linux tcp retransmit timeout weirdness

Hello all,

I'm trying to debug a networking issue and could use some help from the
expert community. The problem I'm experiencing is that large emails
being sent from a linux server to a windows exchange server (crossing a
Cisco PIX firewall) are taking hours to be delivered. I ran a tcpdump
on the linux server to see what's going on underneath the covers and
noticed some strange behavior in the tcp stack. It seems that after
transmitting 3 large segments to the exchange server, the ACK from the
exchange server gets lost/dropped. However, instead of retransmitting
right away the linux server waits a full 23 seconds before
retransmitting the first of the 3 large segments. Immediately after the
retransmit occurs, the ACK arrives from the exchange server and the
linux server transmits a few more large segments before another ACK
gets dropped and the linux server waits an even longer 35 seconds
before retransmitting.

Does this seem like a bug in the tcp stack implementation, or can
somebody come up with an explanation for the long retransmit timeouts.
Note that this is happening during the DATA command of the SMTP session
so mail is flowing unidirectional from the linux server to the
exchange. For those that want to analyze further, I've provided some of
the tcpdump output at the end of this message. The linux server is
running on a 2.4.21-15 RHEL3 kernel and Broadcom Gigabit 5703 ethernet
card using the tigon3 network driver.

Thanks in advance,

Regards,
Kai-Min Sung

-----start tcpdump-----
12:24:18.332435 IP 192.168.201.237.40042 > 10.1.0.62.smtp: S
3753760098:3753760098(0) win 5840 <mss 1460,sackOK,timestamp 63047420
0,nop,wscale 0>
12:24:18.332800 IP 10.1.0.62.smtp > 192.168.201.237.40042: S
83930582:83930582(0) ack 3753760099 win 65535 <mss 1380,nop,wscale
0,nop,nop,timestamp 0 0,nop,nop,sackOK>
12:24:18.332864 IP 192.168.201.237.40042 > 10.1.0.62.smtp: . ack 1 win
5840 <nop,nop,timestamp 63047420 0>
12:24:18.333253 IP 10.1.0.62.smtp > 192.168.201.237.40042: P 1:130(129)
ack 1 win 65535 <nop,nop,timestamp 12991866 63047420>
12:24:18.333285 IP 192.168.201.237.40042 > 10.1.0.62.smtp: . ack 130
win 6432 <nop,nop,timestamp 63047420 12991866>
12:24:18.333399 IP 192.168.201.237.40042 > 10.1.0.62.smtp: P 1:32(31)
ack 130 win 6432 <nop,nop,timestamp 63047420 12991866>
12:24:18.333661 IP 10.1.0.62.smtp > 192.168.201.237.40042: P
130:162(32) ack 32 win 65504 <nop,nop,timestamp 12991866 63047420>
12:24:18.333703 IP 192.168.201.237.40042 > 10.1.0.62.smtp: P 32:63(31)
ack 162 win 6432 <nop,nop,timestamp 63047420 12991866>
12:24:18.333961 IP 10.1.0.62.smtp > 192.168.201.237.40042: P
162:220(58) ack 63 win 65473 <nop,nop,timestamp 12991866 63047420>
12:24:18.334722 IP 192.168.201.237.40042 > 10.1.0.62.smtp: P 63:97(34)
ack 220 win 6432 <nop,nop,timestamp 63047420 12991866>
12:24:18.335301 IP 10.1.0.62.smtp > 192.168.201.237.40042: P
220:265(45) ack 97 win 65439 <nop,nop,timestamp 12991866 63047420>
12:24:18.335713 IP 192.168.201.237.40042 > 10.1.0.62.smtp: P 97:133(36)
ack 265 win 6432 <nop,nop,timestamp 63047420 12991866>
12:24:18.336046 IP 10.1.0.62.smtp > 192.168.201.237.40042: P
265:302(37) ack 133 win 65403 <nop,nop,timestamp 12991866 63047420>
12:24:18.336112 IP 192.168.201.237.40042 > 10.1.0.62.smtp: P 133:139(6)
ack 302 win 6432 <nop,nop,timestamp 63047420 12991866>
12:24:18.336950 IP 10.1.0.62.smtp > 192.168.201.237.40042: P
302:348(46) ack 139 win 65397 <nop,nop,timestamp 12991866 63047420>
12:24:18.337586 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
139:1507(1368) ack 348 win 6432 <nop,nop,timestamp 63047421 12991866>
12:24:18.337600 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
1507:2875(1368) ack 348 win 6432 <nop,nop,timestamp 63047421 12991866>
12:24:18.337611 IP 192.168.201.237.40042 > 10.1.0.62.smtp: P
2875:4235(1360) ack 348 win 6432 <nop,nop,timestamp 63047421 12991866>
12:24:41.296695 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
139:1507(1368) ack 348 win 6432 <nop,nop,timestamp 63049717 12991866>
12:24:41.297318 IP 10.1.0.62.smtp > 192.168.201.237.40042: . ack 2875
win 65535 <nop,nop,timestamp 12992096 63047421>
12:24:41.297341 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
4235:5603(1368) ack 348 win 6432 <nop,nop,timestamp 63049717 12992096>
12:24:41.297351 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
5603:6971(1368) ack 348 win 6432 <nop,nop,timestamp 63049717 12992096>
12:24:41.297359 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
