Packetyzer Trace: ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// // Start of 3way hand shake 'SYN' from Windows 2000 Server to Lwip (Embedded Controller), which // has a listerning socket ready to accept incoming connections. ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// Frame 1 (62 bytes on wire, 62 bytes captured) Frame is marked: False Arrival Time: Mar 11, 2005 14:59:26.-1843363664 Time delta from previous packet: -100.000100000 seconds Time since reference or first frame: 25.000025000 seconds Frame Number: 1 Packet Length: 62 bytes Capture Length: 62 bytes Ethernet II, Src: 00:02:b3:8f:8a:d3, Dst: 00:50:c2:12:15:5f Destination: 00:50:c2:12:15:5f (IeeeRegi_12:15:5f) Source: 00:02:b3:8f:8a:d3 (Intel_8f:8a:d3) Source or Destination Address: 00:50:c2:12:15:5f (IeeeRegi_12:15:5f) Source or Destination Address: 00:02:b3:8f:8a:d3 (Intel_8f:8a:d3) Type: IP (0x0800) Internet Protocol, Src Addr: 192.168.2.133 (192.168.2.133), Dst Addr: 192.168.2.220 (192.168.2.220) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 48 Identification: 0x9526 (38182) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Bad Header checksum: True Header checksum: 0x0000 (incorrect, should be 0xdeef) Source: 192.168.2.133 (192.168.2.133) Source or Destination Address: 192.168.2.133 (192.168.2.133) Destination: 192.168.2.220 (192.168.2.220) Source or Destination Address: 192.168.2.220 (192.168.2.220) Transmission Control Protocol, Src Port: 3179 (3179), Dst Port: 49405 (49405), Seq: 0, Ack: 0, Len: 0 Source port: 3179 (3179) Destination port: 49405 (49405) Source or Destination Port: 3179 Source or Destination Port: 49405 TCP Segment Len: 0 Sequence number: 0 (relative sequence number) Header length: 28 bytes Flags: 0x0002 (SYN) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...0 .... = Acknowledgment: Not set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..1. = Syn: Set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x1141 (correct) Options: (8 bytes) TCP MSS Option: True Maximum segment size: 1460 bytes NOP NOP SACK permitted 0000: 00 50 C2 12 15 5F 00 02 B3 8F 8A D3 08 00 45 00 .P..._........E. 0010: 00 30 95 26 40 00 80 06 00 00 C0 A8 02 85 C0 A8 .0.&@........... 0020: 02 DC 0C 6B C0 FD 90 8F 8D 34 00 00 00 00 70 02 ...k.....4....p. 0030: FF FF 11 41 00 00 02 04 05 B4 01 01 04 02 ...A.......... ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// // 2nd stage of 3way hand shake 'SYN,ACK' from Lwip (Embedded Controller) to Windows 2000 Server ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// Frame 2 (60 bytes on wire, 60 bytes captured) Frame is marked: False Arrival Time: Mar 11, 2005 14:59:26.-1843363664 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 25.000025000 seconds Frame Number: 2 Packet Length: 60 bytes Capture Length: 60 bytes Ethernet II, Src: 00:50:c2:12:15:5f, Dst: 00:02:b3:8f:8a:d3 Destination: 00:02:b3:8f:8a:d3 (Intel_8f:8a:d3) Source: 00:50:c2:12:15:5f (IeeeRegi_12:15:5f) Source or Destination Address: 00:02:b3:8f:8a:d3 (Intel_8f:8a:d3) Source or Destination Address: 00:50:c2:12:15:5f (IeeeRegi_12:15:5f) Type: IP (0x0800) Trailer: 0000 Internet Protocol, Src Addr: 192.168.2.220 (192.168.2.220), Dst Addr: 192.168.2.133 (192.168.2.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 44 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: TCP (0x06) Header checksum: 0xf519 (correct) Source: 192.168.2.220 (192.168.2.220) Source or Destination Address: 192.168.2.220 (192.168.2.220) Destination: 192.168.2.133 (192.168.2.133) Source or Destination Address: 192.168.2.133 (192.168.2.133) Transmission Control Protocol, Src Port: 49405 (49405), Dst Port: 3179 (3179), Seq: 0, Ack: 1, Len: 0 Source port: 49405 (49405) Destination port: 3179 (3179) Source or Destination Port: 49405 Source or Destination Port: 3179 TCP Segment Len: 0 Sequence number: 0 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 24 bytes Flags: 0x0012 (SYN, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..1. = Syn: Set .... ...0 = Fin: Not set Window size: 1100 Checksum: 0x09e5 (correct) Options: (4 bytes) TCP MSS Option: True Maximum segment size: 1024 bytes SEQ/ACK analysis This is an ACK to the segment in frame: 1 0000: 00 02 B3 8F 8A D3 00 50 C2 12 15 5F 08 00 45 00 .......P..._..E. 0010: 00 2C 00 00 40 00 FF 06 F5 19 C0 A8 02 DC C0 A8 .,address@hidden 0020: 02 85 C0 FD 0C 6B 00 00 19 BA 90 8F 8D 35 60 12 .....k.......5`. 