Following graph is conclusions.
Receiving side(192.168.1.55) sends TCP ZeroWindow packet.
This indicats the tcp buffer of receiving side is full.
Sending side(192.168.1.10) sends TCP ZeroWindow Probe packet. This indicats the sending side is asking the receiving side to accept packet or not.
The receiving side answers TCP ZeroWindowAck packet. This indicats the receiving side still can't receive packet.
After repeating this communication many times, receiving side(192.168.1.55) sends TCP ZeroWindow Update. This indicates the receiving side tells sending side to send packets from now on!
| NO | Time | Source | Dest | TCP | |
| 3201 | 20:19:05 | 192.168.1.10 | 192.168.1.55 | TCP 1460 byte | |
| 3202 | 20:19:05 | 192.168.1.55 | 192.168.1.10 | TCP Zerowindow | |
| 3203 | 20:19:06 | 192.168.1.10 | 192.168.1.55 | TCP ZerowindowProbe | |
| 3204 | 20:19:06 | 192.168.1.55 | 192.168.1.10 | TCP ZerowindowAck | |
| 3205 | 20:19:07 | 192.168.1.10 | 192.168.1.55 | TCP ZerowindowProbe | check after 1 second |
| 3206 | 20:19:07 | 192.168.1.55 | 192.168.1.10 | TCP ZerowindowAck | |
| 3207 | 20:19:09 | 192.168.1.10 | 192.168.1.55 | TCP ZerowindowProbe | check after 2.5 seconds |
| 3208 | 20:19:09 | 192.168.1.55 | 192.168.1.10 | TCP ZerowindowAck | |
| 3209 | 20:19:14 | 192.168.1.10 | 192.168.1.55 | TCP ZerowindowProbe | check after 5 seconds |
| 3210 | 20:19:14 | 192.168.1.55 | 192.168.1.10 | TCP ZerowindowAck | |
| 3211 | 20:19:24 | 192.168.1.10 | 192.168.1.55 | TCP ZerowindowProbe | check after 10 seconds |
| 3212 | 20:19:24 | 192.168.1.55 | 192.168.1.10 | TCP ZerowindowAck | |
| 3232 | 20:19:43 | 192.168.1.10 | 192.168.1.55 | TCP ZerowindowProbe | check after 20 seconds |
| 3233 | 20:19:43 | 192.168.1.55 | 192.168.1.10 | TCP ZerowindowAck | |
| 3269 | 20:20:21 | 192.168.1.10 | 192.168.1.55 | TCP ZerowindowProbe | check after 40 seconds |
| 3270 | 20:20:21 | 192.168.1.55 | 192.168.1.10 | TCP ZerowindowAck | |
| 3282 | 20:21:38 | 192.168.1.10 | 192.168.1.55 | TCP ZerowindowProbe | check after 80 seconds |
| 3283 | 20:21:38 | 192.168.1.55 | 192.168.1.10 | TCP Zerowindow Update | Now I can receive packets!! |
Tweet
