TCP Window Scaling issue

[zach.reborn at gmail.com (Zach Hill)]

All are from SPAN ports at each end. So for the second round of packet
captures Site 1 is from a SPAN port off the NIC of Server A. Site 2 is from
a SPAN port off the NIC of the MPLS router.

The first round of packet captures are only from the SPAN port off the MPLS
router at Site 2.


On Thu, Jul 24, 2014 at 3:08 PM, <Valdis.Kletnieks at vt.edu> wrote:

> On Thu, 24 Jul 2014 14:33:56 -0400, Zach Hill said:
>
> > First is the SYN from Server A to Server B
> http://i.imgur.com/E5cu4ev.png
>
> Was this captured with tcpdump on Server A on its way out, or on Server B
> on its way in, or at some other point using a span port?  The answer
> matters
> if we're suspecting that something along the way is stomping the option....
>