0030: 04 4C 09 E5 00 00 02 04 04 00 00 00 .L.......... ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// // Final stage of 3way hand shake 'ACK' from Windows 2000 Server to Lwip (Embedded Controller) // connection now established to Lwip (Embedded Controller). ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// Frame 3 (54 bytes on wire, 54 bytes captured) Frame is marked: False Arrival Time: Mar 11, 2005 14:59:26.-1843363664 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 25.000025000 seconds Frame Number: 3 Packet Length: 54 bytes Capture Length: 54 bytes Ethernet II, Src: 00:02:b3:8f:8a:d3, Dst: 00:50:c2:12:15:5f Destination: 00:50:c2:12:15:5f (IeeeRegi_12:15:5f) Source: 00:02:b3:8f:8a:d3 (Intel_8f:8a:d3) Source or Destination Address: 00:50:c2:12:15:5f (IeeeRegi_12:15:5f) Source or Destination Address: 00:02:b3:8f:8a:d3 (Intel_8f:8a:d3) Type: IP (0x0800) Internet Protocol, Src Addr: 192.168.2.133 (192.168.2.133), Dst Addr: 192.168.2.220 (192.168.2.220) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x9527 (38183) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Bad Header checksum: True Header checksum: 0x0000 (incorrect, should be 0xdef6) Source: 192.168.2.133 (192.168.2.133) Source or Destination Address: 192.168.2.133 (192.168.2.133) Destination: 192.168.2.220 (192.168.2.220) Source or Destination Address: 192.168.2.220 (192.168.2.220) Transmission Control Protocol, Src Port: 3179 (3179), Dst Port: 49405 (49405), Seq: 1, Ack: 1, Len: 0 Source port: 3179 (3179) Destination port: 49405 (49405) Source or Destination Port: 3179 Source or Destination Port: 49405 TCP Segment Len: 0 Sequence number: 1 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Bad Checksum: True Checksum: 0x86cc (incorrect, should be 0x243a) SEQ/ACK analysis This is an ACK to the segment in frame: 2 0000: 00 50 C2 12 15 5F 00 02 B3 8F 8A D3 08 00 45 00 .P..._........E. 0010: 00 28 95 27 40 00 80 06 00 00 C0 A8 02 85 C0 A8 .(.'@........... 0020: 02 DC 0C 6B C0 FD 90 8F 8D 35 00 00 19 BB 50 10 ...k.....5....P. 0030: FF FF 86 CC 00 00 ...... ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// // At this point the Lwip (Embedded Controller) suffers a power brown out I.e Switch power off and // then back on. This means that the Lwip (Embedded Controller) will return to it's initial state of Listerning // ready to accept incoming connections. But the Windows 2000 Server is unware of the brown out, // so it tries to poll (Application Level Polling) the Lwip (Embedded Controller) for it's status. //This means Lwip (Embedded Controller) recieves a PUSH,ACK data packet. ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// Frame 4 (58 bytes on wire, 58 bytes captured) Frame is marked: False Arrival Time: Mar 11, 2005 14:59:58.-1843331664 Time delta from previous packet: 32.000032000 seconds Time since reference or first frame: 57.000057000 seconds Frame Number: 4 Packet Length: 58 bytes Capture Length: 58 bytes Ethernet II, Src: 00:02:b3:8f:8a:d3, Dst: 00:50:c2:12:15:5f Destination: 00:50:c2:12:15:5f (IeeeRegi_12:15:5f) Source: 00:02:b3:8f:8a:d3 (Intel_8f:8a:d3) Source or Destination Address: 00:50:c2:12:15:5f (IeeeRegi_12:15:5f) Source or Destination Address: 00:02:b3:8f:8a:d3 (Intel_8f:8a:d3) Type: IP (0x0800) Internet Protocol, Src Addr: 192.168.2.133 (192.168.2.133), Dst Addr: 192.168.2.220 (192.168.2.220) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 44 Identification: 0x9579 (38265) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Bad Header checksum: True Header checksum: 0x0000 (incorrect, should be 0xdea0) Source: 192.168.2.133 (192.168.2.133) Source or Destination Address: 192.168.2.133 (192.168.2.133) Destination: 192.168.2.220 (192.168.2.220) Source or Destination Address: 192.168.2.220 (192.168.2.220) Transmission Control Protocol, Src Port: 3179 (3179), Dst Port: 49405 (49405), Seq: 1, Ack: 