6971:8339(1368) ack 348 win 6432 <nop,nop,timestamp 63049717 12992096>
12:24:41.298178 IP 10.1.0.62.smtp > 192.168.201.237.40042: . ack 2875
win 65535 <nop,nop,timestamp 12992096 63047421,nop,nop,sack sack 2
{6971:8339}{4235:5603} >
12:24:41.298192 IP 192.168.201.237.40042 > 10.1.0.62.smtp: P
2875:4235(1360) ack 348 win 6432 <nop,nop,timestamp 63049717 12992096>
12:24:41.298863 IP 10.1.0.62.smtp > 192.168.201.237.40042: . ack 5603
win 65535 <nop,nop,timestamp 12992096 63049717,nop,nop,sack sack 1
{6971:8339} >
12:25:16.696694 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
5603:6971(1368) ack 348 win 6432 <nop,nop,timestamp 63053257 12992096>
12:25:16.697338 IP 10.1.0.62.smtp > 192.168.201.237.40042: . ack 8339
win 65535 <nop,nop,timestamp 12992449 63053257>
12:25:16.697379 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
8339:9707(1368) ack 348 win 6432 <nop,nop,timestamp 63053257 12992449>
12:25:16.697390 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
9707:11075(1368) ack 348 win 6432 <nop,nop,timestamp 63053257 12992449>
12:25:16.697996 IP 10.1.0.62.smtp > 192.168.201.237.40042: . ack 9707
win 64167 <nop,nop,timestamp 12992449 63053257>
12:25:16.698009 IP 192.168.201.237.40042 > 10.1.0.62.smtp: P
11075:12443(1368) ack 348 win 6432 <nop,nop,timestamp 63053257
12992449>
12:25:16.698019 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
12443:13811(1368) ack 348 win 6432 <nop,nop,timestamp 63053257
12992449>
12:25:49.696700 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
9707:11075(1368) ack 348 win 6432 <nop,nop,timestamp 63056557 12992449>
12:25:49.697337 IP 10.1.0.62.smtp > 192.168.201.237.40042: . ack 12443
win 65535 <nop,nop,timestamp 12992780 63053257>
12:25:49.697366 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
13811:15179(1368) ack 348 win 6432 <nop,nop,timestamp 63056557
12992780>
12:25:49.697376 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
15179:16547(1368) ack 348 win 6432 <nop,nop,timestamp 63056557
12992780>
12:25:49.697387 IP 192.168.201.237.40042 > 10.1.0.62.smtp: P
16547:17915(1368) ack 348 win 6432 <nop,nop,timestamp 63056557
12992780>
12:25:49.698208 IP 10.1.0.62.smtp > 192.168.201.237.40042: . ack 12443
win 65535 <nop,nop,timestamp 12992780 63053257,nop,nop,sack sack 2
{16547:17915}{13811:15179} >
12:25:49.698228 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
12443:13811(1368) ack 348 win 6432 <nop,nop,timestamp 63056557
12992780>
12:25:49.698848 IP 10.1.0.62.smtp > 192.168.201.237.40042: . ack 15179
win 65535 <nop,nop,timestamp 12992780 63056557,nop,nop,sack sack 1
{16547:17915} >
12:26:41.356702 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
15179:16547(1368) ack 348 win 6432 <nop,nop,timestamp 63061723
12992780>
12:28:24.676703 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
15179:16547(1368) ack 348 win 6432 <nop,nop,timestamp 63072055
12992780>
12:28:24.677378 IP 10.1.0.62.smtp > 192.168.201.237.40042: . ack 17915
win 65535 <nop,nop,timestamp 12994329 63072055>
12:28:24.677401 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
17915:19283(1368) ack 348 win 6432 <nop,nop,timestamp 63072055
12994329>
12:28:24.677412 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
19283:20651(1368) ack 348 win 6432 <nop,nop,timestamp 63072055
12994329>
12:28:24.678138 IP 10.1.0.62.smtp > 192.168.201.237.40042: . ack 20651
win 65535 <nop,nop,timestamp 12994329 63072055>
12:28:24.678151 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
20651:22019(1368) ack 348 win 6432 <nop,nop,timestamp 63072055
12994329>
12:28:24.678161 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
22019:23387(1368) ack 348 win 6432 <nop,nop,timestamp 63072055
12994329>
12:28:24.678169 IP 192.168.201.237.40042 > 10.1.0.62.smtp: P
23387:24755(1368) ack 348 win 6432 <nop,nop,timestamp 63072055
12994329>
12:29:12.886695 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
20651:22019(1368) ack 348 win 6432 <nop,nop,timestamp 63076876
12994329>
12:29:12.887289 IP 10.1.0.62.smtp > 192.168.201.237.40042: . ack 23387
win 65535 <nop,nop,timestamp 12994812 63072055>
12:29:12.887307 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
24755:26123(1368) ack 348 win 6432 <nop,nop,timestamp 63076876
12994812>
12:29:12.887316 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
26123:27491(1368) ack 348 win 6432 <nop,nop,timestamp 63076876
12994812>
12:29:12.887326 IP 192.168.201.237.40042 > 10.1.0.62.smtp: .
27491:28859(1368) ack 348 win 6432 <nop,nop,timestamp 63076876
12994812>
-----end tcpdump -----

