"Don Ray" writes:
> sitemgr[1]# tcpdump -vi ppp0 port 80
> tcpdump: listening on ppp0
> 19:49:01.400140 mrtrh_nb.1104 > sitemgr.www: S 3905947:3905947(0) win 8192
> <mss 1460> (DF) (ttl 32, id 42506)

"Hi, I'm trying to open up a connection to your port 80?"

> 19:49:01.400304 sitemgr.www > mrtrh_nb.1104: S 153344001:153344001(0) ack
> 3905948 win 17520 <mss 1460> (ttl 64, id 649)

"Sure."

> 19:49:01.720111 mrtrh_nb.1104 > sitemgr.www: . ack 1 win 8760 (DF) (ttl 32,
> id 42762)
> 19:49:01.720277 mrtrh_nb.1104 > sitemgr.www: . ack 1 win 32768 (DF) (ttl
> 32, id 43018)

"Did I mention I was a broken TCP implementation? I'm going to send
you not just one but TWO acks in close succession"

> 19:49:01.750106 mrtrh_nb.1104 > sitemgr.www: P 1:330(329) ack 1 win 32768
> (DF) (ttl 32, id 43274)

"And now I'm going to send you a bunch o' stuff, presumably an HTML request."

> 19:49:01.750257 sitemgr.www > mrtrh_nb.1104: . ack 330 win 17520 (ttl 64,
> id 650)

"Got your request..."

> 19:49:01.765347 sitemgr.www > mrtrh_nb.1104: . 1:1461(1460) ack 330 win
> 17520 (ttl 64, id 651)

"Have a maximum frame worth of data."

> 19:49:01.765407 sitemgr.www > mrtrh_nb.1104: P 1461:2049(588) ack 330 win
> 17520 (ttl 64, id 652)

"Have some more data, with a PUSH applied because for some reason I
think you want this *now* (end of the data, maybe?)."

> 19:49:02.990102 sitemgr.www > mrtrh_nb.1104: . 1:1461(1460) ack 330 win
> 17520 (ttl 64, id 654)

"Hmmm. You didn't acknowledge anything. In fact, I keep acking that
last frame you sent me, and you are not replying. Have that first
maximum frame worth of data, retransmitted, just in case."

> 19:49:05.990096 sitemgr.www > mrtrh_nb.1104: . 1:1461(1460) ack 330 win
> 17520 (ttl 64, id 657)

"Still not acknowledging me, eh? ARE YOU OUT THERE?"

> 19:49:11.990098 sitemgr.www > mrtrh_nb.1104: . 1:1461(1460) ack 330 win
> 17520 (ttl 64, id 659)

"HELLO! STUPID WINDOWS 95 BOX! I KEEP SENDING DATA AND YOU AREN'T ACKING!"

> 19:49:23.990182 sitemgr.www > mrtrh_nb.1104: . 1:1461(1460) ack 330 win
> 17520 (ttl 64, id 664)

"YOU OUT THERE? ANYWHERE?"

> 19:49:39.070128 mrtrh_nb.1104 > sitemgr.www: R 3906277:3906277(0) win 0
> (DF) (ttl 32, id 44810)

"Hi there. I'm the stupid machine that never send a reply. I'm going
to send an RST now to break the connection uncleanly because my
programmer wasn't very bright and doesn't do closes cleanly."

> BTW, I'm still learning how to interpret tcpdump (maybe the answer is right
> in front of my face?!)

It appears that for whatever reason, the second machine isn't being
very nice.

You don't say if this happens over your PPP link or your ethernet.

One possibility is that the link is handling short packets well but is
scrambling long ones. You might try doing pings with long packet
lengths and see.

Perry