Home page logo
/

nanog logo nanog mailing list archives

Re: Questions about Internet Packet Losses
From: "Howard C. Berkowitz" <hcb () clark net>
Date: Tue, 14 Jan 1997 05:29:20 -0500

Tony,

Thanks for posting some useful raw data.  A clarification -- in some
messages, you say you've stripped headers, but is unclear if you did so in
your top 10 table.

If so, 41 sounds reasonable for noncompressed-header Telnet, with the 44,
52, 48, 56, etc., sizes, as a guess, to a rounded-up transmission buffer.
44 in implementation where memory is allocated/managed in 4 byte quanta, 52
in 8 byte quanta, etc.

Silly question, at 5AM...MSS is one of those acronyms I use for its own
convenience and beauty, without really stopping to think what it stands
for...Mean Segment Size?

Unanswered questions for further research:
1) What in hell is sending so many 40 byte packets?  Are we really seeing
  productive ACKs?  Or is it just HTTP bogosity?  This really sucks.
2) What OS is using a 512 MSS?  256?
3) What are the minimal revs of various BSD flavors to exceed the 576 MTU
  by default?
4) 41 bytes is pretty obviously interactive traffic.  Is the intuition
  correct?  What's so special about 44, 52, 48 and 56?  What do people do
  with 4, 8, 12 and 16 bytes of data?  And why not any of the odd values?

Tony

              Tony's Top 10
Packet Size    Percentage
40             44.838          "ACKs, SYNs, FINs, RSTs "
552            9.19            512 MSS
1500           6.839           Happy boxes
576            5.779           BSD bogosity
44             4.719           ??
52             1.175           ??
48             0.884           ??
41             0.776           ??
56             0.73            ??
296            0.717           256 MSS



- - - - - - - - - - - - - - - - -


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault