XPost: comp.os.linux.networking   
   From: grahn+nntp@snipabacken.se   
      
   On Mon, 2010-08-23, Mark Hobley wrote:   
   > On Mon, 23 Aug 2010 08:05:47 +0000, Jorgen Grahn wrote:   
   >   
   >> (B) You have dumped a raw, binary tcpdump into the posting. Unreadable   
   >>     to almost anyone, I suspect. Provide a link instead, and/or the   
   >>     output from tcpdump -nr foo.pcap.   
   >   
   > Here is the output from tcpdump -nr:   
      
   Good. The lines are too long, but I see no way around that.   
      
   I will make an attempt to interpret it, but I'm crossposting (with   
   Followup-To) comp.protocols.tcp-ip. There are TCP experts there who   
   enjoy problems like this one.   
      
   > 23:01:05.171401 IP 217.171.136.36 > 10.0.0.2: tcp   
   > 23:03:05.970557 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [S], seq   
   82954937, win 5840, options [mss 1460,sackOK,TS val 47128676 ecr 0,nop,wscale   
   5], length 0   
   > 23:03:06.078058 IP 217.171.136.36.25 > 10.0.0.2.36084: Flags [S.], seq   
   7634705, ack 82954938, win 5792, options [mss 1460,sackOK,TS val 3828769491   
   ecr 47128676,nop,wscale 2], length 0   
   > 23:03:06.078134 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [.], ack 1, win   
   183, options [nop,nop,TS val 47128702 ecr 3828769491], length 0   
   > 23:03:06.208547 IP 217.171.136.36.25 > 10.0.0.2.36084: Flags [P.], seq 1:61,   
   ack 1, win 1448, options [nop,nop,TS val 3828769520 ecr 47128702], length 60   
   > 23:03:06.208612 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [.], ack 61,   
   win 183, options [nop,nop,TS val 47128735 ecr 3828769520], length 0   
   > 23:03:06.209460 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [P.], seq 1:31,   
   ack 61, win 183, options [nop,nop,TS val 47128735 ecr 3828769520], length 30   
   > 23:03:06.328287 IP 217.171.136.36.25 > 10.0.0.2.36084: Flags [.], ack 31,   
   win 1448, options [nop,nop,TS val 3828769550 ecr 47128735], length 0   
   > 23:03:06.329180 IP 217.171.136.36.25 > 10.0.0.2.36084: Flags [P.], seq   
   61:145, ack 31, win 1448, options [nop,nop,TS val 3828769550 ecr 47128735],   
   length 84   
   > 23:03:06.332091 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [P.], seq   
   31:67, ack 145, win 183, options [nop,nop,TS val 47128766 ecr 3828769550],   
   length 36   
   > 23:03:06.447995 IP 217.171.136.36.25 > 10.0.0.2.36084: Flags [P.], seq   
   145:153, ack 67, win 1448, options [nop,nop,TS val 3828769582 ecr 47128766],   
   length 8   
   > 23:03:06.448435 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [P.], seq   
   67:101, ack 153, win 183, options [nop,nop,TS val 47128795 ecr 3828769582],   
   length 34   
   > 23:03:06.568363 IP 217.171.136.36.25 > 10.0.0.2.36084: Flags [P.], seq   
   153:161, ack 101, win 1448, options [nop,nop,TS val 3828769609 ecr 47128795],   
   length 8   
   > 23:03:06.568785 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [P.], seq   
   101:135, ack 161, win 183, options [nop,nop,TS val 47128825 ecr 3828769609],   
   length 34   
   > 23:03:06.677942 IP 217.171.136.36.25 > 10.0.0.2.36084: Flags [P.], seq   
   161:169, ack 135, win 1448, options [nop,nop,TS val 3828769642 ecr 47128825],   
   length 8   
   > 23:03:06.678070 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [P.], seq   
   135:141, ack 169, win 183, options [nop,nop,TS val 47128852 ecr 3828769642],   
   length 6   
   > 23:03:06.797982 IP 217.171.136.36.25 > 10.0.0.2.36084: Flags [P.], seq   
   169:183, ack 141, win 1448, options [nop,nop,TS val 3828769668 ecr 47128852],   
   length 14   
   > 23:03:06.800323 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [.], seq   
   141:1589, ack 183, win 183, options [nop,nop,TS val 47128883 ecr 3828769668],   
   length 1448   
   > 23:03:06.800404 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [.], seq   
   1589:3037, ack 183, win 183, options [nop,nop,TS val 47128883 ecr 3828769668],   
   length 1448   
   > 23:03:06.800589 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [P.], seq   
   3037:4485, ack 183, win 183, options [nop,nop,TS val 47128883 ecr 3828769668],   
   length 1448   
   > 23:03:06.800620 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [P.], seq   
   4485:4865, ack 183, win 183, options [nop,nop,TS val 47128883 ecr 3828769668],   
   length 380   
   > 23:03:06.937956 IP 217.171.136.36.25 > 10.0.0.2.36084: Flags [.], ack 141,   
   win 1448, options [nop,nop,TS val 3828769706 ecr 47128852,nop,nop,sack 1   
   {4485:4865}], length 0   
      
