This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have a scenario, I'm analyzing ssl (decrpyt) traffic to my webserver. I'm investigating server and end-to-end delay issues. In between this I'm stuck at following traffic pattern for which I need some advice/suggestion. The patter shows:-

 client       server
src port 1 -> 80 (syn)
src port 2 -> 80 (syn)
src port 3 -> 80 (syn)
src port 4 -> 80 (syn)
.....

 server        client
src port 80 -> 1  (syn/ack)
src port 80 -> 2  (syn/ack)

client         server
src port 1 -> 80  (ack)
src port 2 -> 80  (ack)

After, complete of handshake I see "http get request" from client. My issues is:-

  1. why are multiple syns send from client to server from different source port
  2. why server choose to reply on NOT all ports mainly the syn/ack is received by first 3 ports.
  3. Multiple acks to different ports?

a sample SYN request just for analysis looks like

"694 47.583499000 192.168.1.56 192.168.1.22 TCP 66 0.000173000 50844→80 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=4 SACK_PERM=1"

Please help me understand this behavior.

asked 04 Aug '15, 08:03

lazerz's gravatar image

lazerz
4181014
accept rate: 0%


  1. That depends on the implementation of your client.
  2. The server may have only so many processes/threads/workers available to handle connections.
  3. Each SYN from an IP:port is a new (TCP) connection, therefore requires it's own ACK.
permanent link

answered 04 Aug '15, 08:33

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

This being said,I'm experiencing same behavior from different machines, as for load on server in that case why i'm not seeing timeout or retransmissions etc?

(04 Aug '15, 08:48) lazerz
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×319
×100
×55

question asked: 04 Aug '15, 08:03

question was seen: 1,967 times

last updated: 04 Aug '15, 08:48

p​o​w​e​r​e​d by O​S​Q​A