107 posts categorized "Chris Greer" Feed

How TCP Works – The Timestamp Option (by Chris Greer)

TCP Timestamp TSval TSecr

In the TCP handshake, you may see an option called timestamps, shortly followed by scary-looking “TSval” and "TSecr" numbers. What are those values and how can you interpret them? Let’s dig.

What is a TCP Timestamp? 

The timestamps option in TCP enables the endpoints to keep a current measurement of the roundtrip time (RTT) of the network between them. This value helps each TCP stack to set and adjust its retransmission timer. There are other benefits, but RTT measurement is the major one.

How it works.

Each end of the connection derives a 4-byte increasing value. This value is unique to each side and has no real numerical significance. The opposite end does not care what the value is, it will simply echo it back to the original sender. The original sender can then measure the timing between the packet(s) that were sent and received with this unique value.

The value used by each end will be increased as the connection goes along. Many TCP implementations will add the measured network RTT value (in milliseconds) to the 4-byte timestamp and use this new number for the next segment to be sent.

For example, in the screenshot below, we can see both ends of the TCP connection using timestamps. Both values, the one used by the sender and receiver, have been added as columns in Wireshark to make them a little easier to see.

TCP Timestamps

The first packet has a timestamp value of 1125169296. Told you it was long and scary! But let's analyze...

Continue reading "How TCP Works – The Timestamp Option (by Chris Greer)" »

Troubleshooting a Spotty/Bad Internet Connection (by Chris Greer)

Recently, I changed my internet service to a new provider. These guys promised some decent bandwidth at a good price.

After getting it installed, nerd-proofed, and monitored, all looked good.

That is until I had a remote training class to teach over WebEx – then the audio issues began. (Of course! Why do these issues always KNOW?!?! Right when you need the connection the most – boom!)

Every 10-15 minutes or so the audio would drop for about 5 seconds. The students could still see my screen, but the audio was clearly having issues. Fortunately, I could call in using my cell and finish up the class with no further problems.

As much as I wanted to blame WebEx, I knew that it was no small coincidence that I had just changed my internet service. Alas, this time it looked like it really was the network! Time to crack out the tools and troubleshoot.

Packet Capture - Wireshark

Continue reading "Troubleshooting a Spotty/Bad Internet Connection (by Chris Greer)" »

Sharkfest 2018 - TCP Fundamentals Part 1 (by Chris Greer)

TCP is a huge component of the reliable delivery of applications. You are using it at this moment to access and read this article. You are probably using it to deliver most - if not all - of your business critical services on your network. 

But how does TCP "do it's thing?"

Why is the network often blamed even when a TCP-based problem is the real culprit? 

Understanding how TCP works will help network engineers of all experience levels to be better troubleshooters. It will help them fix slow networks, identify the root cause of application issues, and finally get answers to perplexing performance questions. This video, recorded at Sharkfest USA 2018 in Mountain View, California, gives an overview of the fundamentals of TCP. 

Sit back, grab some popcorn, and copy of Wireshark. Let's learn more about TCP! 


Author Profile - Chris Greer is the Chief Packet Head for Packet Pioneer LLC and a Certified Wireshark Network Analyst. Chris regularly assists companies in tracking down the source of network and application performance problems using a variety of protocol analysis and monitoring tools including Wireshark. Chris also delivers training and develops technical content for Wireshark and for several analysis vendors. Got packet questions? Let's get in touch!

Chris Greer Packet Pioneer Logo



Wireshark Quick Tip - Opening Two Traces At Once on Mac OS (by Chris Greer)

Hey packet people!

If you are a Mac user and you need to do a side-by-side analysis of two trace files using Wireshark, this video will show you how. I got this tip from Mr. Gerald Combs himself. Thanks Gerald! 

Just wanted to post this in time for Sharkfest next week. You know, so you can follow along with the instructor while comparing a trace from your environment.

Continue reading "Wireshark Quick Tip - Opening Two Traces At Once on Mac OS (by Chris Greer)" »

Wireshark Quick Tip - Graphing TCP Zero Windows with tcptrace (by Chris Greer)

There is a handy new feature in Wireshark that just made looking at one of my favorite trace files a little more interesting.

The tcptrace graph has been used by analysts for years to graph the efficiency of data transfers over TCP. It helps us to see sequence number increase over time, the receive TCP window, bytes in flight, retransmissions and acknowledged data. That way if there is a hitch in a download or large transfer, you can quickly spot if the issue and get to digging for root cause.

In the screenshot below we see a tcptrace graph with all the pertinent info.

Tcptrace graph Wireshark

This graph is great. It has been a huge help for years. As you can see above, there is a long pause in the data transfer, and with a few clicks we can start to deep dive.

But until recently, there was one thing missing that is very important to know when analyzing data transfers – zero windows.

Continue reading "Wireshark Quick Tip - Graphing TCP Zero Windows with tcptrace (by Chris Greer)" »