(E-Mail Removed) écrivait news:1123324251.363471.318040
@g49g2000cwa.googlegroups.com:
> noticed some strange behavior in the tcp stack. It seems that after
> transmitting 3 large segments to the exchange server, the ACK from the
> exchange server gets lost/dropped. However, instead of retransmitting
> right away the linux server waits a full 23 seconds before
> retransmitting the first of the 3 large segments. Immediately after the
> retransmit occurs, the ACK arrives from the exchange server and the
> linux server transmits a few more large segments before another ACK
> gets dropped and the linux server waits an even longer 35 seconds
> before retransmitting.

It seems normal for the tcp protocol. When an ack packet is not received,
the packet is resend after a start delay, but if no ack come back again
the delay before the second resend is increased (and so for far), until
the connection is defined as broken.

I don't know the start delay.

It seems that your connexion is not stable or you don't have enought
bandwidth.

What is your connection type (ethernet, adsl, ...) ? Bandwidth ?


Regards

Hi Antoine,

I thought the retransmits happened in the order of nano/milli-seconds,
not in the order of seconds. This is happening on a local area
network, 10/100Mbps speeds. It's going through a firewall, which could
be what's causing the packets to be dropped. However, irrespective of
the external network conditions, the local tcp stack seems to be acting
funny here with the extremely long retransmits.

