Wireshark-users: Re: [Wireshark-users] Dup ACK #1
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: vincent paul <amoteluro@xxxxxxxxx>
Date: Tue, 13 Apr 2010 09:52:35 -0700 (PDT)
Hi Martin,
How are you?
Please find attached some traces showing the DUP ACK  # 1(immediately from user's side only).  Could you please educate what is/are potential problem(s):
1) congestion ???  How can we explain these immediate ACKs from TCP protocol implementation/requirements? 
2) Could it be "mirror port problem"? 
But we captured traffic using wireshark on customers' workstations, already connected to their network.  This meant they did not prepare a port span connection for us to run test and capture with wireshark.
 
I greatly appreciate your help and expertise.
 
Regards,
PV
--- On Wed, 3/31/10, Martin Visser <martinvisser99@xxxxxxxxx> wrote:

From: Martin Visser <martinvisser99@xxxxxxxxx>
Subject: Re: [Wireshark-users] Dup ACK #1
To: "Community support list for Wireshark" <wireshark-users@xxxxxxxxxxxxx>
Date: Wednesday, March 31, 2010, 6:40 PM

Vincent,

You indicated that you are trying to "understand any problem when a customer using our application across Internet.". You need to describe more clearly what the problem you are seeing is for us to be able to help. Is it unreliable (not connecting/disconnecting) or slower throughput than expected, or some other error reported by the application or user.

From what you have described it seems like you probably have normal congestion going on, and TCP is using one of the various mechanisms it has to recover from it. Without seeing a packet capture (probably you should be this at client and server end if possible) as well as an understanding of the network topology (is it LAN/WAN or Internet?) it is pretty hard to diagnose.

Regards, Martin

MartinVisser99@xxxxxxxxx


On Wed, Mar 31, 2010 at 11:15 PM, vincent paul <amoteluro@xxxxxxxxx> wrote:
Hi Martin,
 
I google around I found one people had the same problem(similar to mine at server side) with wireshark capture, but there was no resolution.  Please take a look and give some thought.
 
 
regards,
PV


--- On Wed, 3/31/10, Martin Visser <martinvisser99@xxxxxxxxx> wrote:

From: Martin Visser <martinvisser99@xxxxxxxxx>
Subject: Re: [Wireshark-users] Dup ACK #1
To: "Community support list for Wireshark" <wireshark-users@xxxxxxxxxxxxx>
Date: Wednesday, March 31, 2010, 1:37 AM

Duplicate ACKs are pretty common when you have congested network. If the client is expecting more data and doesn't receive it in time 9maybe 250ms) then it will send another ACK in the hope that the data it is missing/waiting on will be resent.

You haven't indicated what problem you are chasing. If you send a small sample capture that would be useful.

Regards, Martin

MartinVisser99@xxxxxxxxx


On Wed, Mar 31, 2010 at 3:58 PM, vincent paul <amoteluro@xxxxxxxxx> wrote:
Hi All ,
 
I looked at two traces captured at user's side: one going thru proxy and one bypassing proxy and observed a lot of Dup ACK #1.  Both traces are  traffic of HTTP download's file from server.  I have the following observations and could not find any explanation
 
1)Traffic going thru proxy:  User always sent double ACKs (one ACK(len=0) and  its Dup ACK #1(len=0) immediately). No Dup ACK problem from server side
 
2)Traffic bypassing proxy: server, most of the time, sent out double ACK (ACK(len>0) and its Dup ACK #1 (len=0)) with a time period.  This means:
 
Server---> user: seq=1000 Ack=210 len= 1460
Server----> user (dup Ack #1) seq=2460, Ack =210 len=0
.
.
.
Normal TCP data transfer from server for a while(kind of frequency) , then Server sends out double Acks again.
But there were also some time intervals, the data transfer from server looked normal without any double Acks from server
 
In this case, no Dup Ack problem from user's side.
 
