Do keepalives / heartbeats use same TCP sequence numbers?

[deeze6]

Hello all,

I am analyzing sessions between two servers for which the sniffer is showing hundreds of Non-Responsive Station and Too Many Retransmissions alerts.

When I filter on any one of these TCP sessions, I see the retransmissions occur at constant intervals of 5.107 seconds even though all packets are aknowledged by both sides. Also the same sequence numbers are used in each packet.

Being that the retransmissions are at such a regular interval, this leads me to believe that these retransmissions are keepalives or heartbeats use to keep the session open.
But if that is the case, shouldn't the TCP sequence numbers increment?

 

[rwullems]

Hi,
That depents on what is more in the frame, are there any upper layer protocols or applications present or are the "retransmissions" only ACK frames?
In case of ACK frames that are resent, it can be the case that they are just used to keep the TCP session open (alive). In this case the station sending the ACK's will use the same SEQ number over and over until a new frame with "data" or whatever you are running is transmitted. When this is done, this frame (or some frames later depending on the window size) will be ACKed again.
Regards,
Robert

Robert A.H. Wullems
Sniffer University Instructor
SCM/CNX/MSCA
Citee Education
the Netherlands

 

[deeze6]

Hi Robert, these are ACK frames with the same sequence number repeated over and over. So I guess sniffer considers these retransmissions?

Thanks for your reply!

 

[rwullems]

Hi,
Now, not completely. Normanny frames sent with the same ack number (not SEQ number, the sender will increase this) wil not be marked by sniffer as a retransmission.
Robert

Robert A.H. Wullems
Sniffer University Instructor
SCM/CNX/MSCA