4bf36a0e   
   From: rick.jones2@hp.com   
      
   adirtymindisajoyforever  wrote:   
   > And traces are taken on the senders side.   
      
   > strace shows connect at time T, trace in tcpdump show SYN at T + 3   
   > seconds.   
      
   Is the ARP cache above or below the packet capture point?  If these   
   are all to the same destiantion, and there was no ARP entry, perhaps   
   some of them got tossed at the ARP resolution and what is being seen   
   is the retransmission.   
      
   rick jones   
   --   
   I don't interest myself in "why". I think more often in terms of   
   "when", sometimes "where"; always "how much."  - Joubert   
   these opinions are mine, all mine; HP might not want them anyway... :)   
   feel free to post, OR email to rick.jones2 in hp.com but NOT BOTH...   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)