   This is the last time Three speaks to you, and they only ACK up to   
   your byte #141. They have ACKed that once before, so they haven't seen   
   your 141--4865 yet.   
      
   And that makes you start over again from #141, with 141--1589:   
      
   > 23:03:06.938067 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [.], seq   
   141:1589, ack 183, win 183, options [nop,nop,TS val 47128917 ecr 3828769706],   
   length 1448   
   > 23:03:07.250262 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [.], seq   
   141:1589, ack 183, win 183, options [nop,nop,TS val 47128996 ecr 3828769706],   
   length 1448   
   > 23:03:07.882260 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [.], seq   
   141:1589, ack 183, win 183, options [nop,nop,TS val 47129154 ecr 3828769706],   
   length 1448   
   > 23:03:09.146268 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [.], seq   
   141:1589, ack 183, win 183, options [nop,nop,TS val 47129470 ecr 3828769706],   
   length 1448   
   > 23:03:11.674267 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [.], seq   
   141:1589, ack 183, win 183, options [nop,nop,TS val 47130102 ecr 3828769706],   
   length 1448   
   > 23:03:16.730264 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [.], seq   
   141:1589, ack 183, win 183, options [nop,nop,TS val 47131366 ecr 3828769706],   
   length 1448   
   > 23:03:26.842306 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [.], seq   
   141:1589, ack 183, win 183, options [nop,nop,TS val 47133894 ecr 3828769706],   
   length 1448   
   > 23:03:47.066269 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [.], seq   
   141:1589, ack 183, win 183, options [nop,nop,TS val 47138950 ecr 3828769706],   
   length 1448   
   > 23:04:27.514272 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [.], seq   
   141:1589, ack 183, win 183, options [nop,nop,TS val 47149062 ecr 3828769706],   
   length 1448   
   > 23:05:48.410282 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [.], seq   
   141:1589, ack 183, win 183, options [nop,nop,TS val 47169286 ecr 3828769706],   
   length 1448   
      
   But Three doesn't get those, or doesn't respond.   
      
   > 23:06:05.747618 IP 217.171.136.36.25 > 10.0.0.2.34215: Flags [P.], seq   
   3213499940:3213499962, ack 1251794419, win 1448, options [nop,nop,TS val   
   3828814408 ecr 46873551], length 22   
   > 23:06:05.747666 IP 10.0.0.2.34215 > 217.171.136.36.25: Flags [R], seq   
   1251794419, win 0, length 0   
      
   This one is weird. It's from Three's SMTP server, but goes to a new   
   TCP port on your side. Your side of course tells it to go to hell with   
   a RST.   
      
   I wonder if your NAT device ("broadband router") causes this particular problem   
   by forgetting your port 36084 and allocating a new one. Or maybe it's   
   stray packets from an earlier attempt?   
      
   > 23:07:48.410267 IP 10.0.0.2.36084 > 217.171.136.36.25: Flags [.], seq   
   141:1589, ack 183, win 183, options [nop,nop,TS val 47199286 ecr 3828769706],   
   length 1448   
      
   Yet another retransmission attempt. Now it's waiting 2 minutes between   
   attempts.   
      
   Someone more experienced will have to answer. I think your machine is   
   not to blame, but it could be any other equipment between you and the   
   SMTP server.   
      
      
   [continued in next message]   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)