Packet_vlad's profile - activity

So from the sender point of view the window is 150kB What window do you mean? A sender is aware of 2 windows: CWND

So from the sender point of view the window is 150kB What window do you mean? A sender is aware of 2 windows: CWND

The task is quite complex and usually you can't do this. As current congestion window value is never transferred in pac

This is Moving Average Window (similar as here). As I understand it counts in seconds, so MA = 1 means Moving Average wi

This is Moving Average Window (similar as here). As I understand it count in seconds, so MA = 1 means Moving Average wit

This is Moving Average Window (similar as here)

That's because the client emitted some data packets we don't see in the capture. For the rest network diagram is needed.

That's because the client emitted some data packets we don't see in the capture. BTW as I understand Wireshark doesn't

A network diagram would be of a great help here because there is an asymmetric path involved together with FHRP protocol

A network diagram would be of a great help here because there is an asymmetric path involved together with FHRP protocol

You're welcome!

That did't work because there are two IP fields in a packet - source IP and destination IP. If you add 3rd IP with the s

That did't work because there are two IP field in a packet - source IP and destination IP. If you add 3rd IP with the sa

host 1.1.1.1 and host 2.2.2.2 host 1.1.1.1 and host name.com Please also check this reference for other details.

It's hard to tell without seeing an actual PCAP, but usually getting stuck on constant (not slowly increasing) Bytes In

It's hard to tell without seeing an actual PCAP, but usually getting stuck on constant (not slowly increasing) Bytes In

Can't see the screenshot..

If packet's Sequence Number and Next Sequence Number are equal that means the packet contains no data (TCP segment lengt

If packet's Sequence Number and Next Sequence Number are equal that means the packet contains no data (TCP segment lengt

Also you may read TCP/IP Illustrated vol.1 by Stevens, this book is must have for protocol understanding. TCP part of it

Try to use host stealmylogin.com as capture filter. It'll resolve the name and filter by corresponding IP. BUT the sit

Try to use host stealmylogin.com as capture filter. It'll resolve the name and filter by corresponding IP. BUT the sit

Try to use host stealmylogin.com as capture filter. It'll resolve the name and filter by corresponding IP. BUT the sit

Try ether host 34-E6-D7-55-24-23 || 34-E6-D7-55-24-34

Try ether host 34-E6-D7-55-24-23 || 34-E6-D7-55-24-34

Sake, no, I don't. I just captured Chrome traffic from home to random website, client side, on a notebook itself (PCAP

Sake, no, I don't. I just captured Chrome traffic from home to random website, client side, on a notebook itself (PCAP

Sake, no, I don't. I just captured Chrome traffic from home to random website, client side, on a notebook itself (PCAP

Sake, no, I don't. I just captured Chrome traffic from home to random website, client side, on a notebook itself (PCAP

Sake, no, I don't. I just captured Chrome traffic from home to random website, client side, on a notebook itself (PCAP

My guess is: we observe "simultaneous close" case which means both client and server decided to close a connection at th

My guess is: we observe "simultaneous close" case which means both client and server decided to close a connection at th

My guess is: we observe "simultaneous close" case which means both client and server decided to close a connection at th

My guess is: we observe "simultaneous close" case which means both client and server decided to close a connection at th

My guess is: we observe "simultaneous close" case which means both client and server decided to close a connection at th

My guess is: we observe "simultaneous close" case which means both client and server decided to close a connection at th

Sake: this is very good assumption. Check also Win size in RSTs - it is different (0 and 14336). I cannot understand on

Sake: this is very good assumption. Check also Win size in RSTs - it is different (0 and 14336). I cannot understand on

Sake: this is very good assumption. Check also Win size in RSTs - it is different (0 and 14336). I cannot understand on

Sake: this is very good assumption. Check also Win size in RSTs - it is different (0 and 14336). I cannot understand on