I appreciate your help very much.
 
regards,
PV
 
 


___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe


-----Inline Attachment Follows-----


___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe


___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe


-----Inline Attachment Follows-----

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe

No.     Time        Delta       Source                Destination           Protocol Info
   2945 24.607350   0.002831    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2945 (1490 bytes on wire, 1490 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2103056, Ack: 1, Len: 1436
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2103056    (relative sequence number)
    [Next sequence number: 2104492    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x18 (PSH, ACK)
    Window size: 32016
    Checksum: 0xe838 [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2943]
        [The RTT to ACK the segment was: 0.002864000 seconds]
        [Number of bytes in flight: 1436]
    [Timestamps]
    [Reassembled PDU in frame: 2958]
    TCP segment data (1436 bytes)

No.     Time        Delta       Source                Destination           Protocol Info
   2946 24.649726   0.042376    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2946 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2104492, Ack: 1, Len: 1460
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2104492    (relative sequence number)
    [Next sequence number: 2105952    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 32016
    Checksum: 0x69e9 [validation disabled]
    [SEQ/ACK analysis]
        [Number of bytes in flight: 2896]
    [Timestamps]
    [Reassembled PDU in frame: 2958]
    TCP segment data (1460 bytes)

No.     Time        Delta       Source                Destination           Protocol Info
   2947 24.649771   0.000045    172.17.42.106         www.nowhere.com   TCP      1889 > https [ACK] Seq=1 Ack=2105952 Win=65535 Len=0

Frame 2947 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2105952, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2105952    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0x0801 [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2946]
        [The RTT to ACK the segment was: 0.000045000 seconds]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2948 24.649801   0.000030    172.17.42.106         www.nowhere.com   TCP      [TCP Dup ACK 2947#1] 1889 > https [ACK] Seq=1 Ack=2105952 Win=65535 Len=0

Frame 2948 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2105952, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2105952    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0x0801 [validation disabled]
    [SEQ/ACK analysis]
        [TCP Analysis Flags]
            [This is a TCP duplicate ack]
        [Duplicate ACK #: 1]
        [Duplicate to the ACK in frame: 2947]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2949 24.652691   0.002890    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2949 (1490 bytes on wire, 1490 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2105952, Ack: 1, Len: 1436
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2105952    (relative sequence number)
    [Next sequence number: 2107388    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x18 (PSH, ACK)
    Window size: 32016
    Checksum: 0x1ef7 [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2947]
        [The RTT to ACK the segment was: 0.002920000 seconds]
        [Number of bytes in flight: 1436]
    [Timestamps]
    [Reassembled PDU in frame: 2958]
    TCP segment data (1436 bytes)

No.     Time        Delta       Source                Destination           Protocol Info
   2950 24.677917   0.025226    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2950 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2107388, Ack: 1, Len: 1460
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2107388    (relative sequence number)
    [Next sequence number: 2108848    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 32016
    Checksum: 0x2261 [validation disabled]
    [SEQ/ACK analysis]
        [Number of bytes in flight: 2896]
    [Timestamps]
    [Reassembled PDU in frame: 2958]
    TCP segment data (1460 bytes)

No.     Time        Delta       Source                Destination           Protocol Info
   2951 24.677947   0.000030    172.17.42.106         www.nowhere.com   TCP      1889 > https [ACK] Seq=1 Ack=2108848 Win=65535 Len=0

Frame 2951 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2108848, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2108848    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0xfcb0 [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2950]
        [The RTT to ACK the segment was: 0.000030000 seconds]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2952 24.677975   0.000028    172.17.42.106         www.nowhere.com   TCP      [TCP Dup ACK 2951#1] 1889 > https [ACK] Seq=1 Ack=2108848 Win=65535 Len=0

Frame 2952 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2108848, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2108848    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0xfcb0 [validation disabled]
    [SEQ/ACK analysis]
        [TCP Analysis Flags]
            [This is a TCP duplicate ack]
        [Duplicate ACK #: 1]
        [Duplicate to the ACK in frame: 2951]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2953 24.680815   0.002840    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2953 (1490 bytes on wire, 1490 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2108848, Ack: 1, Len: 1436
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2108848    (relative sequence number)
    [Next sequence number: 2110284    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x18 (PSH, ACK)
    Window size: 32016
    Checksum: 0x7446 [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2951]
        [The RTT to ACK the segment was: 0.002868000 seconds]
        [Number of bytes in flight: 1436]
    [Timestamps]
    [Reassembled PDU in frame: 2958]
    TCP segment data (1436 bytes)

