The information in this article applies to:
SUMMARYThis article covers some basic concepts and tips needed for reading TCP/IP traces. MORE INFORMATIONTCP FlagsA, ACK- (Acknowledge) The receiver will send an ACK that equals the senders sequence number plus the Len, or amount of data, at the TCP layer.SYN, and FIN flags count as 1 byte. The ACK can also be thought of as the sequence number of the next octet the receiver expects to receive. S, SYN- Synchronize is used during session setup to agree on initial sequence numbers. Sequence numbers are random. F, FIN- Finish is used during a graceful session close to show that the sender has no more data to send. R, RST- Reset is an instantaneous abort in both directions (abnormal session disconnection). P, PSH- Push forces data delivery without waiting for buffers to fill. This is used for interactive traffic. The data will also be delivered to the application on the receiving end with out buffering. U, URG- Urgent- Data is sent out of band. In the above two traces, transmission control protocol (TCP) is the highest layer protocol, so the relevant session information can be read from the summary line of the trace. If there is a higher layer protocol (NBT, SMB, Telnet, FTP, etc.), you will have to look in the packet for the TCP flags, acks and sequence numbers. Re-transmission Behavior(from "TCP/IP Implementation Details")TCP starts a re-transmission timer when each outbound segment is handed down to IP. If no acknowledgment has been received for the data in a given segment before the timer expires, then the segment is retransmitted, up to the TcpMaxDataRetransmissions times. The default value for this parameter is 5. The re-transmission timer is initialized to 3 seconds when a TCP connection is established; however it is adjusted "on the fly" to match the characteristics of the connection using Smoothed Round Trip Time (SRTT) calculations as described in RFC793. The timer for a given segment is doubled after each re-transmission of that segment. Using this algorithm, TCP tunes itself to the "normal" delay of a connection. TCP connections over high-delay links will take much longer to time out than those over low- delay links. The following trace clip shows the re-transmission algorithm for two hosts connected over Ethernet on the same subnet. An FTP file transfer was in progress, when the receiving host was disconnected from the network. Since the SRTT for this connection was very small, the first re-transmission was sent after about one-half second. The timer was then doubled for each of the re-transmissions that followed. After the fifth re-transmission, the timer is once again doubled, and if no acknowledgment is received before it expires, then the transfer is aborted. After computer "X's" retries are exhausted, you may not see a "Reset" right away. If computer "Y" finally responds, computer "X" may then reset the connection. Sliding WindowsDuring the handshake, the send window size is set to the other host's receive window. The window size is a buffer and is the amount of data the sender can send and the receiver can receive without an ack. The "window" can slide forward after that packet is acknowledged.With a receive window of 8760, the sender may send 8760 bytes before receiving an ack. The receiver could ack every packet, every other packet or the entire 8760 depending on the IP stack and timing. (See Delayed Ack Timer, and Retransmit timer) Windows NT will ack every other packet. If the packets are coming extremely fast, you may see Windows NT ack more than 2 packets. If the PUSH bit set, data will be delivered up to the application right away, but the ack may still be delayed. The sequence number in frame 51 is 349349990. The ack in frame 57 is 349358750. This is the sequence number from frame 51 plus the amount of data received in frames 51 through 56 (6 frames x 1460 =8760) . Also, the ack 349358750 is the sequence number of the next packet that the host expects to receive. The window size is also used for flow control. If a host is advertising a smaller window size when its buffers are filling, or a window size of 0 if it can not receive data at all. In frame 50 above, the host is advertising a window size of 8760 and in frame 57 it has been dropped to 4096. Ports, Connections, and EndpointsPort numbers define the ultimate destination within a computer. Connections are identified by a pair of endpoints. An Endpoint is the (host, port). Ex. (199.199.40, 21)Port NumbersThe port numbers are divided into three ranges: the Well-Known Ports,the Registered Ports, and the Dynamic and/or Private Ports. The Well-Known Ports are those from 0 through 1023.The Registered Ports are those from 1024 through 49151. The Dynamic and/or Private Ports are those from 49152 through 65535.Well-Known Ports are assigned by Internet Assigned Numbers Authority (IANA) and should only be used by System Processes or by programs executed by priviledged users. An example of this type of port is 80/TCP and 80/UDP. These ports are priviledged and reserved for use by the HTTP protocol. Registered Ports are listed by the IANA and on most systems can be used by ordinary user processes or programs executed by ordinary users. An example of this type of port is 1723/TCP and 1723/UDP. Although these ports can be used by other processes they are generally accepted as the connection control port for Point To Point Tunnelling Protocol (PPTP). Dynamic or Private Ports can be used by any process or user. They are unrestricted. IANA maintains a list of ports on their Web site at: http://www.isi.edu/in-notes/iana/assignments/port-numbersThe third-party contact information included in this article is provided to help you find the technical support you need. This contact information is subject to change without notice. Microsoft in no way guarantees the accuracy of this third-party contact information. Trace Reading SuggestionsFollow a session using source and destination IP address and Port numbers. If you find a Reset, focus on the sequence numbers and acks that proceed it. Use a calculator to see what ack is corresponding to what data sent. Newer versions of NetMon will do the calculations for you. Is the sender doing retries? Note the number of retries and the time elapsed. The default number of retries is 5. Is the receiver asking for a missed frame by ACKing a previous sequence number? Did the sender back up and resend the previous packet? A Reset can be caused by time-outs at the TCP layer or by time outs of higher layer protocols. Resets originating at the TCP layer should be easy to read from the trace. It may be more difficult to determine the cause of Resets originating from higher layer protocols.For example, a Server Message Block (SMB) read may time out in 45 seconds and cause a Reset of the session even though communications are slow but working at the TCP layer. The trace may only narrow down what component is at fault. From there you may need to use other troubleshooting methods to determine the cause. To see TCP sequencing when higher-level protocols are present, start Network Monitor and perform the following steps:
REFERENCES
TCP/IP Illustrated Volume 1; W. Richard Stevens Additional query words:
Keywords : ntprotocol nttcp NTSrv |
|
Last Reviewed: November 24, 1999 © 2000 Microsoft Corporation. All rights reserved. Terms of Use. |