gd25900c51508)

No. Time Source Destination Protocol Stream Seq NextSeq Ack Length Info

1 19:59:17.739060 10.0.0.1 172.16.0.1 TCP 0 0 1 0 66 50000 → 445 [SYN] Seq=0 Win=8192 Len=0 MSS=1418 WS=256 SACK_PERM=1

2 19:59:17.744753 172.16.0.1 10.0.0.1 TCP 0 0 1 1 66 445 → 50000 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1

3 19:59:17.744869 10.0.0.1 172.16.0.1 TCP 0 1 1 1 60 50000 → 445 [ACK] Seq=1 Ack=1 Win=66560 Len=0

4 20:00:14.600295 10.0.0.1 172.16.0.1 TCP 0 20037 20289 23628 306 [TCP ACKed unseen segment] [TCP Previous segment not captured] 50000 → 445 [PSH, ACK] Seq=20037 Ack=23628 Win=66048 Len=252

5 20:00:14.606207 172.16.0.1 10.0.0.1 TCP 0 23628 23816 20289 242 [TCP ACKed unseen segment] [TCP Previous segment not captured] 445 → 50000 [PSH, ACK] Seq=23628 Ack=20289 Win=131840 Len=188

6 20:00:14.606690 10.0.0.1 172.16.0.1 TCP 0 20289 20510 23816 275 [TCP ACKed unseen segment] 50000 → 445 [PSH, ACK] Seq=20289 Ack=23816 Win=65792 Len=221

7 20:00:14.612473 172.16.0.1 10.0.0.1 TCP 0 23816 24020 20510 258 445 → 50000 [PSH, ACK] Seq=23816 Ack=20510 Win=131584 Len=204

8 20:00:14.612488 10.0.0.1 172.16.0.1 TCP 0 20510 20618 24020 162 50000 → 445 [PSH, ACK] Seq=20510 Ack=24020 Win=65536 Len=108

9 20:00:14.618430 172.16.0.1 10.0.0.1 TCP 0 24020 24128 20618 162 445 → 50000 [PSH, ACK] Seq=24020 Ack=20618 Win=131328 Len=108

10 20:00:14.618733 10.0.0.1 172.16.0.1 TCP 0 20618 20710 24128 146 50000 → 445 [PSH, ACK] Seq=20618 Ack=24128 Win=65536 Len=92

Regards, 7ACE

v4.0.0 TCP ACKed unseen segment

Hi experts,

For the TCP Analysis , Version 4.0.0 vs 3.6.8 , why is there such a difference?

4.0.0 : [TCP ACKed unseen segment] count 7

3.6.8 :[TCP ACKed unseen segment] count 3

Version 4.0.0 (v4.0.0-0-g0cbe09cd796b)

No. Time Source Destination Protocol Stream Seq NextSeq Ack Length Info

1 19:59:17.739060000 10.0.0.1 172.16.0.1 TCP 0 0 1 0 66 50000 → 445 [SYN] Seq=0 Win=8192 Len=0 MSS=1418 WS=256 SACK_PERM

2 19:59:17.744753000 172.16.0.1 10.0.0.1 TCP 0 0 1 1 66 445 → 50000 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM

3 19:59:17.744869000 10.0.0.1 172.16.0.1 TCP 0 1 1 1 60 50000 → 445 [ACK] Seq=1 Ack=1 Win=66560 Len=0

4 20:00:14.600295000 10.0.0.1 172.16.0.1 TCP 0 20037 20289 23628 306 [ ] [TCP Previous segment not captured] 50000 → 445 [PSH, ACK] Seq=20037 Ack=23628 Win=66048 Len=252

5 20:00:14.606207000 172.16.0.1 10.0.0.1 TCP 0 23628 23816 20289 242 [TCP ACKed unseen segment] [TCP Previous segment not captured] 445 → 50000 [PSH, ACK] Seq=23628 Ack=20289 Win=131840 Len=188

6 20:00:14.606690000 10.0.0.1 172.16.0.1 TCP 0 20289 20510 23816 275 [TCP ACKed unseen segment] 50000 → 445 [PSH, ACK] Seq=20289 Ack=23816 Win=65792 Len=221

7 20:00:14.612473000 172.16.0.1 10.0.0.1 TCP 0 23816 24020 20510 258 [TCP ACKed unseen segment] 445 → 50000 [PSH, ACK] Seq=23816 Ack=20510 Win=131584 Len=204

8 20:00:14.612488000 10.0.0.1 172.16.0.1 TCP 0 20510 20618 24020 162 [TCP ACKed unseen segment] 50000 → 445 [PSH, ACK] Seq=20510 Ack=24020 Win=65536 Len=108

