Re: [Ethereal-users] help with trace

["Bill Meier" <wmeier@xxxxxxxxxxx>]

> What I don't understand 504-513, the packet stream is ok up until this point, 
> but to me 504 is an > ak to a frame that does not exist? 
> Then 512 starts, like there was of several frames in a 
> segment? Is this correct?

I can think of various reasons for the pattern shown, but they boil down to 
the capture not including (for some reason) all the actual frames of the tcp connection.

The tcp connection appears to be going along just fine (since, for example,  
over the the almost 500 millsec time gap the sequence numbers 
from port 21325 increased by  more than the window size advertised by port 2193).

So: how was this capture made ? Was the capture done on one of  the end-point
nodes of the tcp session ?


Bill Meier