THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

Crosses on TCPtrace graph meaning

Hi all,

could you please tell me what is the meaning of these little crosses on top of TCP segments? I'm using latest v2.6.2rc0-166. Is it some new feature?

Thanks!

image description

Packet_vlad's avatar
1.1k
Packet_vlad
asked 2018-07-18 13:09:34 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

1

Looking at the tcp_stream_dialog.cpp source code, the comment on line 288 and following lines of code indicate that they are representative of a TCP zero window condition. You should be able to verify that.

Note that the use of these crosses to depict a TCP zero window condition seems to differ from the tcptrace's use of these "Little crosses", which are described in the Time Sequence Graph section of the tcptrace manual as follows:

Little crosses (x) These are segments sent with zero TCP data payload (the down and up arrows of the segment coincide, giving rise to a cross).

cmaynard's avatar
11.1k
cmaynard
answered 2018-07-18 15:43:39 +0000
grahamb's avatar
23.8k
grahamb
updated 2018-07-18 16:30:58 +0000
edit flag offensive 0 remove flag delete link
more

Comments

Hi Christopher, thanks, you're exactly right!

This is a trace from today's post.

I just checked it and verified exact match of crosses to zero window packets. Never seen a sequence of fully loaded zero window packets before.

BR, Vlad.

Packet_vlad's avatar Packet_vlad (2018-07-18 16:38:51 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer