> > Rocco Scappatura: > > > 12:31:06.808714 O client.1395 > server.25: . 1931191:1932551(1360) > > ack > > > 358 win 65178 (DF) > > > > Can you show the TCP handshake (SYN/SYN+ACK/ACK) with TCP options. > > You are right, there is no TCP option. I will try to dump another SMTP > session. This time directly on mail gateway server with command: > > # tcpdump -s 0 -w /var/dump host <client> and port 25
Here the tcpdump output of a typical failing transaction (I see a lot of duplicate ack): ncr_ccl > smtp [SYN] Seq=0 Win=65535 Len=0 MSS=1360 smtp > ncr_ccl [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1460 ncr_ccl > smtp [ACK] Seq=1 Ack=1 Win=65535 Len=0 smtp > ncr_ccl [ACK] Seq=20 Ack=13 Win=5840 Len=0 ncr_ccl > smtp [ACK] Seq=51 Ack=53 Win=65483 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=1541 Win=8160 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=2901 Win=10880 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=4261 Win=13600 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=5621 Win=16320 Len=0 [TCP Dup ACK 28#1] smtp > ncr_ccl [ACK] Seq=195 Ack=5621 Win=16320 Len=0 SLE=6981 SRE=8341 [TCP Dup ACK 28#2] smtp > ncr_ccl [ACK] Seq=195 Ack=5621 Win=16320 Len=0 SLE=6981 SRE=9701 [TCP Dup ACK 28#3] smtp > ncr_ccl [ACK] Seq=195 Ack=5621 Win=16320 Len=0 SLE=6981 SRE=11061 [TCP Dup ACK 28#4] smtp > ncr_ccl [ACK] Seq=195 Ack=5621 Win=16320 Len=0 SLE=6981 SRE=12421 [TCP Dup ACK 28#5] smtp > ncr_ccl [ACK] Seq=195 Ack=5621 Win=16320 Len=0 SLE=6981 SRE=13781 [TCP Dup ACK 28#6] smtp > ncr_ccl [ACK] Seq=195 Ack=5621 Win=16320 Len=0 SLE=6981 SRE=15141 [TCP Dup ACK 28#7] smtp > ncr_ccl [ACK] Seq=195 Ack=5621 Win=16320 Len=0 SLE=6981 SRE=16501 [TCP Dup ACK 28#8] smtp > ncr_ccl [ACK] Seq=195 Ack=5621 Win=16320 Len=0 SLE=6981 SRE=17861 [TCP Dup ACK 28#9] smtp > ncr_ccl [ACK] Seq=195 Ack=5621 Win=16320 Len=0 SLE=6981 SRE=19221 [TCP Dup ACK 28#10] smtp > ncr_ccl [ACK] Seq=195 Ack=5621 Win=16320 Len=0 SLE=6981 SRE=20581 [TCP Dup ACK 28#11] smtp > ncr_ccl [ACK] Seq=195 Ack=5621 Win=16320 Len=0 SLE=6981 SRE=21941 smtp > ncr_ccl [ACK] Seq=195 Ack=21941 Win=19040 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=23301 Win=21760 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=24661 Win=24480 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=26021 Win=27200 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=27381 Win=29920 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=28741 Win=32640 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=30101 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=31461 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=32821 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=32949 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=34309 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=35669 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=37029 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=38389 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=39749 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=41109 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=42469 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=43829 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=45189 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=46549 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=47909 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=49269 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=50629 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=51989 Win=32767 Len=0 [TCP Dup ACK 98#1] smtp > ncr_ccl [ACK] Seq=195 Ack=51989 Win=32767 Len=0 SLE=53349 SRE=54709 [TCP Dup ACK 98#2] smtp > ncr_ccl [ACK] Seq=195 Ack=51989 Win=32767 Len=0 SLE=56069 SRE=57429 SLE=53349 SRE=54709 [TCP Dup ACK 98#3] smtp > ncr_ccl [ACK] Seq=195 Ack=51989 Win=32767 Len=0 SLE=56069 SRE=58789 SLE=53349 SRE=54709 [TCP Dup ACK 98#4] smtp > ncr_ccl [ACK] Seq=195 Ack=51989 Win=32767 Len=0 SLE=56069 SRE=60149 SLE=53349 SRE=54709 [TCP Dup ACK 98#5] smtp > ncr_ccl [ACK] Seq=195 Ack=51989 Win=32767 Len=0 SLE=56069 SRE=61509 SLE=53349 SRE=54709 [TCP Dup ACK 98#6] smtp > ncr_ccl [ACK] Seq=195 