6
19:25:47.629351 IP 2.2.2.2.80 > 1.1.1.1.31889: Flags [.], seq 2372487272:2372492544, ack 2808407165, win 122, options [nop,nop,TS val 911640439 ecr 235835291], length 5272
19:25:47.631626 IP 1.1.1.1.31889 > 2.2.2.2.80: Flags [.], ack 2372480682, win 3876, options [nop,nop,TS val 235835291 ecr 911640428], length 0
19:25:47.631638 IP 1.1.1.1.31889 > 2.2.2.2.80: Flags [.], ack 2372483318, win 3793, options [nop,nop,TS val 235835291 ecr 911640428], length 0
19:25:47.631677 IP 1.1.1.1.31889 > 2.2.2.2.80: Flags [.], ack 2372483318, win 4096, options [nop,nop,TS val 235835292 ecr 911640428], length 0
19:25:47.674712 IP 1.1.1.1.31889 > 2.2.2.2.80: Flags [.], ack 2372485954, win 4054, options [nop,nop,TS val 235835335 ecr 911640428], length 0

What is the meaning of the ecr in the options list in tcpdump's output?
I google it but failed.

red0ct
  • 4,840
  • 3
  • 17
  • 44
Dan
  • 3,221
  • 7
  • 27
  • 24
  • [The timestamp from the echo reply](http://stackoverflow.com/questions/2524511/what-is-the-meaning-of-the-tsv-and-tser-fields-in-an-ethereal-dump). – CodeCaster Sep 19 '16 at 12:45
  • @CodeCaster Thank you. It seems that you are right, but why the values are so different? – Dan Sep 19 '16 at 17:05

1 Answers1

8

ECR - Echo reply --- that was sent with the acknowledgement field. Its a timestamp value calculated based upon the TSval sent in the sync packet...

balraje
  • 81
  • 1
  • 2