On 7 November 2012 17:35, Nick Bright <nick.bright_at_valnet.net> wrote:
> On the web server that should be receiving the hit, tcpdump reports:
>
> 16:31:21.283309 IP 64.254.49.2.33315 > 64.254.32.23.http: Flags [S], seq
> 4294319084, win 14600, options [mss 1460,sackOK,TS val 11023544 ecr
> 0,nop,wscale 7], length 0
> 16:31:21.283415 IP 64.254.32.23.http > 64.254.49.2.33315: Flags [S.], seq
> 2198086634, ack 4294319085, win 14480, options [mss 1460,sackOK,TS val
> 2023464600 ecr 11023544,nop,wscale 7], length 0
> 16:31:22.282510 IP 64.254.32.23.http > 64.254.49.2.33315: Flags [S.], seq
> 2198086634, ack 4294319085, win 14480, options [mss 1460,sackOK,TS val
> 2023465600 ecr 11023544,nop,wscale 7], length 0
>
> (this repeats several times, in what I would presume are browser retries)
At any point do you get
<timestamp> IP 64.254.49.2.33315 > 64.253.32.23.http: Flags [.] <rest of line>
It looks like no return ACK is being sent from the client, without the
3WHS you're never going to see a connection in the Apache logs.
kmw
Received on Wed Nov 07 2012 - 22:41:44 MST
This archive was generated by hypermail 2.2.0 : Thu Nov 08 2012 - 12:00:03 MST