RE: [Ethereal-users] help with trace

["Tim michals" <tcmichals@xxxxxxx>]

The two nodes, PC and a TCP/IP device.  The trace was taken from the PC
side.

The problem is this is via USB, RNDIS over USB, so it is a point to point
type of link.

We were thinking that the driver may not be keeping up? 



-----Original Message-----
From: ethereal-users-bounces@xxxxxxxxxxxx
[mailto:ethereal-users-bounces@xxxxxxxxxxxx] On Behalf Of Bill Meier
Sent: Friday, October 07, 2005 6:39 PM
To: ethereal-users@xxxxxxxxxxxx
Subject: Re: [Ethereal-users] help with trace

> What I don't understand 504-513, the packet stream is ok up until this
point, 
> but to me 504 is an > ak to a frame that does not exist? 
> Then 512 starts, like there was of several frames in a 
> segment? Is this correct?

I can think of various reasons for the pattern shown, but they boil down to 
the capture not including (for some reason) all the actual frames of the tcp
connection.

The tcp connection appears to be going along just fine (since, for example,

over the the almost 500 millsec time gap the sequence numbers 
from port 21325 increased by  more than the window size advertised by port
2193).

So: how was this capture made ? Was the capture done on one of  the
end-point
nodes of the tcp session ?


Bill Meier




_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users