I was writting a java (jpcap) application that distinguishes which response packet was for which request packet. suddenly I encounter these two http packets that my browser sent exactly the same (seq number, ack number, ...) except one of them has push flag and different identification number. I was wondering why browser sent these two? is it Ajax?

1342824149:911270 /192.168.2.#->/174.143.213.# protocol(6) priority(0)  hop(128)  offset(0) ident(14123) TCP 11303 > 80 seq(2473817076) win(17040) ack 3940549542 

1342824149:911797 /192.168.2.#->/174.143.213.# protocol(6) priority(0)  hop(128)  offset(0) ident(14124) TCP 11303 > 80 seq(2473817076) win(17040) ack 3940549542  P

and more important question, are there separate responses for these two packets? or there is just one response? or same response? and what responses would looks like?

有帮助吗?

解决方案

Your browser just says "connect to IP address X on port Y" and "send these bytes". It's the TCP/IP stack inside the kernel that's responsible for actually creating packets and making sure they get to their destination. In this case, the first packet didn't get acknowledged by the destination, so the TCP code in the kernel sent it again.

其他提示

If they have the same TCP sequence number they are the same data: the second one is a retry due to non-acknowledgement. The PUSH flag doesn't really do anything except possibly in routers. The different Wireshark number is just because they are different actual receive events: it's not in the packet.

许可以下: CC-BY-SA归因
不隶属于 StackOverflow
scroll top