9 20:00:14.618430000 172.16.0.1 10.0.0.1 TCP 0 24020 24128 20618 162 [TCP ACKed unseen segment] 445 → 50000 [PSH, ACK] Seq=24020 Ack=20618 Win=131328 Len=108

10 20:00:14.618733000 10.0.0.1 172.16.0.1 TCP 0 20618 20710 24128 146 [TCP ACKed unseen segment] 50000 → 445 [PSH, ACK] Seq=20618 Ack=24128 Win=65536 Len=92

Version 3.6.8 (v3.6.8-0-gd25900c51508)

No. Time Source Destination Protocol Stream Seq NextSeq Ack Length Info

1 19:59:17.739060 10.0.0.1 172.16.0.1 TCP 0 0 1 0 66 50000 → 445 [SYN] Seq=0 Win=8192 Len=0 MSS=1418 WS=256 SACK_PERM=1

2 19:59:17.744753 172.16.0.1 10.0.0.1 TCP 0 0 1 1 66 445 → 50000 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1

3 19:59:17.744869 10.0.0.1 172.16.0.1 TCP 0 1 1 1 60 50000 → 445 [ACK] Seq=1 Ack=1 Win=66560 Len=0

4 20:00:14.600295 10.0.0.1 172.16.0.1 TCP 0 20037 20289 23628 306 [TCP ACKed unseen segment] [TCP Previous segment not captured] 50000 → 445 [PSH, ACK] Seq=20037 Ack=23628 Win=66048 Len=252

5 20:00:14.606207 172.16.0.1 10.0.0.1 TCP 0 23628 23816 20289 242 [TCP ACKed unseen segment] [TCP Previous segment not captured] 445 → 50000 [PSH, ACK] Seq=23628 Ack=20289 Win=131840 Len=188

6 20:00:14.606690 10.0.0.1 172.16.0.1 TCP 0 20289 20510 23816 275 [TCP ACKed unseen segment] 50000 → 445 [PSH, ACK] Seq=20289 Ack=23816 Win=65792 Len=221

7 20:00:14.612473 172.16.0.1 10.0.0.1 TCP 0 23816 24020 20510 258 445 → 50000 [PSH, ACK] Seq=23816 Ack=20510 Win=131584 Len=204

8 20:00:14.612488 10.0.0.1 172.16.0.1 TCP 0 20510 20618 24020 162 50000 → 445 [PSH, ACK] Seq=20510 Ack=24020 Win=65536 Len=108

9 20:00:14.618430 172.16.0.1 10.0.0.1 TCP 0 24020 24128 20618 162 445 → 50000 [PSH, ACK] Seq=24020 Ack=20618 Win=131328 Len=108

10 20:00:14.618733 10.0.0.1 172.16.0.1 TCP 0 20618 20710 24128 146 50000 → 445 [PSH, ACK] Seq=20618 Ack=24128 Win=65536 Len=92

Regards, 7ACE

v4.0.0 TCP ACKed unseen segment

Hi experts,

For the TCP Analysis , Version 4.0.0 vs 3.6.8 , why is there such a difference?

4.0.0 : [TCP ACKed unseen segment]  count 7

7 3.6.8 :[TCP ACKed unseen segment] count 3

3

Version 4.0.0 (v4.0.0-0-g0cbe09cd796b)

No. Time    Source  Destination Protocol    Stream  Seq NextSeq Ack Length  Info

Info 1 19:59:17.739060000 10.0.0.1 172.16.0.1 TCP 0 0 1 0 66 50000 → 445 [SYN] Seq=0 Win=8192 Len=0 MSS=1418 WS=256 SACK_PERM

SACK_PERM 2 19:59:17.744753000 172.16.0.1 10.0.0.1 TCP 0 0 1 1 66 445 → 50000 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM

SACK_PERM 3 19:59:17.744869000 10.0.0.1 172.16.0.1 TCP 0 1 1 1 60 50000 → 445 [ACK] Seq=1 Ack=1 Win=66560 Len=0

Len=0 4 20:00:14.600295000 10.0.0.1 172.16.0.1 TCP 0 20037 20289 23628 306 [ ] [TCP Previous segment not captured] 50000 → 445 [PSH, ACK] Seq=20037 Ack=23628 Win=66048 Len=252

