Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

TCP flow out of sync

In attached screenshot of a TCP flow capture, the acknowledgment and sequence numbers are out of sync. IP address starting with 83 is the external address of the web client. Ip address starting with 194 is the external address of the web server.

I.m.o the server is sending a sequence 4381 in packet 27 that is incorrectly numbered. As the previous -captured- packet from server to client has SEQ 1 with a Length of 0. A previous packet (or multiple, counting up to SEQ 4380) with SEQ 1 and length 4380 is missing from server to client. Wireshark notices this descripancy and says a previous segment is obviously missing. Do you agree with this analysis ?

2018_10_11_pppoe1_interface_pcap_Copy