Ack=51989 Win=32767 Len=0 SLE=56069 SRE=62869 SLE=53349 SRE=54709 [TCP Dup ACK 98#7] smtp > ncr_ccl [ACK] Seq=195 Ack=51989 Win=32767 Len=0 SLE=56069 SRE=64229 SLE=53349 SRE=54709 [TCP Dup ACK 98#8] smtp > ncr_ccl [ACK] Seq=195 Ack=51989 Win=32767 Len=0 SLE=56069 SRE=65589 SLE=53349 SRE=54709 smtp > ncr_ccl [ACK] Seq=195 Ack=54709 Win=32767 Len=0 SLE=56069 SRE=65589 smtp > ncr_ccl [ACK] Seq=195 Ack=65589 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=65717 Win=32767 Len=0 [TCP Dup ACK 120#1] smtp > ncr_ccl [ACK] Seq=195 Ack=65717 Win=32767 Len=0 SLE=67077 SRE=68437 [TCP Dup ACK 120#2] smtp > ncr_ccl [ACK] Seq=195 Ack=65717 Win=32767 Len=0 SLE=67077 SRE=69797 [TCP Dup ACK 120#3] smtp > ncr_ccl [ACK] Seq=195 Ack=65717 Win=32767 Len=0 SLE=67077 SRE=71157 [TCP Dup ACK 120#4] smtp > ncr_ccl [ACK] Seq=195 Ack=65717 Win=32767 Len=0 SLE=67077 SRE=72517 smtp > ncr_ccl [ACK] Seq=195 Ack=72517 Win=32767 Len=0 [TCP Dup ACK 130#1] smtp > ncr_ccl [ACK] Seq=195 Ack=72517 Win=32767 Len=0 SLE=73877 SRE=75237 [TCP Dup ACK 130#2] smtp > ncr_ccl [ACK] Seq=195 Ack=72517 Win=32767 Len=0 SLE=73877 SRE=76597 smtp > ncr_ccl [ACK] Seq=195 Ack=76597 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=77957 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=79317 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=80677 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=82037 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=83397 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=84757 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=86117 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=87477 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=88837 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=90197 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=91557 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=92917 Win=32767 Len=0 [TCP Dup ACK 160#1] smtp > ncr_ccl [ACK] Seq=195 Ack=92917 Win=32767 Len=0 SLE=94277 SRE=95637 [TCP Dup ACK 160#2] smtp > ncr_ccl [ACK] Seq=195 Ack=92917 Win=32767 Len=0 SLE=96997 SRE=98357 SLE=94277 SRE=95637 [TCP Dup ACK 160#3] smtp > ncr_ccl [ACK] Seq=195 Ack=92917 Win=32767 Len=0 SLE=96997 SRE=98485 SLE=94277 SRE=95637 smtp > ncr_ccl [ACK] Seq=195 Ack=95637 Win=32767 Len=0 SLE=96997 SRE=98485 smtp > ncr_ccl [ACK] Seq=195 Ack=98485 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=99845 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=101205 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=102565 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=103925 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=105285 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=106645 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=108005 Win=32767 Len=0 [TCP Dup ACK 184#1] smtp > ncr_ccl [ACK] Seq=195 Ack=108005 Win=32767 Len=0 SLE=109365 SRE=110725 [TCP Dup ACK 184#2] smtp > ncr_ccl [ACK] Seq=195 Ack=108005 Win=32767 Len=0 SLE=109365 SRE=112085 [TCP Dup ACK 184#3] smtp > ncr_ccl [ACK] Seq=195 Ack=108005 Win=32767 Len=0 SLE=109365 SRE=113445 [TCP Dup ACK 184#4] smtp > ncr_ccl [ACK] Seq=195 Ack=108005 Win=32767 Len=0 SLE=109365 SRE=114805 smtp > ncr_ccl [ACK] Seq=195 Ack=114805 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=116165 Win=32767 Len=0 smtp > ncr_ccl [ACK] Seq=195 Ack=117525 Win=32767 Len=0 . . . smtp > mpfoncl [ACK] Seq=195 Ack=3126741 Win=32767 Len=0 smtp > mpfoncl [ACK] Seq=195 Ack=3129461 Win=32767 Len=0 smtp > mpfoncl [ACK] Seq=195 Ack=3132181 Win=32767 Len=0 smtp > mpfoncl [ACK] Seq=195 Ack=3134901 Win=32767 Len=0 smtp > mpfoncl [ACK] Seq=195 Ack=3137621 Win=32767 Len=0 [TCP Dup ACK 7753#1] smtp > mpfoncl [ACK] Seq=195 Ack=3137621 Win=32767 Len=0 SLE=3129461 SRE=3130821 [TCP Dup ACK 7753#2] smtp > mpfoncl [ACK] Seq=195 Ack=3137621 Win=32767 Len=0 SLE=3129461 SRE=3130821 [TCP Dup ACK 7753#3] smtp > mpfoncl [ACK] Seq=195 Ack=3137621 Win=32767 Len=0 SLE=3129461 SRE=3130821 [TCP Dup ACK 7753#4] smtp > mpfoncl [ACK] Seq=195 Ack=3137621 Win=32767 Len=0 SLE=3129461 SRE=3130821 [TCP Dup ACK 7753#5] smtp > mpfoncl [ACK] Seq=195 Ack=3137621 Win=32767 Len=0 SLE=3129461 SRE=3130821 rocsca