No.     Time        Delta       Source                Destination           Protocol Info
   2954 24.716850   0.036035    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2954 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2110284, Ack: 1, Len: 1460
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2110284    (relative sequence number)
    [Next sequence number: 2111744    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 32016
    Checksum: 0x1bb9 [validation disabled]
    [SEQ/ACK analysis]
        [Number of bytes in flight: 2896]
    [Timestamps]
    [Reassembled PDU in frame: 2958]
    TCP segment data (1460 bytes)

No.     Time        Delta       Source                Destination           Protocol Info
   2955 24.716943   0.000093    172.17.42.106         www.nowhere.com   TCP      1889 > https [ACK] Seq=1 Ack=2111744 Win=65535 Len=0

Frame 2955 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2111744, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2111744    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0xf160 [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2954]
        [The RTT to ACK the segment was: 0.000093000 seconds]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2956 24.716978   0.000035    172.17.42.106         www.nowhere.com   TCP      [TCP Dup ACK 2955#1] 1889 > https [ACK] Seq=1 Ack=2111744 Win=65535 Len=0

Frame 2956 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2111744, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2111744    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0xf160 [validation disabled]
    [SEQ/ACK analysis]
        [TCP Analysis Flags]
            [This is a TCP duplicate ack]
        [Duplicate ACK #: 1]
        [Duplicate to the ACK in frame: 2955]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2957 24.719859   0.002881    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2957 (1490 bytes on wire, 1490 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2111744, Ack: 1, Len: 1436
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2111744    (relative sequence number)
    [Next sequence number: 2113180    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x18 (PSH, ACK)
    Window size: 32016
    Checksum: 0x3e70 [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2955]
        [The RTT to ACK the segment was: 0.002916000 seconds]
        [Number of bytes in flight: 1436]
    [Timestamps]
    [Reassembled PDU in frame: 2958]
    TCP segment data (1436 bytes)

No.     Time        Delta       Source                Destination           Protocol Info
   2958 24.752203   0.032344    www.nowhere.com   172.17.42.106         SSLv3    Application Data, 

Frame 2958 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2113180, Ack: 1, Len: 1460
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2113180    (relative sequence number)
    [Next sequence number: 2114640    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 32016
    Checksum: 0xda84 [validation disabled]
    [SEQ/ACK analysis]
        [Number of bytes in flight: 2896]
    [Timestamps]
    TCP segment data (1460 bytes)
    [Reassembled PDU in frame: 2958]
    TCP segment data (504 bytes)
[Reassembled TCP Segments (13557 bytes): #2941(513), #2942(1460), #2945(1436), #2946(1460), #2949(1436), #2950(1460), #2953(1436), #2954(1460), #2957(1436), #2958(1460)]
Secure Socket Layer
    SSLv3 Record Layer: Application Data Protocol: http
        Content Type: Application Data (23)
        Version: SSL 3.0 (0x0300)
        Length: 13048
        Encrypted Application Data: 6D85A1DBFC51291D74E0A96254480EA4BB1DB5FAF5DF4193...

No.     Time        Delta       Source                Destination           Protocol Info
   2959 24.752273   0.000070    172.17.42.106         www.nowhere.com   TCP      1889 > https [ACK] Seq=1 Ack=2114640 Win=65535 Len=0

Frame 2959 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2114640, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2114640    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0xe610 [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2958]
        [The RTT to ACK the segment was: 0.000070000 seconds]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2960 24.752309   0.000036    172.17.42.106         www.nowhere.com   TCP      [TCP Dup ACK 2959#1] 1889 > https [ACK] Seq=1 Ack=2114640 Win=65535 Len=0

