Ethereal-users: [Ethereal-users] data + FIN: Small error in TCP next sequence number and TCP Seq

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "BERGWEILER, CHRISTIAN (HP-Netherlands, ex1)" <cristian_bergweiler@xxxxxx>
Date: Wed, 21 May 2003 16:33:51 +0200
Hi all,

Although this probably is not the best place for a small bug report, here it
goes anyhow:

If you turn TCP Sequence Number Analysis on, a false "TCP ACKed lost
segment" message is generated for TCP packets with both data and the FIN
flag on. Apparently Ethereal forgets to add the FIN (which "consumes" a
sequence number) to its sum, so it sees an ACK for a sequence number it did
not expect (one more than the calculated one); therefore it concludes that a
segment was lost.

You can see the problem also without turning TCP Sequence Analysis on: If
you look at the "Next Sequence Number" field for such a packet, you'll see
the wrong calculation there too. 

Below, frame 2655 has sequence number 2393802338, plus 466 for the data plus
1 for the FIN makes 2393802805 to be the expected next seq. number.
In frame 2656, the correct value (2393802805) is ACKed, but Ethereal flags
an error. If you examine the detailed view of frame 2655 below, you'll see
the "Next sequence number" also showing the wrong value.

[...]
2655 93.322619 192.168.2.1 192.168.2.198 TCP 810 > 9100 [FIN, PSH, ACK]
Seq=2393802338 Ack=763926 Win=5840 Len=466
2656 93.327544 192.168.2.198 192.168.2.1 TCP [TCP ACKed lost segment] 9100 >
810 [ACK] Seq=763926 Ack=2393802805 Win=2454 Len=0
2657 93.332261 192.168.2.198 192.168.2.1 TCP 9100 > 810 [FIN, ACK]
Seq=763926 Ack=2393802805 Win=2454 Len=0
2658 93.332286 192.168.2.1 192.168.2.198 TCP 810 > 9100 [ACK] Seq=2393802805
Ack=763927 Win=5840 Len=0


Frame 2655 (520 bytes on wire, 520 bytes captured)
[...]
Transmission Control Protocol, Src Port: 810 (810), Dst Port: 9100 (9100),
Seq: 2393802338, Ack: 763926, Len: 466
    Source port: 810 (810)
    Destination port: 9100 (9100)
    Sequence number: 2393802338
    Next sequence number: 2393802804
    Acknowledgement number: 763926
    Header length: 20 bytes
    Flags: 0x0019 (FIN, PSH, ACK)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...1 .... = Acknowledgment: Set
        .... 1... = Push: Set
        .... .0.. = Reset: Not set
        .... ..0. = Syn: Not set
        .... ...1 = Fin: Set
    Window size: 5840
    Checksum: 0x24f6 (correct)
Data (466 bytes)

Have a nice day!

Cristian Bergweiler 
JetDirect Support Engineer 
HPCS-EMEA Operations Regional