This preview shows page 1. Sign up to view the full content.
Unformatted text preview: flags (R and P) later. The
other two TCP header flag bits-ACK and URG-are printed specially by tcpdump.
It's possible for more than one of the four flag bits in Figure 18.2 to be on in a single segment,
but we normally see only one on at a time.
RFC 1025 [Postel 1987], the TCP and IP Bake Off, calls a segment with the maximum combination of
allowable flag bits turned on at once (SYN, URG, PSH, FIN, and 1 byte of data) a Kamikaze packet. It's also file:///D|/Documents%20and%20Settings/bigini/Docu...homenet2run/tcpip/tcp-ip-illustrated/tcp_conn.htm (2 of 37) [12/09/2001 14.47.15] Chapter 18. TCP Connection Establishment and Termination known as a nastygram, Christmas tree packet, and lamp test segment. In line 1, the field 1415531521:1415531521 (0) means the sequence number of the packet
was 1415531521 and the number of data bytes in the segment was 0. tcpdump displays this by
printing the starting sequence number, a colon, the implied ending sequence number, and the
number of data bytes in parentheses. The advantage of displaying both the sequence number
and the implied ending sequence number is to see what the implied ending sequence number is,
when the number of bytes is greater than 0. This field is output only if (1) the segment contains
one or more bytes of data or (2) the SYN, FIN, or RST flag was on. Lines 1, 2, 4, and 6 in
Figure 18.1 display this field because of the flag bits-we never exchange any data in this
In line 2 the field ack 1415531522 shows the acknowledgment number. This is printed only
if the ACK flag in the header is on.
The field win 4096 in every line of output shows the window size being advertised by the
sender. In these examples, where we are not exchanging any data, the window size never
changes from its default of 4096. (We examine TCP's window size in Section 20.4.)
The final field that is output in Figure 18.1, <mss 1024> shows the maximum segment size
(MSS) option specified by the sender. The sender does not want to receive TCP segments larger
than this value....
View Full Document
- Spring '12