Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

what does this wireshark info refer to

I am new to wireshark and to networking in general, but I am monitoring the traffic of my application and I can filter on it so I can see when it is actively transfering data that it is supposed to with the server but wireshark shows this:

protocol = TCP
length = 54
info = 56705 > ms-wbt-server [ACK] Seq=1 Ack=61 Win=252 Len=0

being fired every second from my app to my app server. Why does my application keep sending these packets every second?

It is a c# .net app if that is of any assistance.

like image 201
Daniel Robinson Avatar asked Feb 01 '13 10:02

Daniel Robinson


2 Answers

It's a TCP keepalive packet, containing no data but with the ACK flag set. Just tells the other end you are still there, and keeps the connection open.

There's a good overview here: http://tldp.org/HOWTO/TCP-Keepalive-HOWTO/overview.html

like image 153
Vicky Avatar answered Oct 13 '22 09:10

Vicky


ms-wbt-server is port 3389, and is used for the Remote Desktop Protocol (RDP), do you have a remote desktop connection open to your server by any chance?

like image 27
Fiach Reid Avatar answered Oct 13 '22 08:10

Fiach Reid