Wireshark · Wireshark-users: Re: [Wireshark-users] newbie question about tcp three-way handshaking

[Shain Singh <shain.singh@xxxxxxxxx>]

Have you got a two-way SPAN port setup for your capture?

On 22 January 2013 13:41, 温金超 <wenjinchao0418@xxxxxxxxx> wrote:

Hi guys,

Is should be three-way handshaking or not when trying to establishe a new connection?

but I tcpdump following:

 

19:23:12.688758 IP 10.1.164.64.51350 > 10.13.220.4.80: S 3779651860:3779651860(0) win 8192 <mss 1260,nop,wscale 8,nop,nop,sackOK>

19:23:12.688776 IP 10.13.220.4.80 > 10.1.164.64.51350: S4133937230:4133937230(0) ack 3779651861 win 5840 <mss 1460,nop,nop,sackOK,nop,wscale 9>

19:23:12.688779 IP 10.13.220.4.80 > 10.1.164.64.51350: S4133937230:4133937230(0) ack 3779651861 win 5840 <mss 1460,nop,nop,sackOK,nop,wscale 9>

19:23:12.689716 IP 10.1.164.64.51350 > 10.13.220.4.80: . ack 1 win 260

10.13.220.4 ack twice for syn. any idea ?

Thanks for any suggesstion.

jinchao

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe

--
Shaineel Singh
e: shain.singh@xxxxxxxxx
p: +61 422 921 951
w: http://buffet.shainsingh.com

--
"Too many have dispensed with generosity to practice charity" - Albert Camus