Frame 2960 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2114640, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2114640    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0xe610 [validation disabled]
    [SEQ/ACK analysis]
        [TCP Analysis Flags]
            [This is a TCP duplicate ack]
        [Duplicate ACK #: 1]
        [Duplicate to the ACK in frame: 2959]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2961 24.755227   0.002918    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2961 (1490 bytes on wire, 1490 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2114640, Ack: 1, Len: 1436
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2114640    (relative sequence number)
    [Next sequence number: 2116076    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x18 (PSH, ACK)
    Window size: 32016
    Checksum: 0xc94f [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2959]
        [The RTT to ACK the segment was: 0.002954000 seconds]
        [Number of bytes in flight: 1436]
    [Timestamps]
    [Reassembled PDU in frame: 2977]
    TCP segment data (1436 bytes)

No.     Time        Delta       Source                Destination           Protocol Info
   2962 24.774372   0.019145    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2962 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2116076, Ack: 1, Len: 1460
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2116076    (relative sequence number)
    [Next sequence number: 2117536    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 32016
    Checksum: 0x3d54 [validation disabled]
    [SEQ/ACK analysis]
        [Number of bytes in flight: 2896]
    [Timestamps]
    [Reassembled PDU in frame: 2977]
    TCP segment data (1460 bytes)

No.     Time        Delta       Source                Destination           Protocol Info
   2963 24.774433   0.000061    172.17.42.106         www.nowhere.com   TCP      1889 > https [ACK] Seq=1 Ack=2117536 Win=65535 Len=0

Frame 2963 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2117536, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2117536    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0xdac0 [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2962]
        [The RTT to ACK the segment was: 0.000061000 seconds]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2964 24.774465   0.000032    172.17.42.106         www.nowhere.com   TCP      [TCP Dup ACK 2963#1] 1889 > https [ACK] Seq=1 Ack=2117536 Win=65535 Len=0

Frame 2964 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2117536, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2117536    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0xdac0 [validation disabled]
    [SEQ/ACK analysis]
        [TCP Analysis Flags]
            [This is a TCP duplicate ack]
        [Duplicate ACK #: 1]
        [Duplicate to the ACK in frame: 2963]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2965 24.777296   0.002831    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2965 (1490 bytes on wire, 1490 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2117536, Ack: 1, Len: 1436
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2117536    (relative sequence number)
    [Next sequence number: 2118972    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x18 (PSH, ACK)
    Window size: 32016
    Checksum: 0x8d22 [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2963]
        [The RTT to ACK the segment was: 0.002863000 seconds]
        [Number of bytes in flight: 1436]
    [Timestamps]
    [Reassembled PDU in frame: 2977]
    TCP segment data (1436 bytes)

No.     Time        Delta       Source                Destination           Protocol Info
   2966 24.792301   0.015005    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2966 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2118972, Ack: 1, Len: 1460
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2118972    (relative sequence number)
    [Next sequence number: 2120432    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 32016
    Checksum: 0xab93 [validation disabled]
    [SEQ/ACK analysis]
        [Number of bytes in flight: 2896]
    [Timestamps]
    [Reassembled PDU in frame: 2977]
    TCP segment data (1460 bytes)

No.     Time        Delta       Source                Destination           Protocol Info
   2967 24.792362   0.000061    172.17.42.106         www.nowhere.com   TCP      1889 > https [ACK] Seq=1 Ack=2120432 Win=65535 Len=0

Frame 2967 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2120432, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2120432    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0xcf70 [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2966]
        [The RTT to ACK the segment was: 0.000061000 seconds]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2968 24.792396   0.000034    172.17.42.106         www.nowhere.com   TCP      [TCP Dup ACK 2967#1] 1889 > https [ACK] Seq=1 Ack=2120432 Win=65535 Len=0

