SteveZhou's profile - activity

tcp reset with and without ack flag set Hi, Is there any difference between a RST packet with and without ACK bit set?

nice article, have added to my reading list. thank you !

Hi,

I now that TCP MSS (max segment size) value is telling the peer "I can receive xxx bytes of data". I am wondering if both side will agree upon a min value or each side can use their own claimed size. For example, if A says I can receive 1460 Bytes while B said I can do 1200 Bytes. Will 1200 be picked up as the max MSS size on this tcp session? or A can only send max to 1200 bytes to B, while B can send max of 1460 Bytes of data to A?

Thanks! -Steve

hi, if tshark works, that is good to know.

How to read a specified packet in hex and ASCII? Hi, I know tcpdump has -X option to print packets in hex and ASCII. -r

Is TCP MSS a value both communication peers agreed up？ Hi, I now that TCP MSS (max segment size) value is telling the p

Hi,

I am handling an issue that the smb file transfer over tcp does not fill the 1Gbit pipe between the Windows file server and a macOS 10.14.5 client. They are on different subnet so it can be any intermediate devices that is blocking something.

The weird thing I am seeing is that the sender was stuck at sending 8 * SMSS and no more. According to the Ack, the receiver window is still large enough to accept more incoming data, but the actual send window didn't increase to more than 8 * SMSS followed by each of the RTT (Ack). There is no window full reported either.

I am wondering what can be the possible reason that the sending speed was stuck at 8 * SMSS? I am no saying 8 is low, but it was just not as good as, i don't know, 14 * SMSS?

thanks!

what is the 'MA window' in the tcp throughput graph? Hi, what does the 'MA window' mean in tcp throughput graph? Its v

So it is the client was writing to the server. Several things: The client seems to have the TSO feature enabled on the

So it is the client was writing to the server. Several things: The client seems have the TSO feature enabled on the NI

Hi,

all of sudden, not sure what i did, all the smb or smb2 (tcp port 445) are now all displayed as tcp packets. I tried to Decode tcp 445 but there is no option of smb or smb2.

how do I recover this situation? A reinstallation of Wireshark doesn't get it fixed. I guess remove the Wireshark.app (on macOS 10.14.5) can help me, but I don't want to lose the current config.

thank you!

aha, the 'Default' profile does show me the SMB traffic, so it is a problem of my current profile, any idea which config

sorry that I cannot share the pcap here since it's from the customer.

the actual tcp send window is not increased furhter Hi, I am handling an issue that the smb file transfer over tcp does

disable and reenable smb and smb2 does't not help.

please see the screenshot here.

See the screenshot here.

Hi, I just checked that and they are all enabled. Wireshark Version 3.0.1 (v3.0.1-0-gea351cd8)

smb or smb2 packets are all parsed to tcp Hi, all of sudden, not sure what i did, all the smb or smb2 (tcp port 445) ar

I recently see more than 10% of retransmission from sniffer trace via wireshark. It sounds really a big problem to me since on Ethernet, I vagely recall that the baseline of retransmission rate is about 0.5%? I am not sure what is the baseline for a 802.11 WLAN.

Any ideas?

Hi,

I notiched that the # of displayed packets is not the same as it should be when you try to export them, please see that screenshot below:

Is it a known isssue? I was using "smb || smb2" as the display filter.

i further confirmed that the smaller number contains only smb/smb2 packets, while you try to export, the larger number also contains the pure tcp packets (for smb file streaming) for the corresponding smb session. Is it expected?

displayed packets unmatched when trying to export Hi, I notiched that the # of displayed packets is not the same as it

does Wireshark support Chinese characters in SMB2 protocol Hi, While reviewing a SMB2 trace, the directory named with C

what is the baseline of the 802.11 wireless network retransmission rate? I recently see more than 10% of retransmission