Wireshark · Wireshark-users: Re: [Wireshark-users] TCP Previous segment lost > connection lost (bank transaction)

[Sake Blok <sake@xxxxxxxxxx>]

On Mon, Apr 13, 2009 at 07:37:18PM +0200, Sake Blok wrote:
> On Sun, Apr 12, 2009 at 01:21:02PM -0400, Vikki Taxdal wrote:
> > On Sun, Apr 12, 2009 at 3:41 AM, Sake Blok <sake@xxxxxxxxxx> wrote:
> > 
> > > 8720    S->C    data (response, seq 2666, next 2492)
> > > 8721    C->S    ACK (2492)
> > > ~17 sec delay
> > > 8722    S->C    FIN (seq 2515, previous segment lost)
> > 
> > So, does this part mean maybe not one, but _some_ packets were lost?
> > One with the segment transporting 23 bytes, and one or more
> > retransmissions after that, depending on the Server TCP's timeout
> > value for waiting for ACK?
> 
> No, only the 23 bytes between seq 2492 and 2515 were lost. They could
> have been transmitted in several frames, but that is not likely
> considering the content of the missing bytes.

Oops, I think I misread your question. Yes, if the SSL Alerts was sent
straight after receving the ACK of frame 8721, I would have expected it
to be sent multiple times in the 17 sec gap. However, it is most likely
that the server closed the connecting *after* the gap, by sending the
SSL alert, followed by the FIN.

Cheers,
Sake