not sure ESTABLISHED TCP traffic will have ACK flag set always...

[Michele Vetturi]

On Fri, Apr 08, 2005, someone also known as Christian Seberino wrote:
> 2. One side sends LESS packets then the other! --
>    fast side doesn't have enough incoming to ACK either!

This problem is resolved by the TCP window? Am I right?


> Agree? Why then do people say to drop non-ACK'd packets
> as suspicious??.... I would think it would be common
> for one side to send more packets then the other.  I could
> be wrong.


One side CAN send more packets.


-- 
[ Michele Vetturi
  --------------------------------------------------
  IRItaly.org and Honeynet.it member
  PGP key available at:    http://vetz.homelinux.org ]