Regards,
-Kai

<(E-Mail Removed)> wrote in message
news:(E-Mail Removed) oups.com...
> Hi Antoine,
>
> I thought the retransmits happened in the order of nano/milli-seconds,
> not in the order of seconds. This is happening on a local area
> network, 10/100Mbps speeds. It's going through a firewall, which could
> be what's causing the packets to be dropped. However, irrespective of
> the external network conditions, the local tcp stack seems to be acting
> funny here with the extremely long retransmits.

Where was the trace you posted taken? Is it from the sending side?
Receiving side?

DS

That was taken from the sending side. Below is the trace taken from
the receiving side. You'll notice bad cksum errors for the packet sent
by the receiver. Those are because the trace was taken using ethereal
and there's a known bug when the checksum calculation is offloaded in
the NIC card.

Regards,
-Kai

-----start tcpdump-----
12:27:28.451192 IP (tos 0x0, ttl 64, id 54174, offset 0, flags [DF],
proto 6, length: 60) 192.168.201.237.40042 > 10.1.0.62.smtp: S [tcp sum
ok] 3753760098:3753760098(0) win 5840 <mss 1380,sackOK,timestamp
63047420 0,nop,wscale 0>
12:27:28.451242 IP (tos 0x0, ttl 128, id 28723, offset 0, flags [DF],
proto 6, length: 64, bad cksum 0 (->f5af)!) 10.1.0.62.smtp >
192.168.201.237.40042: S [tcp sum ok] 3380812001:3380812001(0) ack
3753760099 win 65535 <mss 1460,nop,wscale 0,nop,nop,timestamp 0
0,nop,nop,sackOK>
12:27:28.451519 IP (tos 0x0, ttl 64, id 54175, offset 0, flags [DF],
proto 6, length: 52) 192.168.201.237.40042 > 10.1.0.62.smtp: . [tcp sum
ok] 1:1(0) ack 1 win 5840 <nop,nop,timestamp 63047420 0>
12:27:28.451659 IP (tos 0x0, ttl 128, id 28724, offset 0, flags [DF],
proto 6, length: 181, bad cksum 0 (->f539)!) 10.1.0.62.smtp >
192.168.201.237.40042: P [bad tcp cksum 957c (->2a3)!] 1:130(129) ack 1
win 65535 <nop,nop,timestamp 12991866 63047420>
12:27:28.451933 IP (tos 0x0, ttl 64, id 54176, offset 0, flags [DF],
proto 6, length: 52) 192.168.201.237.40042 > 10.1.0.62.smtp: . [tcp sum
ok] 1:1(0) ack 130 win 6432 <nop,nop,timestamp 63047420 12991866>
12:27:28.452061 IP (tos 0x0, ttl 64, id 54177, offset 0, flags [DF],
proto 6, length: 83) 192.168.201.237.40042 > 10.1.0.62.smtp: P [tcp sum
ok] 1:32(31) ack 130 win 6432 <nop,nop,timestamp 63047420 12991866>
12:27:28.452117 IP (tos 0x0, ttl 128, id 28725, offset 0, flags [DF],
proto 6, length: 84, bad cksum 0 (->f599)!) 10.1.0.62.smtp >
192.168.201.237.40042: P [bad tcp cksum 951b (->8938)!] 130:162(32) ack
32 win 65504 <nop,nop,timestamp 12991866 63047420>
12:27:28.452360 IP (tos 0x0, ttl 64, id 54178, offset 0, flags [DF],
proto 6, length: 83) 192.168.201.237.40042 > 10.1.0.62.smtp: P [tcp sum