Frame 2968 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2120432, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2120432    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0xcf70 [validation disabled]
    [SEQ/ACK analysis]
        [TCP Analysis Flags]
            [This is a TCP duplicate ack]
        [Duplicate ACK #: 1]
        [Duplicate to the ACK in frame: 2967]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2969 24.795705   0.003309    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2969 (1490 bytes on wire, 1490 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2120432, Ack: 1, Len: 1436
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2120432    (relative sequence number)
    [Next sequence number: 2121868    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x18 (PSH, ACK)
    Window size: 32016
    Checksum: 0xe3e3 [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2967]
        [The RTT to ACK the segment was: 0.003343000 seconds]
        [Number of bytes in flight: 1436]
    [Timestamps]
    [Reassembled PDU in frame: 2977]
    TCP segment data (1436 bytes)

No.     Time        Delta       Source                Destination           Protocol Info
   2970 24.804205   0.008500    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2970 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2121868, Ack: 1, Len: 1460
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2121868    (relative sequence number)
    [Next sequence number: 2123328    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 32016
    Checksum: 0x9e7d [validation disabled]
    [SEQ/ACK analysis]
        [Number of bytes in flight: 2896]
    [Timestamps]
    [Reassembled PDU in frame: 2977]
    TCP segment data (1460 bytes)

No.     Time        Delta       Source                Destination           Protocol Info
   2971 24.804236   0.000031    172.17.42.106         www.nowhere.com   TCP      1889 > https [ACK] Seq=1 Ack=2123328 Win=65535 Len=0

Frame 2971 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2123328, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2123328    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0xc420 [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2970]
        [The RTT to ACK the segment was: 0.000031000 seconds]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2972 24.804264   0.000028    172.17.42.106         www.nowhere.com   TCP      [TCP Dup ACK 2971#1] 1889 > https [ACK] Seq=1 Ack=2123328 Win=65535 Len=0

Frame 2972 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2123328, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2123328    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0xc420 [validation disabled]
    [SEQ/ACK analysis]
        [TCP Analysis Flags]
            [This is a TCP duplicate ack]
        [Duplicate ACK #: 1]
        [Duplicate to the ACK in frame: 2971]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2973 24.807190   0.002926    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2973 (1490 bytes on wire, 1490 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2123328, Ack: 1, Len: 1436
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2123328    (relative sequence number)
    [Next sequence number: 2124764    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x18 (PSH, ACK)
    Window size: 32016
    Checksum: 0xcf9b [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2971]
        [The RTT to ACK the segment was: 0.002954000 seconds]
        [Number of bytes in flight: 1436]
    [Timestamps]
    [Reassembled PDU in frame: 2977]
    TCP segment data (1436 bytes)

No.     Time        Delta       Source                Destination           Protocol Info
   2974 24.816165   0.008975    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2974 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2124764, Ack: 1, Len: 1460
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2124764    (relative sequence number)
    [Next sequence number: 2126224    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 32016
    Checksum: 0xc4d7 [validation disabled]
    [SEQ/ACK analysis]
        [Number of bytes in flight: 2896]
    [Timestamps]
    [Reassembled PDU in frame: 2977]
    TCP segment data (1460 bytes)

No.     Time        Delta       Source                Destination           Protocol Info
   2975 24.816206   0.000041    172.17.42.106         www.nowhere.com   TCP      1889 > https [ACK] Seq=1 Ack=2126224 Win=65535 Len=0

Frame 2975 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2126224, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2126224    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0xb8d0 [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2974]
        [The RTT to ACK the segment was: 0.000041000 seconds]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2976 24.816238   0.000032    172.17.42.106         www.nowhere.com   TCP      [TCP Dup ACK 2975#1] 1889 > https [ACK] Seq=1 Ack=2126224 Win=65535 Len=0

Frame 2976 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2126224, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2126224    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0xb8d0 [validation disabled]
    [SEQ/ACK analysis]
        [TCP Analysis Flags]
            [This is a TCP duplicate ack]
        [Duplicate ACK #: 1]
        [Duplicate to the ACK in frame: 2975]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2977 24.819131   0.002893    www.nowhere.com   172.17.42.106         SSLv3    Application Data, 

