This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi,

Wireshark is outputing a black background with pink(?) letters with this:

[TCP Dup ACK] http -> autonoc [ACK] seq=597 ack=672 win=67000

And just bellow, follow a red background with yellow letters with this:

autonoc -> http [RST] seq=672 win=0 len=0

What could be this?

asked 05 May '13, 14:14

skd's gravatar image

skd
6113
accept rate: 0%


As Jasper there is nothing particularly unusual or sinister here. There are a couple of things that probably threw you though:-

  1. Wireshark tries to convert TCP and UDP ports to the names that were registered for these numbers with the IANA registry. So TCP port 80 became http and TCP port 1140 became autonoc.
  2. While http is useful in this case (helping us know the server was probably a web server), autonoc is probably not. When a client establishes a connection to a server it usually chooses a "random" port with a high number (above 1024), called an ephemeral port, for the connection. In this case your client chose 1140. So converting it to autonoc really is incorrect, as it would only make sense if this TCP port was on the server side.
  3. The "Dup ACK" is probably just the server wanting to see some more action from the client. The followup action from the client though is the RST (reset), which means it is done with that conversation. So all good and normal TCP.
permanent link

answered 05 May '13, 14:33

martyvis's gravatar image

martyvis
8911525
accept rate: 7%

Nothing special, just color markers for a duplicate ACK and a TCP reset packet. Which is all basic TCP stuff, so if you want to know more about that you need to study how TCP works.

permanent link

answered 05 May '13, 14:20

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×27
×1

question asked: 05 May '13, 14:14

question was seen: 2,132 times

last updated: 05 May '13, 14:33

p​o​w​e​r​e​d by O​S​Q​A