Netscape 2.x and Win95

[Chuck Murcko <ch...@telebase.com>]

Here's a tcpdump output of SYN/FIN/RST packets between the Netscape
client and Apache-1.2dev (latest). This is the same type of output
Stevens considers in TCP/IP Illustrated, Vol. 3.

Note the win 0 packets and high rate of SYN packets; Stevens describes this
behavior as indicative of a pathological client. 8^) This also causes the
double RST replies from Apache.

The very end of the trace is where the client hangs w/the keepalive bug.

tcpdump: listening on ec0
15:48:38.232130 jont.telebase.com.2567 > spudboy.telebase.com.80: S 24662777:24662777(0) win 8192 <mss 1460> (DF)
15:48:38.232470 spudboy.telebase.com.80 > jont.telebase.com.2567: S 202436763:202436763(0) ack 24662778 win 17520 <mss 1460> (DF)
15:48:38.324323 spudboy.telebase.com.80 > jont.telebase.com.2567: F 2467:2467(0) ack 179 win 17520 (DF)
15:48:38.354670 jont.telebase.com.2568 > spudboy.telebase.com.80: S 24662904:24662904(0) win 8192 <mss 1460> (DF)
15:48:38.354959 spudboy.telebase.com.80 > jont.telebase.com.2568: S 202563787:202563787(0) ack 24662905 win 17520 <mss 1460> (DF)
15:48:38.362993 jont.telebase.com.2569 > spudboy.telebase.com.80: S 24662910:24662910(0) win 8192 <mss 1460> (DF)
15:48:38.363275 spudboy.telebase.com.80 > jont.telebase.com.2569: S 202595373:202595373(0) ack 24662911 win 17520 <mss 1460> (DF)
15:48:38.364083 jont.telebase.com.2570 > spudboy.telebase.com.80: S 24662913:24662913(0) win 8192 <mss 1460> (DF)
15:48:38.364320 spudboy.telebase.com.80 > jont.telebase.com.2570: S 202649431:202649431(0) ack 24662914 win 17520 <mss 1460> (DF)
15:48:38.387263 jont.telebase.com.2567 > spudboy.telebase.com.80: R 24662956:24662956(0) win 0 (DF)
15:48:38.389843 jont.telebase.com.2571 > spudboy.telebase.com.80: S 24662939:24662939(0) win 8192 <mss 1460> (DF)
15:48:38.390148 spudboy.telebase.com.80 > jont.telebase.com.2571: S 202712635:202712635(0) ack 24662940 win 17520 <mss 1460> (DF)
15:48:41.607119 jont.telebase.com.2569 > spudboy.telebase.com.80: R 24663142:24663142(0) win 0 (DF)
15:48:41.607897 jont.telebase.com.2568 > spudboy.telebase.com.80: R 24663333:24663333(0) win 0 (DF)
15:48:41.667366 jont.telebase.com.2572 > spudboy.telebase.com.80: S 24666218:24666218(0) win 8192 <mss 1460> (DF)
15:48:41.667676 spudboy.telebase.com.80 > jont.telebase.com.2572: S 203816071:203816071(0) ack 24666219 win 17520 <mss 1460> (DF)
15:48:56.618778 spudboy.telebase.com.80 > jont.telebase.com.2571: F 3295:3295(0) ack 433 win 17520 (DF)
15:48:56.658641 spudboy.telebase.com.80 > jont.telebase.com.2570: F 5520:5520(0) ack 676 win 17520 (DF)
15:48:56.798649 spudboy.telebase.com.80 > jont.telebase.com.2572: F 486:486(0) ack 210 win 17520 (DF)
15:49:01.333861 spudboy.telebase.com.80 > jont.telebase.com.2572: R 203816558:203816558(0) win 0
15:49:01.347161 jont.telebase.com.2573 > spudboy.telebase.com.80: S 24685902:24685902(0) win 8192 <mss 1460> (DF)
15:49:01.347436 spudboy.telebase.com.80 > jont.telebase.com.2573: S 208102996:208102996(0) ack 24685903 win 17520 <mss 1460> (DF)
15:49:01.470532 spudboy.telebase.com.80 > jont.telebase.com.2571: R 202715931:202715931(0) win 0
15:49:01.478683 jont.telebase.com.2574 > spudboy.telebase.com.80: S 24686033:24686033(0) win 8192 <mss 1460> (DF)
15:49:01.478931 spudboy.telebase.com.80 > jont.telebase.com.2574: S 208242005:208242005(0) ack 24686034 win 17520 <mss 1460> (DF)
15:49:05.349880 spudboy.telebase.com.80 > jont.telebase.com.2570: R 202654952:202654952(0) win 0
15:49:05.393062 jont.telebase.com.2575 > spudboy.telebase.com.80: S 24689949:24689949(0) win 8192 <mss 1460> (DF)
15:49:05.393330 spudboy.telebase.com.80 > jont.telebase.com.2575: S 209169831:209169831(0) ack 24689950 win 17520 <mss 1460> (DF)
15:49:05.491549 jont.telebase.com.2576 > spudboy.telebase.com.80: S 24690037:24690037(0) win 8192 <mss 1460> (DF)
15:49:05.491850 spudboy.telebase.com.80 > jont.telebase.com.2576: S 209345944:209345944(0) ack 24690038 win 17520 <mss 1460> (DF)
15:49:20.486348 spudboy.telebase.com.80 > jont.telebase.com.2574: F 1073:1073(0) ack 461 win 17520 (DF)
15:49:20.486834 spudboy.telebase.com.80 > jont.telebase.com.2573: F 2664:2664(0) ack 439 win 17520 (DF)
15:49:20.499550 spudboy.telebase.com.80 > jont.telebase.com.2574: R 208243079:208243079(0) win 0
15:49:20.506444 spudboy.telebase.com.80 > jont.telebase.com.2573: R 208105661:208105661(0) win 0
15:49:20.506575 spudboy.telebase.com.80 > jont.telebase.com.2575: F 2037:2037(0) ack 453 win 17520 (DF)
15:49:20.518559 spudboy.telebase.com.80 > jont.telebase.com.2575: R 209171869:209171869(0) win 0
15:49:20.576301 spudboy.telebase.com.80 > jont.telebase.com.2576: F 922:922(0) ack 449 win 17520 (DF)
15:49:20.587545 spudboy.telebase.com.80 > jont.telebase.com.2576: R 209346867:209346867(0) win 0

38 packets received by filter
0 packets dropped by kernel

chuck
Chuck Murcko	N2K Inc.	Wayne PA	chuck@telebase.com
And now, on a lighter note:
Satellite Safety Tip #14:
	If you see a bright streak in the sky coming at you, duck.