Frame 2977 (1490 bytes on wire, 1490 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2126224, Ack: 1, Len: 1436
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2126224    (relative sequence number)
    [Next sequence number: 2127660    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x18 (PSH, ACK)
    Window size: 32016
    Checksum: 0x82c7 [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2975]
        [The RTT to ACK the segment was: 0.002925000 seconds]
        [Number of bytes in flight: 1436]
    [Timestamps]
    TCP segment data (1436 bytes)
    [Reassembled PDU in frame: 2977]
    TCP segment data (471 bytes)
[Reassembled TCP Segments (13524 bytes): #2958(504), #2961(1436), #2962(1460), #2965(1436), #2966(1460), #2969(1436), #2970(1460), #2973(1436), #2974(1460), #2977(1436)]
Secure Socket Layer
    SSLv3 Record Layer: Application Data Protocol: http
        Content Type: Application Data (23)
        Version: SSL 3.0 (0x0300)
        Length: 13048
        Encrypted Application Data: 2A4A7D88943BE6CFD8B6C7867550CA59A60DBDA92A9D8EC0...

No.     Time        Delta       Source                Destination           Protocol Info
   2978 24.845701   0.026570    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2978 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2127660, Ack: 1, Len: 1460
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2127660    (relative sequence number)
    [Next sequence number: 2129120    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 32016
    Checksum: 0x0be8 [validation disabled]
    [SEQ/ACK analysis]
        [Number of bytes in flight: 2896]
    [Timestamps]
    [Reassembled PDU in frame: 2994]
    TCP segment data (1460 bytes)

No.     Time        Delta       Source                Destination           Protocol Info
   2979 24.845743   0.000042    172.17.42.106         www.nowhere.com   TCP      1889 > https [ACK] Seq=1 Ack=2129120 Win=65535 Len=0

Frame 2979 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2129120, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2129120    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0xad80 [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2978]
        [The RTT to ACK the segment was: 0.000042000 seconds]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2980 24.845773   0.000030    172.17.42.106         www.nowhere.com   TCP      [TCP Dup ACK 2979#1] 1889 > https [ACK] Seq=1 Ack=2129120 Win=65535 Len=0

Frame 2980 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2129120, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2129120    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0xad80 [validation disabled]
    [SEQ/ACK analysis]
        [TCP Analysis Flags]
            [This is a TCP duplicate ack]
        [Duplicate ACK #: 1]
        [Duplicate to the ACK in frame: 2979]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2981 24.848900   0.003127    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2981 (1490 bytes on wire, 1490 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2129120, Ack: 1, Len: 1436
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2129120    (relative sequence number)
    [Next sequence number: 2130556    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x18 (PSH, ACK)
    Window size: 32016
    Checksum: 0x55c7 [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2979]
        [The RTT to ACK the segment was: 0.003157000 seconds]
        [Number of bytes in flight: 1436]
    [Timestamps]
    [Reassembled PDU in frame: 2994]
    TCP segment data (1436 bytes)

No.     Time        Delta       Source                Destination           Protocol Info
   2982 24.874080   0.025180    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2982 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2130556, Ack: 1, Len: 1460
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2130556    (relative sequence number)
    [Next sequence number: 2132016    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 32016
    Checksum: 0xefea [validation disabled]
    [SEQ/ACK analysis]
        [Number of bytes in flight: 2896]
    [Timestamps]
    [Reassembled PDU in frame: 2994]
    TCP segment data (1460 bytes)

No.     Time        Delta       Source                Destination           Protocol Info
   2983 24.874113   0.000033    172.17.42.106         www.nowhere.com   TCP      1889 > https [ACK] Seq=1 Ack=2132016 Win=65535 Len=0

Frame 2983 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2132016, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2132016    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0xa230 [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2982]
        [The RTT to ACK the segment was: 0.000033000 seconds]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2984 24.874142   0.000029    172.17.42.106         www.nowhere.com   TCP      [TCP Dup ACK 2983#1] 1889 > https [ACK] Seq=1 Ack=2132016 Win=65535 Len=0

