Wireshark-users: Re: [Wireshark-users] Help with Output "TCP Dup ACK3#2 1320 > 22 ACK
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stephen Fisher <stephentfisher@xxxxxxxxx>
Date: Mon, 21 May 2007 14:52:22 -0700
On Fri, May 18, 2007 at 03:57:01PM -0600, Mike Ciccone wrote:

> I am having a problem with SSH.  I can ssh from some server but not 
> others.  I verified that there are no access-lists blocking from doing 
> this.  When I ran Wireshark on my pc and tried to ssh to the server I 
> get the following line that could be telling me what the problem is. 
> However, I don't understand it and was hoping some out there could 
> explain it to me.
> 
> Here is the line:
> [TCP Dup ACK 3#2] 1320 > 22 [ACK] Seq=1 Ack=1 win=65535 Len=0
> 
> Does this mean anything to anyone?  I'm guessing my problem lies here.  
> If I ssh to a server that works... I don't see this line

It has meaning once you read the source code ;).  The analysis within 
the brackets means means that this packet is it is the 2nd duplicate ack 
to packet #3.  Which packet number do you first receive a notice like 
the one above?  Is it the third packet of the SYN, SYN+ACK, ACK TCP 
handshake or a later packet?


Steve