1, Len: 4 Source port: 3179 (3179) Destination port: 49405 (49405) Source or Destination Port: 3179 Source or Destination Port: 49405 TCP Segment Len: 4 Sequence number: 1 (relative sequence number) Next sequence number: 5 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65535 Bad Checksum: True Checksum: 0x86d0 (incorrect, should be 0xa62c) SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) out-of-order segment Data (4 bytes) 0000: 00 50 C2 12 15 5F 00 02 B3 8F 8A D3 08 00 45 00 .P..._........E. 0010: 00 2C 95 79 40 00 80 06 00 00 C0 A8 02 85 C0 A8 .,address@hidden 0020: 02 DC 0C 6B C0 FD 90 8F 8D 35 00 00 19 BB 50 18 ...k.....5....P. 0030: FF FF 86 D0 00 00 FF 00 7F 00 .......... ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// // Because the Lwip (Embedded Controller) was not expecting a PSH,ACK from the Windows 2000 Server // due to it being in a listerning state, ready to accept incoming connections, it returns a RST,ACK. At this // point i think Lwip (Embedded Controller) as gone in to an unrecoverable state. ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// Frame 5 (60 bytes on wire, 60 bytes captured) Frame is marked: False Arrival Time: Mar 11, 2005 14:59:58.-1843331664 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 57.000057000 seconds Frame Number: 5 Packet Length: 60 bytes Capture Length: 60 bytes Ethernet II, Src: 00:50:c2:12:15:5f, Dst: 00:02:b3:8f:8a:d3 Destination: 00:02:b3:8f:8a:d3 (Intel_8f:8a:d3) Source: 00:50:c2:12:15:5f (IeeeRegi_12:15:5f) Source or Destination Address: 00:02:b3:8f:8a:d3 (Intel_8f:8a:d3) Source or Destination Address: 00:50:c2:12:15:5f (IeeeRegi_12:15:5f) Type: IP (0x0800) Trailer: 000000000000 Internet Protocol, Src Addr: 192.168.2.220 (192.168.2.220), Dst Addr: 192.168.2.133 (192.168.2.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: TCP (0x06) Header checksum: 0xf51d (correct) Source: 192.168.2.220 (192.168.2.220) Source or Destination Address: 192.168.2.220 (192.168.2.220) Destination: 192.168.2.133 (192.168.2.133) Source or Destination Address: 192.168.2.133 (192.168.2.133) Transmission Control Protocol, Src Port: 49405 (49405), Dst Port: 3179 (3179), Seq: 2, Ack: 5, Len: 0 Source port: 49405 (49405) Destination port: 3179 (3179) Source or Destination Port: 49405 Source or Destination Port: 3179 TCP Segment Len: 0 Sequence number: 2 (relative sequence number) Acknowledgement number: 5 (relative ack number) Header length: 20 bytes Flags: 0x0014 (RST, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .1.. = Reset: Set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 1100 Checksum: 0x1fe5 (correct) SEQ/ACK analysis This is an ACK to the segment in frame: 4 TCP Analysis Flags This frame is a (suspected) out-of-order segment A segment before this frame was lost 0000: 00 02 B3 8F 8A D3 00 50 C2 12 15 5F 08 00 45 00 .......P..._..E. 0010: 00 28 00 00 40 00 FF 06 F5 1D C0 A8 02 DC C0 A8 .(address@hidden 0020: 02 85 C0 FD 0C 6B 00 00 19 BC 90 8F 8D 39 50 14 .....k.......9P. 0030: 04 4C 1F E5 00 00 00 00 00 00 00 00 .L.......... ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// // At this point the Windows 2000 Server as detected a problem relalises there is a problem // (Application Level Polling), thus closes its connection and waits 60sec. After this period as alapsed // it tries to re-connect to the Lwip (Embedded Controller), this is what follows...... // // Windows 2000 Server start of new connection 'SYN' in 3way Handshake. ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// Frame 6 (62 bytes on wire, 62 bytes captured) Frame is marked: False Arrival Time: Mar 11, 2005 15:01:01.