Hello!
> what kind of wickedness from this way came?
19:57:07.234813 > 193.233.7.100.32949 > 204.243.9.36.smtp: S [ECN-Echo,CWR]
3045688343:3045688343(0) win 5840/0 <mss 1460,sackOK,timestamp 685566
0,nop,wscale 0> (DF) (ttl 64, id 0)
19:57:07.470542 < 204.243.9.36.smtp > 193.233.7.100.32949: S
534078928:534078928(0) ack 3045688344 win 0/0 (ttl 49, id 63204)
19:57:07.470612 > 193.233.7.100.32949 > 204.243.9.36.smtp: . 1:1(0) ack 1 win
5840/0 (DF) (ttl 64, id 0)
19:57:07.731885 < 204.243.9.36.smtp > 193.233.7.100.32949: . 1:1(0) ack 1 win
10136/10136 <nop,nop,timestamp 8870901 685566,nop,wscale 0,mss 1460> (DF) (ttl
239, id 38803)
Grrr.... These option set is invalid: wscale, mss can be only with SYN.
Timestamps are not allowed if they were not sent with SYN.
Note that it is the only line, where they happen. 8)
19:57:07.783152 < 204.243.9.36.34420 > 193.233.7.100.auth: S
2858361319:2858361319(0) win 8760/0 <mss 1460> (DF) (ttl 239, id 38804)
19:57:07.783211 > 193.233.7.100.auth > 204.243.9.36.34420: S
3045018596:3045018596(0) ack 2858361320 win 5840/0 <mss 1460> (DF) (ttl 64, id
0)
19:57:08.183993 < 204.243.9.36.34420 > 193.233.7.100.auth: . 1:1(0) ack 1 win
8760/0 (DF) (ttl 239, id 38805)
19:57:08.184642 < 204.243.9.36.34420 > 193.233.7.100.auth: P 1:11(10) ack 1 win
8760/0 (DF) (ttl 239, id 38806)
19:57:08.184736 > 193.233.7.100.auth > 204.243.9.36.34420: . 1:1(0) ack 11 win
5840/10 (DF) (ttl 64, id 0)
19:57:08.223365 > 193.233.7.100.auth > 204.243.9.36.34420: P 1:35(34) ack 11
win 5840/0 (DF) (ttl 64, id 0)
19:57:08.889359 < 204.243.9.36.smtp > 193.233.7.100.32949: P 1:99(98) ack 1 win
10220/84 (DF) (ttl 239, id 38809)
19:57:08.889441 > 193.233.7.100.32949 > 204.243.9.36.smtp: . 1:1(0) ack 99 win
5840/98 (DF) (ttl 64, id 0)
19:57:08.890086 < 204.243.9.36.34420 > 193.233.7.100.auth: . 11:11(0) ack 35
win 8760/34 (DF) (ttl 239, id 38807)
19:57:08.892332 < 204.243.9.36.34420 > 193.233.7.100.auth: F 11:11(0) ack 35
win 8760/0 (DF) (ttl 239, id 38808)
19:57:08.893125 > 193.233.7.100.auth > 204.243.9.36.34420: F 35:35(0) ack 12
win 5840/1 (DF) (ttl 64, id 0)
19:57:09.255579 < 204.243.9.36.34420 > 193.233.7.100.auth: . 12:12(0) ack 36
win 8760/1 (DF) (ttl 239, id 38810)
19:57:16.291821 > 193.233.7.100.32949 > 204.243.9.36.smtp: P 1:12(11) ack 99
win 5840/0 (DF) (ttl 64, id 0)
Alexey
|