From: grahn+nntp@snipabacken.se   
      
   On Tue, 2010-10-19, Rick Jones wrote:   
   > ctwiz  wrote:   
   >> On Oct 19, 12:43?pm, Jorgen Grahn  wrote:   
   >> > Which can be summarized like this: a SYN like this is ignored:   
   >> >   
   >> > ? ?seq 3459677040, win 65535, options   
   >> > ? ?[mss 1460,nop,wscale 3,nop,nop,TS val 792743561 ecr 0,sackOK,eol]   
   >> >   
   >> > but when the client switches to this, a connection is made:   
   >> >   
   >> > ? ?seq 3459677040, win 65535, options   
   >> > ? ?[mss 1460,sackOK,eol]   
   >> >   
   >   
   >> Correct. But I'm curious as to why the client (my os x 10.6.4 macbook   
   >> pro) would change the header to accommodate the previously non-   
   >> responsive server. Is this in the spec? or is this some weird OS   
   >> dependent implementation?   
   >   
   > It suggests that Apple have encountered "problems" often enough in   
   > connecting to some stacks involving either the window scaling or time   
   > stamp options (I'm ass-u-me-ing the nops present are necessary and   
   > sufficient) to code their stack to say that after the Nth   
   > retransmssion back-off on some options.  There is not, to my knowledge   
   > anything in the TCP specs that requires such behaviour, then again I   
   > don't think there is anything that precludes it either.   
   >   
   >> > No, I don't have the answer ... but it's easier for others to discuss   
   >> > something they can see directly and quote.   
   >> >   
   >> > What does netstat -s say?   
   >> >   
   >   
   >> Ip:   
      
   [lots of exotic output]   
      
   >   
   > It might be easier to do something like:   
   >   
   > netstat -s > before   
   >    
   > netstat -s > after   
   > beforeafter before after > delta   
      
   Or calculate the delta manually, since you only need to do it once.   
      
   The machine seems to have been up for a long time -- all kinds of   
   freaky error counters had high counts.  I'm guessing those SYNs only   
   update one or two of them.   
      
   When you find the right counter, try googling for it. I'm not sure if   
   anyone here knows the meaning of all of them.  Last time I needed to   
   know what one of the freaky "Ext" counters meant, I had to look in the   
   Linux kernel source code.   
      
   /Jorgen   
      
   PS. Your "bad" SYNs look pretty much like normal SYNs between my Linux   
       machines -- MSS, window scaling, timestamp and sackOK. It doesn't   
       seem to me as if the Mac does anything abnormal. But I don't know   
       TCP well enough to say.   
      
   --   
     // Jorgen Grahn    O  o   .   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)