tcpdump and <nop,nop,timestamp xxx yyy>

Chris Noe (stiker@northlink.com)
Fri, 20 Mar 1998 22:30:44 -0700 (MST)


Just noticed this while tcpdump'ing a recent telnet (over ppp) session:

17:30:10.571579 209.75.160.90.domain > 209.75.160.34.domain: 9864 A? northlink.com. (31)
17:30:10.796499 209.75.160.34.domain > 209.75.160.90.domain: 9864* 1/4/4 (192)
17:30:10.799810 209.75.160.90.1025 > 209.75.160.32.telnet: S 3310621889:3310621889(0) win 32488 <mss 536,nop,nop,timestamp 112754 0,wscale 0,eol> (DF)
17:30:10.976449 209.75.160.32.telnet > 209.75.160.90.1025: S 1854400001:1854400001(0) ack 3310621890 win 16768 <mss 1460,nop,wscale 0,nop,nop,timestamp 17611 112754>
17:30:10.976575 209.75.160.90.1025 > 209.75.160.32.telnet: . ack 1 win 32488 <nop,nop,timestamp 112772 17611> (DF)
17:30:10.978750 209.75.160.90.1025 > 209.75.160.32.telnet: P 1:25(24) ack 1 win 32488 <nop,nop,timestamp 112772 17611> (DF)
17:30:11.206476 209.75.160.32.telnet > 209.75.160.90.1025: P 1:16(15) ack 25 win 16744 <nop,nop,timestamp 17611 112772> [tos 0x10]
17:30:11.206603 209.75.160.90.1025 > 209.75.160.32.telnet: . ack 16 win 32488 <nop,nop,timestamp 112795 17611> (DF)
17:30:11.207850 209.75.160.90.1025 > 209.75.160.32.telnet: P 25:31(6) ack 16 win 32488 <nop,nop,timestamp 112795 17611> (DF)
17:30:11.656460 209.75.160.32.telnet > 209.75.160.90.1025: P 16:38(22) ack 25 win 16768 <nop,nop,timestamp 17611 112795> [tos 0x10]
17:30:11.666487 209.75.160.32.telnet > 209.75.160.90.1025: P 38:56(18) ack 31 win 16768 <nop,nop,timestamp 17612 112795> [tos 0x10]
17:30:11.666580 209.75.160.90.1025 > 209.75.160.32.telnet: P 31:104(73) ack 56 win 32488 <nop,nop,timestamp 112841 17612> (DF)
17:30:11.946466 209.75.160.32.telnet > 209.75.160.90.1025: . ack 104 win 16768 <nop,nop,timestamp 17612 112841> [tos 0x10]
17:30:11.946560 209.75.160.90.1025 > 209.75.160.32.telnet: P 104:138(34) ack 56 win 32488 <nop,nop,timestamp 112869 17612> (DF)
17:30:12.136472 209.75.160.32.telnet > 209.75.160.90.1025: . ack 138 win 16768 <nop,nop,timestamp 17613 112869> [tos 0x10]
17:30:12.186471 209.75.160.32.telnet > 209.75.160.90.1025: P 56:62(6) ack 138 win 16768 <nop,nop,timestamp 17613 112869> [tos 0x10]
17:30:12.187203 209.75.160.90.1025 > 209.75.160.32.telnet: P 138:151(13) ack 62 win 32488 <nop,nop,timestamp 112893 17613> (DF)
17:30:12.336469 209.75.160.32.telnet > 209.75.160.90.1025: . ack 151 win 16768 <nop,nop,timestamp 17613 112893> [tos 0x10]
17:30:13.526464 209.75.160.32.telnet > 209.75.160.90.1025: P 62:68(6) ack 151 win 16768 <nop,nop,timestamp 17613 112893> [tos 0x10]
17:30:13.527290 209.75.160.90.1025 > 209.75.160.32.telnet: P 151:165(14) ack 68 win 32488 <nop,nop,timestamp 113027 17613> (DF)
17:30:13.546456 209.75.160.32.telnet > 209.75.160.90.1025: P 62:68(6) ack 151 win 16768 <nop,nop,timestamp 17615 112893> [tos 0x10]
17:30:13.546531 209.75.160.90.1025 > 209.75.160.32.telnet: . ack 68 win 32488 <nop,nop,timestamp 113029 17615> (DF)
17:30:13.846471 209.75.160.32.telnet > 209.75.160.90.1025: P 68:74(6) ack 165 win 16768 <nop,nop,timestamp 17616 113027> [tos 0x10]
17:30:13.847259 209.75.160.90.1025 > 209.75.160.32.telnet: P 165:173(8) ack 74 win 32488 <nop,nop,timestamp 113059 17616> (DF)
