This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

TCP - debugging 3 way handshake

0

I am relatively new to TCP. I am writing a small stack for our embedded system to eventually send an email. I have actually gotten it to connect to our email server and login. However, I'm getting retransmissions, and I don't know why. I'm hoping some of you experts can enlighten me as to why.

https://www.cloudshark.org/captures/1e8542d7b55c

Looking at this mostly 3 way handshake capture, the server sends a PSH ACK 220 packet (708), in which I ACK (709). Then, the retransmissions start. It looks like my sequence numbers are correct, so I'm not sure why the server didn't accept it.

General Questions on the capture:

  1. I thought, thru my reading, that after my 3 way handshake ACK (packet 688), communication stops (but the connection stays open) until I send data to the server. But the server always responds to my ACK with the 220 packet, so maybe not. I haven't logged in, so maybe that's just a general connection message. Is the ACK always followed by the 220 packet?

  2. Why the retransmissions?

  3. The retransmissions seem to drop a byte as the 220 becomes 20 on all 4 retransmission packets. Why? This seems to always happen on the retransmissions.

Thanks in advance.

Sutton

asked 28 Feb '17, 11:03

dodge55's gravatar image

dodge55
21●4●4●9
accept rate: 0%

One Answer:

1

1st) You've uploaded a filtered capture, so your packet numbers are useless.

2nd) Your ACK has a (relative) number of 2, which means only the first byte of the received 181 bytes are acknowledged, hence the retransmissions.

answered 28 Feb '17, 11:37

Jaap's gravatar image

Jaap ♦
11.7k●16●101
accept rate: 14%

When the client is taking over 800ms to ACK the SYN/ACK from the Server, I wouldn't expect too much "good" to follow.

(28 Feb '17, 21:51) Rooster_50

Thanks for the tip. I found my problem in the sequence numbers. So, for now, things are working much better.

Sorry for the packet numbers. I didn't realize that exporting selective packets made the numbering scheme different.

I still haven't found out why my ACK to the SYN/ACK is taking so long. It seems to be fast some times and very slow others.

(01 Mar '17, 04:43) dodge55

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(01 Mar '17, 05:40) Jaap ♦