Ok you don't say what they host systems are but I am going to guess Unix of some variety, in which case has anyone been playing around with the keepalive timers ?
If the session keepalive timer is reached a probe is sent with the ACK number set to ACK-1 i.e. telling the other end that the recipient lied previously when it said it had received all the data. This forces the origin to resend with the correct ACK number TCP/IP Illustrated Vol 2 p830 There are probably other instances where this is done but that's the one I've come across most often. MFC -----Original Message----- From: [EMAIL PROTECTED] [mailto:nobody@;groupstudy.com]On Behalf Of Matthew Tayler Sent: 24 October 2002 09:04 To: [EMAIL PROTECTED] Subject: TCP Ack numbers suddenly regress [7:56189] Anyone come across a situation where the ACK number suddenly steps back 1 and the link then resets ? Host A to Host B is running fine with the app using port 2400 on A talking to an app on B using ports 3564 & 3565 are in use. We have several traces showing the steady increase of sequence numbers then all of a sudden the ACK number takes step back by 1. There are no FIN segments in the preceeding traffic, but the now regressed ACK number is repeated in 7 segments sent and then a reset segment is issued and the two start exchanging data again. I am not allowed to post any of the data from the trace given the nature of the two systems involved, but here is an example of the way the ACK numbers run >From A to B port 2400 to 3564 4567 is ACK'd 4785 ..... 4948 4947 >From A to B port 2400 to 3565 466 is ACK'd 483 ..... 500 499 The link between the two is fine during this problem, utilisation drops but is nevera bove 20% anyway. Both host applicationms are still running and there are no process issues. The Cisco kit at either end is happy no error messages or the like so I we knows its host/app related. I can't find anything this specific in the archives and the nearest any of my textbooks come is to say a FIN has been issued - which the trace says is not the case. The reason for asking is that I didn't think it was possible to regress the sequence numbers, with the exception of the example from TCP/IP Illustrated Vol 2 noted above. Any ideas would be appreciated. Thanks Matt T Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=56191&t=56189 -------------------------------------------------- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