ok] 32:63(31) ack 162 win 6432 <nop,nop,timestamp 63047420 12991866>
12:27:28.452413 IP (tos 0x0, ttl 128, id 28726, offset 0, flags [DF],
proto 6, length: 110, bad cksum 0 (->f57e)!) 10.1.0.62.smtp >
192.168.201.237.40042: P [bad tcp cksum 9535 (->487)!] 162:220(58) ack
63 win 65473 <nop,nop,timestamp 12991866 63047420>
12:27:28.453387 IP (tos 0x0, ttl 64, id 54179, offset 0, flags [DF],
proto 6, length: 86) 192.168.201.237.40042 > 10.1.0.62.smtp: P [tcp sum
ok] 63:97(34) ack 220 win 6432 <nop,nop,timestamp 63047420 12991866>
12:27:28.453751 IP (tos 0x0, ttl 128, id 28727, offset 0, flags [DF],
proto 6, length: 97, bad cksum 0 (->f58a)!) 10.1.0.62.smtp >
192.168.201.237.40042: P [bad tcp cksum 9528 (->d0e1)!] 220:265(45) ack
97 win 65439 <nop,nop,timestamp 12991866 63047420>
12:27:28.454379 IP (tos 0x0, ttl 64, id 54180, offset 0, flags [DF],
proto 6, length: 88) 192.168.201.237.40042 > 10.1.0.62.smtp: P [tcp sum
ok] 97:133(36) ack 265 win 6432 <nop,nop,timestamp 63047420 12991866>
12:27:28.454501 IP (tos 0x0, ttl 128, id 28728, offset 0, flags [DF],
proto 6, length: 89, bad cksum 0 (->f591)!) 10.1.0.62.smtp >
192.168.201.237.40042: P [bad tcp cksum 9520 (->99c4)!] 265:302(37) ack
133 win 65403 <nop,nop,timestamp 12991866 63047420>
12:27:28.454766 IP (tos 0x0, ttl 64, id 54181, offset 0, flags [DF],
proto 6, length: 58) 192.168.201.237.40042 > 10.1.0.62.smtp: P [tcp sum
ok] 133:139(6) ack 302 win 6432 <nop,nop,timestamp 63047420 12991866>
12:27:28.455399 IP (tos 0x0, ttl 128, id 28729, offset 0, flags [DF],
proto 6, length: 98, bad cksum 0 (->f587)!) 10.1.0.62.smtp >
192.168.201.237.40042: P [bad tcp cksum 9529 (->37a8)!] 302:348(46) ack
139 win 65397 <nop,nop,timestamp 12991866 63047420>
12:27:28.456623 IP (tos 0x0, ttl 64, id 54182, offset 0, flags [DF],
proto 6, length: 1420) 192.168.201.237.40042 > 10.1.0.62.smtp: . [tcp
sum ok] 139:1507(1368) ack 348 win 6432 <nop,nop,timestamp 63047421
12991866>
12:27:28.456740 IP (tos 0x0, ttl 64, id 54183, offset 0, flags [DF],
proto 6, length: 1420) 192.168.201.237.40042 > 10.1.0.62.smtp: . [tcp
sum ok] 1507:2875(1368) ack 348 win 6432 <nop,nop,timestamp 63047421
12991866>
12:27:28.456759 IP (tos 0x0, ttl 128, id 28730, offset 0, flags [DF],
proto 6, length: 52, bad cksum 0 (->f5b4)!) 10.1.0.62.smtp >
192.168.201.237.40042: . [bad tcp cksum 94fb (->5849)!] 348:348(0) ack
2875 win 65535 <nop,nop,timestamp 12991866 63047421>
12:27:51.414943 IP (tos 0x0, ttl 64, id 54185, offset 0, flags [DF],
proto 6, length: 1420) 192.168.201.237.40042 > 10.1.0.62.smtp: . [tcp
sum ok] 139:1507(1368) ack 348 win 6432 <nop,nop,timestamp 63049717
12991866>
12:27:51.414970 IP (tos 0x0, ttl 128, id 29453, offset 0, flags [DF],
