WSU - CS 3705-0 - Spring 2006 - Vincenzo MAGGIO

Ethereal Lab TCP

After uploading alice.txt to gaia.cs.umass.edu I got the following page:



and this is part of the capture file:


  1. My machine
    1. IP: 67.182.228.87
    2. port: 2410
  2. gaia.cs.umass.edu
    1. IP: 128.119.245.12
    2. port: 80
  3. Number 3 is equal to # 1
    1. Seq=0
    2. the string: "[SYN]"
    1. Seq=0
    2. Ack=1
    3. The value is the previous packet Seq number + 1
    4. the string: "[SYN ACK]"
  4. here the packet with the POST method
    it's the number #221

    1. Seq=1, 560, 1, 2020, 3480, 1
    2. They were sent at [since capture began] + 1.894674, 1.894862, 1.983667, 1.984024, 1.984034, 1.992590
    3. in the packet #233 gaia ACKs the first segment
    4. in packet #233 time delta from previous packet is 0.089. we can assume that RTT has been at least 0.089 * 2 = 0.178 s.
    5. round trip:

  5. packets' lenght 221-237: bytes 613, 1514, 60, 1514, 1514, 60
  6. No there is no retransmission
    1. I would check for duplicate ACK, but there is none

    2. as well as a search with the filter "ip.addr eq 128.119.245.12 and tcp.flags.cwr eq 1"
      does not give any result.
      Where CWR stands for Congestion Window Reduced
  7. Ordering by "Source" it is easy to notice in the column "Info" the several Ack=<number>.
    Those numbers are the total bytes received till that ACK-ed packet

  8. then it is easier to subtract from the arrival time the starting time, to divide the packet size with.