5 20:00:14.606207000 172.16.0.1 10.0.0.1 TCP 0 23628 23816 20289 242 [TCP ACKed unseen segment] [TCP Previous segment not captured] 50000 → 445 [PSH, ACK] Seq=20037 Ack=23628 Win=66048 Len=252 5 20:00:14.606207000 172.16.0.1 10.0.0.1 TCP 0 23628 23816 20289 242 [TCP ACKed unseen segment] [TCP Previous segment not captured] 445 → 50000 [PSH, ACK] Seq=23628 Ack=20289 Win=131840 Len=188

Len=188 6 20:00:14.606690000 10.0.0.1 172.16.0.1 TCP 0 20289 20510 23816 275 [TCP ACKed unseen segment] [TCP ACKed unseen segment] 50000 → 445 [PSH, ACK] Seq=20289 Ack=23816 Win=65792 Len=221

Len=221 7 20:00:14.612473000 172.16.0.1 10.0.0.1 TCP 0 23816 24020 20510 258 [TCP ACKed unseen segment] [TCP ACKed unseen segment] 445 → 50000 [PSH, ACK] Seq=23816 Ack=20510 Win=131584 Len=204

Len=204 8 20:00:14.612488000 10.0.0.1 172.16.0.1 TCP 0 20510 20618 24020 162 [TCP ACKed unseen segment] [TCP ACKed unseen segment] 50000 → 445 [PSH, ACK] Seq=20510 Ack=24020 Win=65536 Len=108

Len=108 9 20:00:14.618430000 172.16.0.1 10.0.0.1 TCP 0 24020 24128 20618 162 [TCP ACKed unseen segment] [TCP ACKed unseen segment] 445 → 50000 [PSH, ACK] Seq=24020 Ack=20618 Win=131328 Len=108

Len=108 10 20:00:14.618733000 10.0.0.1 172.16.0.1 TCP 0 20618 20710 24128 146 [TCP ACKed unseen segment] [TCP ACKed unseen segment] 50000 → 445 [PSH, ACK] Seq=20618 Ack=24128 Win=65536 Len=92

Len=92

Version 3.6.8 (v3.6.8-0-gd25900c51508)

No. Time    Source  Destination Protocol    Stream  Seq NextSeq Ack Length  Info

Info 1 19:59:17.739060 10.0.0.1 172.16.0.1 TCP 0 0 1 0 66 50000 → 445 [SYN] Seq=0 Win=8192 Len=0 MSS=1418 WS=256 SACK_PERM=1

SACK_PERM=1 2 19:59:17.744753 172.16.0.1 10.0.0.1 TCP 0 0 1 1 66 445 → 50000 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1

SACK_PERM=1 3 19:59:17.744869 10.0.0.1 172.16.0.1 TCP 0 1 1 1 60 50000 → 445 [ACK] Seq=1 Ack=1 Win=66560 Len=0

Len=0 4 20:00:14.600295 10.0.0.1 172.16.0.1 TCP 0 20037 20289 23628 306 [TCP ACKed unseen segment] [TCP ACKed unseen segment] [TCP Previous segment not captured] 50000 → 445 [PSH, ACK] Seq=20037 Ack=23628 Win=66048 Len=252

Len=252 5 20:00:14.606207 172.16.0.1 10.0.0.1 TCP 0 23628 23816 20289 242 [TCP ACKed unseen segment] [TCP ACKed unseen segment] [TCP Previous segment not captured] 445 → 50000 [PSH, ACK] Seq=23628 Ack=20289 Win=131840 Len=188

Len=188 6 20:00:14.606690 10.0.0.1 172.16.0.1 TCP 0 20289 20510 23816 275 [TCP ACKed unseen segment] [TCP ACKed unseen segment] 50000 → 445 [PSH, ACK] Seq=20289 Ack=23816 Win=65792 Len=221

Len=221 7 20:00:14.612473 172.16.0.1 10.0.0.1 TCP 0 23816 24020 20510 258 445 → 50000 [PSH, ACK] Seq=23816 Ack=20510 Win=131584 Len=204

Len=204 8 20:00:14.612488 10.0.0.1 172.16.0.1 TCP 0 20510 20618 24020 162 50000 → 445 [PSH, ACK] Seq=20510 Ack=24020 Win=65536 Len=108

Len=108 9 20:00:14.618430 172.16.0.1 10.0.0.1 TCP 0 24020 24128 20618 162 445 → 50000 [PSH, ACK] Seq=24020 Ack=20618 Win=131328 Len=108

Len=108 10 20:00:14.618733 10.0.0.1 172.16.0.1 TCP 0 20618 20710 24128 146 50000 → 445 [PSH, ACK] Seq=20618 Ack=24128 Win=65536 Len=92

Len=92

Regards, 7ACE