On 11/7/2012 4:41 PM, Kevin Wilcox wrote:
> On 7 November 2012 17:35, Nick Bright<nick.bright_at_valnet.net> wrote:
>
>> On the web server that should be receiving the hit, tcpdump reports:
>>
>> 16:31:21.283309 IP 64.254.49.2.33315> 64.254.32.23.http: Flags [S], seq
>> 4294319084, win 14600, options [mss 1460,sackOK,TS val 11023544 ecr
>> 0,nop,wscale 7], length 0
>> 16:31:21.283415 IP 64.254.32.23.http> 64.254.49.2.33315: Flags [S.], seq
>> 2198086634, ack 4294319085, win 14480, options [mss 1460,sackOK,TS val
>> 2023464600 ecr 11023544,nop,wscale 7], length 0
>> 16:31:22.282510 IP 64.254.32.23.http> 64.254.49.2.33315: Flags [S.], seq
>> 2198086634, ack 4294319085, win 14480, options [mss 1460,sackOK,TS val
>> 2023465600 ecr 11023544,nop,wscale 7], length 0
>>
>> (this repeats several times, in what I would presume are browser retries)
>
> At any point do you get
>
> <timestamp> IP 64.254.49.2.33315> 64.253.32.23.http: Flags [.]<rest of line>
>
> It looks like no return ACK is being sent from the client, without the
> 3WHS you're never going to see a connection in the Apache logs.
>
> kmw
>
I don't see any output from tcpdump that has a "Flags [.]", they are all
"Flags [S.]" or "Flags [S]".
Thanks,
-- ----------------------------------------------- - Nick Bright - - Vice President of Technology - - Valnet -=- We Connect You -=- - - Tel 888-332-1616 x 315 / Fax 620-331-0789 - - Web http://www.valnet.net/ - ----------------------------------------------- - Are your files safe? - - Valnet Vault - Secure Cloud Backup - - More information & 30 day free trial at - - http://www.valnet.net/services/valnet-vault - -----------------------------------------------
This archive was generated by hypermail 2.2.0 : Thu Nov 08 2012 - 12:00:03 MST