This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Why I am seeing multiple syn packets when I open a web page?

0

Hi Trying to find an explanation for a slow network response, I installed the wireshark sniffer. When I opened a web page I see that multiple syn packets are being sent to the web server, in less tan 0.005 seconds. Any idea why this happens ? alt text

asked 29 Oct '14, 17:20

Alzav's gravatar image

Alzav
11112
accept rate: 0%


One Answer:

2

This is because your browser wants to have multiple parallel sessions to the server to speed up communication. In your case 6 sessions are started right away - I think this is the default for Chrome In Mozilla you can control this in about:config

Regards Matthias


From http://tools.ietf.org/html/draft-ietf-tcpm-initcwnd-00

   In the mean time, applications have responded to TCP's "slow" start.
   Web sites use multiple sub-domains [Bel10] to circumvent HTTP 1.1
   regulation on two connections per physical host [RFC2616]. As of
   today, major web browsers open multiple connections to the same site
   (up to six connections per domain [Ste08] and the number is growing).
   This trend is to remedy HTTP serialized download to achieve
   parallelism and higher performance.

answered 29 Oct '14, 23:10

mrEEde's gravatar image

mrEEde
3.9k152270
accept rate: 20%

edited 30 Oct '14, 00:03

Thanks a lot

(30 Oct '14, 08:04) Alzav