Question regd timestamp option

[Chuck Swiger]

jha miku wrote:
> In case of active open, the SYN segments always have
> timestamp enabled, since the RFC flg is set. But,
> Currently, I am seeing some SYN segments without
> timestamp option.

FreeBSD (and OS X, and other things using a BSD network stack) will generate 
initial TCP SYN packets containing the "MNWNNT" TCP options, at least by 
default in the absense of other information or settings.

> The only condition that I am aware of when timestamp
> is disabled, is on sending the 3rd SYN in retransmit code
> when the timestamp gets disabled.
> looking at the tcpdump, it is unclear why the SYNs are
> sent during active open without timestamp option.

The TCP stack seems to remember some information about which TCP options a 
remote host is willing to accept.  If the remote system didn't accept a 
timestamp the first time (perhaps it's talking to an old windows box which does 
"MNNS"), there is no point in sending that option out the next time you open a 
new connection to the same system.

-- 
-Chuck