Frame 2984 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2132016, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2132016    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0xa230 [validation disabled]
    [SEQ/ACK analysis]
        [TCP Analysis Flags]
            [This is a TCP duplicate ack]
        [Duplicate ACK #: 1]
        [Duplicate to the ACK in frame: 2983]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2985 24.876977   0.002835    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2985 (1490 bytes on wire, 1490 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2132016, Ack: 1, Len: 1436
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2132016    (relative sequence number)
    [Next sequence number: 2133452    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x18 (PSH, ACK)
    Window size: 32016
    Checksum: 0x5394 [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2983]
        [The RTT to ACK the segment was: 0.002864000 seconds]
        [Number of bytes in flight: 1436]
    [Timestamps]
    [Reassembled PDU in frame: 2994]
    TCP segment data (1436 bytes)

No.     Time        Delta       Source                Destination           Protocol Info
   2986 24.915595   0.038618    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2986 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2133452, Ack: 1, Len: 1460
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2133452    (relative sequence number)
    [Next sequence number: 2134912    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 32016
    Checksum: 0x5535 [validation disabled]
    [SEQ/ACK analysis]
        [Number of bytes in flight: 2896]
    [Timestamps]
    [Reassembled PDU in frame: 2994]
    TCP segment data (1460 bytes)

No.     Time        Delta       Source                Destination           Protocol Info
   2987 24.915653   0.000058    172.17.42.106         www.nowhere.com   TCP      1889 > https [ACK] Seq=1 Ack=2134912 Win=65535 Len=0

Frame 2987 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2134912, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2134912    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0x96e0 [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2986]
        [The RTT to ACK the segment was: 0.000058000 seconds]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2988 24.915685   0.000032    172.17.42.106         www.nowhere.com   TCP      [TCP Dup ACK 2987#1] 1889 > https [ACK] Seq=1 Ack=2134912 Win=65535 Len=0

Frame 2988 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: Ibm_5f:3c:01 (00:11:25:5f:3c:01), Dst: 172.17.42.1 (00:e0:b1:7d:2d:b4)
Internet Protocol, Src: 172.17.42.106 (172.17.42.106), Dst: www.nowhere.com (155.155.155.155)
Transmission Control Protocol, Src Port: 1889 (1889), Dst Port: https (443), Seq: 1, Ack: 2134912, Len: 0
    Source port: 1889 (1889)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2134912    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0x96e0 [validation disabled]
    [SEQ/ACK analysis]
        [TCP Analysis Flags]
            [This is a TCP duplicate ack]
        [Duplicate ACK #: 1]
        [Duplicate to the ACK in frame: 2987]
    [Timestamps]

No.     Time        Delta       Source                Destination           Protocol Info
   2989 24.918564   0.002879    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2989 (1490 bytes on wire, 1490 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2134912, Ack: 1, Len: 1436
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2134912    (relative sequence number)
    [Next sequence number: 2136348    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x18 (PSH, ACK)
    Window size: 32016
    Checksum: 0x397a [validation disabled]
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 2987]
        [The RTT to ACK the segment was: 0.002911000 seconds]
        [Number of bytes in flight: 1436]
    [Timestamps]
    [Reassembled PDU in frame: 2994]
    TCP segment data (1436 bytes)

No.     Time        Delta       Source                Destination           Protocol Info
   2990 24.959074   0.040510    www.nowhere.com   172.17.42.106         TCP      [TCP segment of a reassembled PDU]

Frame 2990 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: 172.17.42.1 (00:e0:b1:7d:2d:b4), Dst: Ibm_5f:3c:01 (00:11:25:5f:3c:01)
Internet Protocol, Src: www.nowhere.com (155.155.155.155), Dst: 172.17.42.106 (172.17.42.106)
Transmission Control Protocol, Src Port: https (443), Dst Port: 1889 (1889), Seq: 2136348, Ack: 1, Len: 1460
    Source port: https (443)
    Destination port: 1889 (1889)
    [Stream index: 0]
    Sequence number: 2136348    (relative sequence number)
    [Next sequence number: 2137808    (relative sequence number)]
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 32016
    Checksum: 0xd80b [validation disabled]
    [SEQ/ACK analysis]
        [Number of bytes in flight: 2896]
    [Timestamps]
    [Reassembled PDU in frame: 2994]
    TCP segment data (1460 bytes)