This preview shows page 1. Sign up to view the full content.
Unformatted text preview: equence of packets is exchanged 2 hours later in lines 8-11.
If we could see all the fields in the keepalive probes, lines 6 and 10, we would see that the
sequence number field is one less than the next sequence number to be sent (i.e., 13 in
this example, when it should be 14), but because there is no data in the segment,
tcpdump does not print the sequence number field. (It only prints the sequence number
for empty segments that contain the SYN, FIN, or RST flags.) It is the receipt of this
incorrect sequence number that forces the server's TCP to respond with an ACK to the
keepalive probe. The response tells the client the next sequence number that the server is
Some older implementations based on 4.2BSD do not respond to these keepalive probes unless the
segment contains data. Some systems can be configured to send one garbage byte of data in the probe to
elicit the response. The garbage byte causes no harm, because it's not the expected byte (it's a byte that
the receiver has previously received and acknowledged), so it's thrown away by the receiver. Other
systems send the 4.3BSD-style segment (no data) for the first half of the probe period, and if no
response is received, switch to the 4.2BSD-style segment for the last half. We then disconnect the cable and expect the next probe, 2 hours later, to fail. When this
next probe takes place, notice that we never see the TCP segments on the cable, because
the host is not responding to ARP requests. We can still see that the client sends 10
probes, spaced 75 seconds apart, before giving up. We can see from our interactive script file:///D|/Documents%20and%20Settings/bigini/Docum.../homenet2run/tcpip/tcp-ip-illustrated/tcp_keep.htm (5 of 9) [12/09/2001 14.47.30] Chapter 23. TCP Keepalive Timer that the error code returned to the client process by TCP gets translated into "Connection
timed out," which is what happened.
Other End Crashes and Reboots
In this example we'll see what happens when the clie...
View Full Document
This test prep was uploaded on 04/04/2014 for the course ECE EL5373 taught by Professor Guoyang during the Spring '12 term at NYU Poly.
- Spring '12