What's the meaning of "ecr" option in tcpdump?

networking tcp tcpdump packet-capture
Dan picture Dan · Sep 19, 2016 · Viewed 7.7k times · Source 
19:25:47.629351 IP 2.2.2.2.80 > 1.1.1.1.31889: Flags [.], seq 2372487272:2372492544, ack 2808407165, win 122, options [nop,nop,TS val 911640439 ecr 235835291], length 5272
19:25:47.631626 IP 1.1.1.1.31889 > 2.2.2.2.80: Flags [.], ack 2372480682, win 3876, options [nop,nop,TS val 235835291 ecr 911640428], length 0
19:25:47.631638 IP 1.1.1.1.31889 > 2.2.2.2.80: Flags [.], ack 2372483318, win 3793, options [nop,nop,TS val 235835291 ecr 911640428], length 0
19:25:47.631677 IP 1.1.1.1.31889 > 2.2.2.2.80: Flags [.], ack 2372483318, win 4096, options [nop,nop,TS val 235835292 ecr 911640428], length 0
19:25:47.674712 IP 1.1.1.1.31889 > 2.2.2.2.80: Flags [.], ack 2372485954, win 4054, options [nop,nop,TS val 235835335 ecr 911640428], length 0

What is the meaning of the ecr in the options list in tcpdump's output?
I google it but failed.

Answer

balraje picture balraje · Dec 27, 2016

ECR - Echo reply --- that was sent with the acknowledgement field. Its a timestamp value calculated based upon the TSval sent in the sync packet...

Related questions

Capture only ssl handshake with tcpdump

I have a server to which many clients connect using SSL. Recently I'm observing SSL handshake errors in the server logs (ex SSL MAC error). The error itself is not important, but I want to see why some clients are …

Read More
How to concatenate two tcpdump files (pcap files)

How to concatenate two tcpdump files, so that one traffic will appear after another in the file? To be concrete I want to "multiply" one tcpdump file, so that all the sessions will be repeated one after another sequentially few …

Read More
Stripping payload from a tcpdump?

Is there an automated way (either in tcpdump or via a helper app Out There) to generate a pcap file that contains only Ethernet, IP and Layer 4 (TCP in my case) headers, so that there is no payload/application data …

Read More