Home page logo
/

nanog logo nanog mailing list archives

Re: Questions about Internet Packet Losses
From: Vern Paxson <vern () ee lbl gov>
Date: Mon, 13 Jan 1997 21:17:57 PST

   indicate that 9% of the packets had a 512 byte *payload*.

I already subtracted off the 40 bytes for the headers.  I meant MSS.

(By payload, I meant data, i.e., not including headers, same as you ...)

However,
the spikes in the packet percentages are clearly due to hosts using that
MSS.  You would otherwise expect to see a "smooth" distribution across
packet sizes, which is not at ALL what's happening.

Right, spikes correspond to MSS's (and other effects like acks & SYN/FIN's).

Are you saying the data shows significant spikes at other, non-standard MSS
values?  If it does, then (modulo some thinking about the particular numbers)
I agree that they're likely MSS candidates and support the notion that weird
MSS's are being used.  But if the data has a few spikes at things like 512
but no strong spikes at non-standard values, then that doesn't help distinguish
between (1) lots of weird TCP's using weird MSS's, vs (2) lots of packets
that are less than full-size because the mainstream TCP didn't have enough
bytes to fill them.

If your data is available, I'd love to take a gander at it.

                Vern
- - - - - - - - - - - - - - - - -


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]