Pages

1/12/2015

Packet-Level: Am I looking at a trace from client side or server side?

Look at 3 way handshake (SYN, SYN/ACK, ACK.)
  - Client side trace will have delay between SYN & SYN/ACK
  - Server side trace will have delay between SYN/ACK & ACK.

Duh, this is obvious!  Some might say.  But I find it insightful as TCP analysis is just a "hobby" -- I do it so rarely in my work that I learn and re-learn each time I need to slog through a trace file.

No comments: