Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations wOOdy-Soft on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

snoop output help

Status
Not open for further replies.
yowza

yowza

Technical User
Nov 28, 2001
121
US
Below is a small portion of a Unix snoop session. My problem is that after awhile the applications running on hostf6 and hostm1 seem to hang. I suspect that the problem is with hostf6 which is where I ran the snoop. My knowledge of TCP is limited but the way I understand it if hostm1 sends a packet with Seq=100, hostf6 should reply with an Ack of 101. I don't see that scenario in this session. Hostm1 sends an Ack of 1790643430 and hostf6 replies with Seq= 1790643430. Both hosts are Unix systems with the Nics configured for failover. I am assuming this is what the broadcast messages are. Can someone please look at the session below and tell me what is going on? I think one problem is with the nic failover condition because in some cases there are 9 or 10 broadcasts before data appears to be sent. I am also interested in the Len and Win entries. How can there be a Len of 0? Shouldn't the Win sync up to the same size at some point? I am still researching TCP but I need to resolve this problem fairly quickly.

3427391717 Len=0 Win=7803
lfrq202.asdp11.ABC.com -> A.B.C.D ICMP Echo request (ID: 10754 Sequence number: 64687)
A.B.C.D -> lfrq202.asdp11.ABC.com ICMP Echo reply (ID: 10754 Sequence number: 64687)
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
lfrq202.asdp11.ABC.com -> A.B.C.D ICMP Echo request (ID: 10754 Sequence number: 64688)
A.B.C.D -> lfrq202.asdp11.ABC.com ICMP Echo reply (ID: 10754 Sequence number: 64688)
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
lfrq202.asdp11.ABC.com -> A.B.C.D ICMP Echo request (ID: 10754 Sequence number: 64689)
A.B.C.D -> lfrq202.asdp11.ABC.com ICMP Echo reply (ID: 10754 Sequence number: 64689)
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
hostm1 -> hostf6 TCP D=636 S=40446 Ack=1790643430 Seq=3427391717 Len=325 Win=7803
hostf6 -> hostm1 TCP D=40446 S=636 Ack=3427392042 Seq=1790643430 Len=197 Win=24820
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
hostm1 -> hostf6 TCP D=636 S=40446 Ack=1790643627 Seq=3427392042 Len=133 Win=7606
hostf6 -> hostm1 TCP D=40446 S=636 Ack=3427392175 Seq=1790643627 Len=101 Win=24820
hostf6 -> hostm1 TCP D=40446 S=636 Ack=3427392175 Seq=1790643728 Len=53 Win=24820
hostm1 -> hostf6 TCP D=636 S=40446 Ack=1790643781 Seq=3427392175 Len=0 Win=7452
hostm1 -> hostf6 TCP D=636 S=40446 Ack=1790643781 Seq=3427392175 Len=277 Win=7452
hostf6 -> hostm1 TCP D=40446 S=636 Ack=3427392452 Seq=1790643781 Len=85 Win=24820
hostm1 -> hostf6 TCP D=636 S=40446 Ack=1790643866 Seq=3427392452 Len=0 Win=7367
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
lfrq202.asdp11.ABC.com -> A.B.C.D ICMP Echo request (ID: 10754 Sequence number: 64690)
A.B.C.D -> lfrq202.asdp11.ABC.com ICMP Echo reply (ID: 10754 Sequence number: 64690)
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
lfrq202.asdp11.ABC.com -> A.B.C.D ICMP Echo request (ID: 10754 Sequence number: 64691)
A.B.C.D -> lfrq202.asdp11.ABC.com ICMP Echo reply (ID: 10754 Sequence number: 64691)
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
lfrq202.asdp11.ABC.com -> A.B.C.D ICMP Echo request (ID: 10754 Sequence number: 64692)
A.B.C.D -> lfrq202.asdp11.ABC.com ICMP Echo reply (ID: 10754 Sequence number: 64692)
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
hostm1 -> hostf6 TCP D=636 S=40446 Ack=1790643866 Seq=3427392452 Len=325 Win=7367
hostf6 -> hostm1 TCP D=40446 S=636 Ack=3427392777 Seq=1790643866 Len=197 Win=24820
hostm1 -> hostf6 TCP D=636 S=40446 Ack=1790644063 Seq=3427392777 Len=133 Win=8760
hostf6 -> hostm1 TCP D=40446 S=636 Ack=3427392910 Seq=1790644063 Len=101 Win=24820
hostf6 -> hostm1 TCP D=40446 S=636 Ack=3427392910 Seq=1790644164 Len=53 Win=24820
hostm1 -> hostf6 TCP D=636 S=40446 Ack=1790644217 Seq=3427392910 Len=0 Win=8606
hostm1 -> hostf6 TCP D=636 S=40446 Ack=1790644217 Seq=3427392910 Len=277 Win=8606
hostf6 -> hostm1 TCP D=40446 S=636 Ack=3427393187 Seq=1790644217 Len=85 Win=24820
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes
hostm1 -> hostf6 TCP D=636 S=40446 Ack=1790644302 Seq=3427393187 Len=0 Win=8521
? -> (broadcast) ETHER Type=886D (Unknown), size = 60 bytes

 
Status
Not open for further replies.

Similar threads

sologeek
  • Locked
  • Question
VPN server help
Replies
0
Views
737
sologeek
sologeek
Amaimon11
  • Locked
  • Question
OpenVPN help
Replies
0
Views
194
Amaimon11
Amaimon11
CTCINY
  • Locked
  • Question
Audiocodes Mediant 1000 Help
Replies
0
Views
231
CTCINY
CTCINY
scoutice
  • Locked
  • Question
Querying an EdgeQam for current output status
Replies
1
Views
121
bnorton916
bnorton916
turnbui
  • Locked
  • Question
server: connection vs request - help needed to understand programming theory
Replies
1
Views
272
Noway2
Noway2

Part and Inventory Search

Sponsor

Back
Top