17:30:14.086452 209.75.160.32.telnet > 209.75.160.90.1025: P 74:80(6) ack 173 win 16768 <nop,nop,timestamp 17617 113059> [tos 0x10]
17:30:14.087245 209.75.160.90.1025 > 209.75.160.32.telnet: P 173:181(8) ack 80 win 32488 <nop,nop,timestamp 113083 17617> (DF)
17:30:14.296475 209.75.160.32.telnet > 209.75.160.90.1025: P 80:86(6) ack 181 win 16768 <nop,nop,timestamp 17617 113083> [tos 0x10]
17:30:14.297266 209.75.160.90.1025 > 209.75.160.32.telnet: P 181:192(11) ack 86 win 32488 <nop,nop,timestamp 113104 17617> (DF)
17:30:14.446470 209.75.160.32.telnet > 209.75.160.90.1025: P 86:89(3) ack 192 win 16768 <nop,nop,timestamp 17618 113104> [tos 0x10]
17:30:14.447220 209.75.160.90.1025 > 209.75.160.32.telnet: P 192:195(3) ack 89 win 32488 <nop,nop,timestamp 113119 17618> (DF)
17:30:14.606460 209.75.160.32.telnet > 209.75.160.90.1025: P 89:104(15) ack 195 win 16768 <nop,nop,timestamp 17618 113119> [tos 0x10]
17:30:14.607366 209.75.160.90.1025 > 209.75.160.32.telnet: P 195:204(9) ack 104 win 32488 <nop,nop,timestamp 113135 17618> (DF)
17:30:14.876486 209.75.160.32.telnet > 209.75.160.90.1025: P 104:194(90) ack 204 win 16759 <nop,nop,timestamp 17618 113135> [tos 0x10]
17:30:14.877882 209.75.160.90.1025 > 209.75.160.32.telnet: P 204:277(73) ack 194 win 32488 <nop,nop,timestamp 113162 17618> (DF)
17:30:15.056473 209.75.160.32.telnet > 209.75.160.90.1025: P 194:201(7) ack 277 win 16768 <nop,nop,timestamp 17619 113162> [tos 0x10]
17:30:15.456456 209.75.160.90.1025 > 209.75.160.32.telnet: . ack 201 win 32488 <nop,nop,timestamp 113220 17619> (DF)
17:30:15.596477 209.75.160.32.telnet > 209.75.160.90.1025: P 201:216(15) ack 277 win 16768 <nop,nop,timestamp 17620 113220> [tos 0x10]
17:30:16.096454 209.75.160.90.1025 > 209.75.160.32.telnet: . ack 216 win 32488 <nop,nop,timestamp 113284 17620> (DF)
17:30:20.436688 209.75.160.90.1025 > 209.75.160.32.telnet: F 277:277(0) ack 216 win 32488 <nop,nop,timestamp 113718 17620> (DF)
17:30:21.496465 209.75.160.90.1025 > 209.75.160.32.telnet: F 277:277(0) ack 216 win 32488 <nop,nop,timestamp 113824 17620> (DF)
17:30:21.636470 209.75.160.32.telnet > 209.75.160.90.1025: . ack 278 win 16768 <nop,nop,timestamp 17632 113824> [tos 0x10]
17:30:21.646476 209.75.160.32.telnet > 209.75.160.90.1025: F 216:216(0) ack 278 win 16768 <nop,nop,timestamp 17632 113824> [tos 0x10]
17:30:21.646562 209.75.160.90.1025 > 209.75.160.32.telnet: . ack 217 win 32488 <nop,nop,timestamp 113839 17620> (DF)

What are these <nop,nop>'s doing before my timestamps?
Could they be affecting throughput? (two in *each* packet sent/recv'd)

I've never seen this before in 2.1.89, 2.0.29..

Probably just a cool new feature, eh?

tcpdump version 3.4a5
libpcap version 0.4a5

Chris Noe
(stiker@northlink.com)

---
---------------------------------------------------------
#!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj
$/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1
lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)
---- http://online.offshore.com.ai/arms-trafficker/ -----

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu