07627bce   
   From: barmar@alum.mit.edu   
      
   In article   
   <11ff68ec-2c98-4eb0-a1c0-4d3943c2bade@v10g2000yqn.googlegroups.com>,   
    lmike  wrote:   
      
   > I see somthing from a tcpdump output on Linux that I don't quite   
   > understand (see below).   
   > -why all a sudden, A sends to B with big seq numbers (i.e.   
   > 3286598003:3286598051), and why with ack 1191864251?   
   > A(server)-B(client) link has been idle for a few minutes before this   
   > happened. None of these big seq numbers appear in any prior log   
   > messages.   
   > 1191864251 never shows up as a seq number in B's messages to A.   
   >   
   > -why B then starts to send to A pkgs starting from seq number 1?   
   > Looks like a resend? Why this happens? Thanks   
   >   
   > A > B: P 3286598003:3286598051(48) ack 1191864251 win 65535   
   >    
   > B > A:  P 1:16(15) ack 48 win 65535  2253170396>   
   > A > B: . ack 16 win 65535    
   > B > A: P 48:65(17) ack 16 win 65535  1200125699>   
   > A > B:  P 16:199(183) ack 65 win 65535  2253170397>   
   > B > A:  P 65:211(146) ack 199 win 65535  1200125700>   
      
   By default, tcpdump shows the absolute sequence numbers only in the   
   first segment of a connection in each direction.  Subsequent segments   
   are displayed using sequence numbers relative to the initial sequence   
   number.   
      
   You can use the -S option to make it display absolute sequence numbers   
   all the time.   
      
   --   
   Barry Margolin, barmar@alum.mit.edu   
   Arlington, MA   
   *** PLEASE don't copy me on replies, I'll read them in the group ***   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)