-1843268664 Time delta from previous packet: 63.000063000 seconds Time since reference or first frame: 120.000120000 seconds Frame Number: 6 Packet Length: 62 bytes Capture Length: 62 bytes Ethernet II, Src: 00:02:b3:8f:8a:d3, Dst: 00:50:c2:12:15:5f Destination: 00:50:c2:12:15:5f (IeeeRegi_12:15:5f) Source: 00:02:b3:8f:8a:d3 (Intel_8f:8a:d3) Source or Destination Address: 00:50:c2:12:15:5f (IeeeRegi_12:15:5f) Source or Destination Address: 00:02:b3:8f:8a:d3 (Intel_8f:8a:d3) Type: IP (0x0800) Internet Protocol, Src Addr: 192.168.2.133 (192.168.2.133), Dst Addr: 192.168.2.220 (192.168.2.220) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 48 Identification: 0x959f (38303) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Bad Header checksum: True Header checksum: 0x0000 (incorrect, should be 0xde76) Source: 192.168.2.133 (192.168.2.133) Source or Destination Address: 192.168.2.133 (192.168.2.133) Destination: 192.168.2.220 (192.168.2.220) Source or Destination Address: 192.168.2.220 (192.168.2.220) Transmission Control Protocol, Src Port: 3189 (3189), Dst Port: 49405 (49405), Seq: 0, Ack: 0, Len: 0 Source port: 3189 (3189) Destination port: 49405 (49405) Source or Destination Port: 3189 Source or Destination Port: 49405 TCP Segment Len: 0 Sequence number: 0 (relative sequence number) Header length: 28 bytes Flags: 0x0002 (SYN) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...0 .... = Acknowledgment: Not set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..1. = Syn: Set .... ...0 = Fin: Not set Window size: 65535 Checksum: 0x00e7 (correct) Options: (8 bytes) TCP MSS Option: True Maximum segment size: 1460 bytes NOP NOP SACK permitted SEQ/ACK analysis This is an ACK to the segment in frame: 5 The RTT to ACK the segment was: 0.000039000 seconds 0000: 00 50 C2 12 15 5F 00 02 B3 8F 8A D3 08 00 45 00 .P..._........E. 0010: 00 30 95 9F 40 00 80 06 00 00 C0 A8 02 85 C0 A8 address@hidden 0020: 02 DC 0C 75 C0 FD 91 FC 9C 17 00 00 00 00 70 02 ...u..........p. 0030: FF FF 00 E7 00 00 02 04 05 B4 01 01 04 02 .............. ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// // Lwip (Embedded Controller) replies with RST,ACK. Why did it do this ? At this point it is now impossible // to connect to the Lwip (Embedded Controller) the process just keeps going SYN from Windows 2000 Server // with the Lwip (Embedded Controller) returning RST,ACK. Thus we have a dead socket....... // only way to clear the problem is to reset Lwip (Embedded Controller). // // This all comes about because data (PSH,ACK) was sent to a listerning socket. If i ensure that no // data sent to the listerning socket, then everything is ok. ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// Frame 7 (60 bytes on wire, 60 bytes captured) Frame is marked: False Arrival Time: Mar 11, 2005 15:01:01.-1843268664 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 120.000120000 seconds Frame Number: 7 Packet Length: 60 bytes Capture Length: 60 bytes Ethernet II, Src: 00:50:c2:12:15:5f, Dst: 00:02:b3:8f:8a:d3 Destination: 00:02:b3:8f:8a:d3 (Intel_8f:8a:d3) Source: 00:50:c2:12:15:5f (IeeeRegi_12:15:5f) Source or Destination Address: 00:02:b3:8f:8a:d3 (Intel_8f:8a:d3) Source or Destination Address: 00:50:c2:12:15:5f (IeeeRegi_12:15:5f) Type: IP (0x0800) Trailer: 000000000000 Internet Protocol, Src Addr: 192.168.2.220 (192.168.2.220), Dst Addr: 192.168.2.133 (192.168.2.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x0001 (1) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: TCP (0x06) Header checksum: 0xf51c (correct) Source: 192.168.2.220 (192.168.2.220) Source or Destination Address: 192.168.2.220 (192.168.2.220) Destination: 192.168.2.133 (192.168.2.133) Source or Destination Address: 192.168.2.133 (192.168.2.133) Transmission Control Protocol, Src Port: 49405 (49405), Dst Port: 3189 (3189), Seq: 0, Ack: 1, Len: 0 Source port: 49405 (49405) Destination port: 3189 (3189) Source or Destination Port: 49405 Source or Destination Port: 3189 TCP Segment Len: 0 Sequence number: 0 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 20 bytes Flags: 0x0014 (RST, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .1.. = Reset: Set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 1100 Checksum: 0x294b (correct) SEQ/ACK analysis This is an ACK to the segment in frame: 6 0000: 00 02 B3 8F 8A D3 00 50 C2 12 15 5F 08 00 45 00 .......P..._..E. 0010: 00 28 00 01 40 00 FF 06 F5 1C C0 A8 02 DC C0 A8 .(address@hidden 0020: 02 85 C0 FD 0C 75 00 00 00 00 91 FC 9C 18 50 14 .....u........P. 0030: 04 4C 29 4B 00 00 00 00 00 00 00 00 .L)K........ ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// // end //