Subject: timeout value in TCP implementation

From: kunchanl <[email-masked]>
Date: Sun, 20 Apr 2003 09:57:00 -0700 (PDT)

Hi,

    I've observed quiet a few of connections in my tcpdump trace
has the SYN packet re-transmitted after about 3 seconds (as
the example below). I'm wondering if this 3-second is related
some particular timeout value in some tcp implementaton. Can
anybody shed me some light?

Thanks
Kun-chan Lan

1036626828.477241 10.0.0.1.2355 > 192.168.0.2.80: S 12193306:12193306(0)
win 8192 <mss 1460,nop,nop,sackOK> (DF)
1036626831.460768 10.0.0.1.2355 > 192.168.0.2.80: S 12193306:12193306(0)
win 8192 <mss 1460,nop,nop,sackOK> (DF)
1036626831.784822 10.0.0.1.2355 > 192.168.0.2.80: . ack 3335637810 win
8760 (DF)
1036626831.792048 10.0.0.1.2355 > 192.168.0.2.80: P 0:758(758) ack 1 win
8760 (DF)
1036626831.852406 10.0.0.1.2355 > 192.168.0.2.80: . ack 124 win 8638 (DF)
1036626831.852423 10.0.0.1.2355 > 192.168.0.2.80: R 12194065:12194065(0)
win 0 (DF)

---

From: kunchanl <[email-masked]>
Date: Sun, 20 Apr 2003 10:18:50 -0700 (PDT)

Hi,

     I've observed quiet a few  connections in my tcpdump trace
where the web server waits for 10-15 seconds to send out
FIN packet to close up the connection (in the following example
the web server waits for 10 second before sending out the FIN)

   I'm wondering if this is some kind of bug that ties to
some particular web server or tcp implementation? or it is
something normal?

1036628283.930394 10.0.0.1.3653 > 192.168.0.2.80: S 3207141408:3207141408(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
1036628283.931361 192.168.0.2.80 > 10.0.0.1.3653: S 2876574950:2876574950(0) ack 3207141409 win 5840 <mss 1460,nop,nop,sackOK> (DF)
1036628284.024387 10.0.0.1.3653 > 192.168.0.2.80: . ack 1 win 17520 (DF)
1036628284.053898 10.0.0.1.3653 > 192.168.0.2.80: P 1:388(387) ack 1 win 17520 (DF)
1036628284.055470 192.168.0.2.80 > 10.0.0.1.3653: . ack 388 win 6432 (DF)
1036628284.057227 192.168.0.2.80 > 10.0.0.1.3653: P 1:181(180) ack 388 win 6432 (DF)
1036628284.326158 10.0.0.1.3653 > 192.168.0.2.80: . ack 181 win 17340 (DF)
1036628286.367286 10.0.0.1.3653 > 192.168.0.2.80: P 388:678(290) ack 181 win 17340 (DF)
1036628286.370024 192.168.0.2.80 > 10.0.0.1.3653: P 181:512(331) ack 678 win 7504 (DF)
1036628286.577595 10.0.0.1.3653 > 192.168.0.2.80: . ack 512 win 17009 (DF)
1036628297.384645 192.168.0.2.80 > 10.0.0.1.3653: F 512:512(0) ack 678 win 7504(DF)
1036628297.405154 10.0.0.1.3653 > 192.168.0.2.80: . ack 513 win 17009 (DF)
1036628304.498357 10.0.0.1.3653 > 192.168.0.2.80: R 3207142086:3207142086(0) win 0 (DF)

 Thanks
 Kun-chan Lan