proto 6, length: 52, bad cksum 0 (->f2e1)!) 10.1.0.62.smtp >
192.168.201.237.40042: . [bad tcp cksum 94fb (->5763)!] 348:348(0) ack
2875 win 65535 <nop,nop,timestamp 12992096 63047421>
12:27:51.415579 IP (tos 0x0, ttl 64, id 54186, offset 0, flags [DF],
proto 6, length: 1420) 192.168.201.237.40042 > 10.1.0.62.smtp: . [tcp
sum ok] 4235:5603(1368) ack 348 win 6432 <nop,nop,timestamp 63049717
12992096>
12:27:51.415597 IP (tos 0x0, ttl 128, id 29454, offset 0, flags [DF],
proto 6, length: 64, bad cksum 0 (->f2d4)!) 10.1.0.62.smtp >
192.168.201.237.40042: . [bad tcp cksum 9507 (->909c)!] 348:348(0) ack
2875 win 65535 <nop,nop,timestamp 12992096 63047421,nop,nop,sack sack 1
{4235:5603} >
12:27:51.415817 IP (tos 0x0, ttl 64, id 54188, offset 0, flags [DF],
proto 6, length: 1420) 192.168.201.237.40042 > 10.1.0.62.smtp: . [tcp
sum ok] 6971:8339(1368) ack 348 win 6432 <nop,nop,timestamp 63049717
12992096>
12:27:51.415838 IP (tos 0x0, ttl 128, id 29455, offset 0, flags [DF],
proto 6, length: 72, bad cksum 0 (->f2cb)!) 10.1.0.62.smtp >
192.168.201.237.40042: . [bad tcp cksum 950f (->ca7c)!] 348:348(0) ack
2875 win 65535 <nop,nop,timestamp 12992096 63047421,nop,nop,sack sack 2
{6971:8339}{4235:5603} >
12:27:51.416434 IP (tos 0x0, ttl 64, id 54189, offset 0, flags [DF],
proto 6, length: 1412) 192.168.201.237.40042 > 10.1.0.62.smtp: P [tcp
sum ok] 2875:4235(1360) ack 348 win 6432 <nop,nop,timestamp 63049717
12992096>
12:27:51.416513 IP (tos 0x0, ttl 128, id 29456, offset 0, flags [DF],
proto 6, length: 64, bad cksum 0 (->f2d2)!) 10.1.0.62.smtp >
192.168.201.237.40042: . [bad tcp cksum 9507 (->679c)!] 348:348(0) ack
5603 win 65535 <nop,nop,timestamp 12992096 63049717,nop,nop,sack sack 1
{6971:8339} >
12:28:26.813369 IP (tos 0x0, ttl 64, id 54190, offset 0, flags [DF],
proto 6, length: 1420) 192.168.201.237.40042 > 10.1.0.62.smtp: . [tcp
sum ok] 5603:6971(1368) ack 348 win 6432 <nop,nop,timestamp 63053257
12992096>
12:28:26.813417 IP (tos 0x0, ttl 128, id 30910, offset 0, flags [DF],
proto 6, length: 52, bad cksum 0 (->ed30)!) 10.1.0.62.smtp >
192.168.201.237.40042: . [bad tcp cksum 94fb (->29de)!] 348:348(0) ack
8339 win 65535 <nop,nop,timestamp 12992449 63053257>
12:28:26.814041 IP (tos 0x0, ttl 64, id 54191, offset 0, flags [DF],
proto 6, length: 1420) 192.168.201.237.40042 > 10.1.0.62.smtp: . [tcp
sum ok] 8339:9707(1368) ack 348 win 6432 <nop,nop,timestamp 63053257
12992449>
12:28:26.814086 IP (tos 0x0, ttl 128, id 30911, offset 0, flags [DF],
proto 6, length: 52, bad cksum 0 (->ed2f)!) 10.1.0.62.smtp >
192.168.201.237.40042: . [bad tcp cksum 94fb (->29de)!] 348:348(0) ack
9707 win 64167 <nop,nop,timestamp 12992449 63053257>
12:28:26.814154 IP (tos 0x0, ttl 64, id 54192, offset 0, flags [DF],
