TCP stream - can anyone explain?

[tomkrysl]

Hi, can anyone explain this TCP stream captured by wireshark ?
Thx tk

No.     Time        Source                Destination           Protocol Length Info
 360366 4426.777205 192.168.2.101         212.96.182.251        TCP      62     26432 > 65535 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
 360367 4426.852060 212.96.182.251        192.168.2.101         TCP      58     65535 > 26432 [SYN, ACK] Seq=0 Ack=1 Win=1446 Len=0 MSS=1446
 360368 4426.852138 192.168.2.101         212.96.182.251        TCP      54     26432 > 65535 [ACK] Seq=1 Ack=1 Win=17352 Len=0
 360369 4426.852290 192.168.2.101         212.96.182.251        TCP      426    26432 > 65535 [PSH, ACK] Seq=1 Ack=1 Win=17352 Len=372
 360383 4426.931808 212.96.182.251        192.168.2.101         TCP      54     [TCP Previous segment lost] 65535 > 26432 [FIN, ACK] Seq=546 Ack=373 Win=1446 Len=0
 360384 4426.931833 192.168.2.101         212.96.182.251        TCP      54     [TCP Dup ACK 360369#1] 26432 > 65535 [ACK] Seq=373 Ack=1 Win=17352 Len=0
 360386 4426.993925 212.96.182.251        192.168.2.101         TCP      54     65535 > 26432 [FIN, ACK] Seq=546 Ack=373 Win=1446 Len=0
 360387 4426.993969 192.168.2.101         212.96.182.251        TCP      54     [TCP Dup ACK 360369#2] 26432 > 65535 [ACK] Seq=373 Ack=1 Win=17352 Len=0
 361817 4442.180284 212.96.182.251        192.168.2.101         TCP      54     65535 > 26432 [FIN, ACK] Seq=546 Ack=373 Win=1446 Len=0
 361818 4442.180312 192.168.2.101         212.96.182.251        TCP      54     [TCP Dup ACK 360369#3] 26432 > 65535 [ACK] Seq=373 Ack=1 Win=17352 Len=0
 361821 4442.331098 212.96.182.251        192.168.2.101         TCP      599    [TCP Retransmission] 65535 > 26432 [PSH, ACK] Seq=1 Ack=373 Win=1446 Len=545
 361822 4442.331154 192.168.2.101         212.96.182.251        TCP      54     26432 > 65535 [ACK] Seq=373 Ack=547 Win=16807 Len=0
 361823 4442.331265 212.96.182.251        192.168.2.101         TCP      54     65535 > 26432 [FIN, ACK] Seq=546 Ack=373 Win=1446 Len=0
 361824 4442.331280 192.168.2.101         212.96.182.251        TCP      54     [TCP Dup ACK 361822#1] 26432 > 65535 [ACK] Seq=373 Ack=547 Win=16807 Len=0
 361825 4442.331499 192.168.2.101         212.96.182.251        TCP      54     26432 > 65535 [FIN, ACK] Seq=373 Ack=547 Win=16807 Len=0
 361829 4442.365215 212.96.182.251        192.168.2.101         TCP      54     65535 > 26432 [ACK] Seq=547 Ack=374 Win=1446 Len=0

 

[allworxguy]

I'm no expert on Wireshark, but it appears to me to be alot of errors in the handshake. Hence the Duplicate Acknowledgements and Retransmissions.

Marv

http://www.telemarv.ca

 

[DrB0b]

My two questions would be:
1) What parts do you want to know about or are confused about?
2) This isnt a homework assignment is it? If so, you will have to do the research on your own.

Learning - A never ending quest for knowledge usually attained by being thrown in a situation and told to fix it NOW.

 

[tomkrysl]

Thanks these things are clear to me now. I was testing my embedded tcp/ip stack, not having a clue about this particular error. It was due to packet drop off both at my device and somewhere in the network.

tk