Comments on: Network Monitoring Experimentations 3 http://hoopercharles.wordpress.com/2010/01/05/network-monitoring-experimentations-3/ Miscellaneous Random Oracle Topics: Stop, Think, ... Understand Mon, 13 May 2013 14:10:06 +0000 hourly 1 http://wordpress.com/ By: Charles Hooper http://hoopercharles.wordpress.com/2010/01/05/network-monitoring-experimentations-3/#comment-140 Thu, 07 Jan 2010 02:38:13 +0000 http://hoopercharles.wordpress.com/?p=695#comment-140 Good catch regarding the speed at which the packets are sent by the *.46 RH/Samba server. Just before the ACK on packet 177, the server sent 8 packets of about 1500 bytes each in the span of about 0.000053 seconds. That fact is one of characteristics I had hoped someone would identify. The 100-200ms delay before the ACK is sent is a second characteristics I had hoped someone would identify.

]]> By: Jeremy Baumont http://hoopercharles.wordpress.com/2010/01/05/network-monitoring-experimentations-3/#comment-128 Tue, 05 Jan 2010 16:34:36 +0000 http://hoopercharles.wordpress.com/?p=695#comment-128 Hi,

first thanks for these “Network Monitoring Series” really interesting, I was noticing on the second capture of Wireshark a little delay before the ACK of *.47 W2003 client between 100-200 ms for the frame 168, 187 and 197. It looks to me that *.46 RH/Samba server send quickly the pieces of the file (for example frames 160 to 167) then the W2003 delayed the ACK. Could it be due to “delayed ACK” TCP feature ?

cheers,

–Jeremy Baumont

]]>