proto 6, length: 1420) 192.168.201.237.40042 > 10.1.0.62.smtp: . [tcp
sum ok] 9707:11075(1368) ack 348 win 6432 <nop,nop,timestamp 63053257
12992449>
12:28:26.814662 IP (tos 0x0, ttl 64, id 54193, offset 0, flags [DF],
proto 6, length: 1420) 192.168.201.237.40042 > 10.1.0.62.smtp: P [tcp
sum ok] 11075:12443(1368) ack 348 win 6432 <nop,nop,timestamp 63053257
12992449>
12:28:26.814684 IP (tos 0x0, ttl 128, id 30912, offset 0, flags [DF],
proto 6, length: 52, bad cksum 0 (->ed2e)!) 10.1.0.62.smtp >
192.168.201.237.40042: . [bad tcp cksum 94fb (->19d6)!] 348:348(0) ack
12443 win 65535 <nop,nop,timestamp 12992449 63053257>
12:28:59.811231 IP (tos 0x0, ttl 64, id 54195, offset 0, flags [DF],
proto 6, length: 1420) 192.168.201.237.40042 > 10.1.0.62.smtp: . [tcp
sum ok] 9707:11075(1368) ack 348 win 6432 <nop,nop,timestamp 63056557
12992449>
12:28:59.811264 IP (tos 0x0, ttl 128, id 32522, offset 0, flags [DF],
proto 6, length: 52, bad cksum 0 (->e6e4)!) 10.1.0.62.smtp >
192.168.201.237.40042: . [bad tcp cksum 94fb (->188b)!] 348:348(0) ack
12443 win 65535 <nop,nop,timestamp 12992780 63053257>
12:28:59.811878 IP (tos 0x0, ttl 64, id 54196, offset 0, flags [DF],
proto 6, length: 1420) 192.168.201.237.40042 > 10.1.0.62.smtp: . [tcp
sum ok] 13811:15179(1368) ack 348 win 6432 <nop,nop,timestamp 63056557
12992780>
12:28:59.811910 IP (tos 0x0, ttl 128, id 32523, offset 0, flags [DF],
proto 6, length: 64, bad cksum 0 (->e6d7)!) 10.1.0.62.smtp >
192.168.201.237.40042: . [bad tcp cksum 9507 (->6f4)!] 348:348(0) ack
12443 win 65535 <nop,nop,timestamp 12992780 63053257,nop,nop,sack sack
1 {13811:15179} >
12:28:59.812120 IP (tos 0x0, ttl 64, id 54198, offset 0, flags [DF],
proto 6, length: 1420) 192.168.201.237.40042 > 10.1.0.62.smtp: P [tcp
sum ok] 16547:17915(1368) ack 348 win 6432 <nop,nop,timestamp 63056557
12992780>
12:28:59.812142 IP (tos 0x0, ttl 128, id 32524, offset 0, flags [DF],
proto 6, length: 72, bad cksum 0 (->e6ce)!) 10.1.0.62.smtp >
192.168.201.237.40042: . [bad tcp cksum 950f (->f603)!] 348:348(0) ack
12443 win 65535 <nop,nop,timestamp 12992780 63053257,nop,nop,sack sack
2 {16547:17915}{13811:15179} >
12:28:59.812737 IP (tos 0x0, ttl 64, id 54199, offset 0, flags [DF],
proto 6, length: 1420) 192.168.201.237.40042 > 10.1.0.62.smtp: . [tcp
sum ok] 12443:13811(1368) ack 348 win 6432 <nop,nop,timestamp 63056557
12992780>
12:28:59.812771 IP (tos 0x0, ttl 128, id 32525, offset 0, flags [DF],
proto 6, length: 64, bad cksum 0 (->e6d5)!) 10.1.0.62.smtp >
192.168.201.237.40042: . [bad tcp cksum 9507 (->d9ff)!] 348:348(0) ack
15179 win 65535 <nop,nop,timestamp 12992780 63056557,nop,nop,sack sack
1 {16547:17915} >
-----end tcpdump-----