I’m working on a tool to test a tcp proxy and I see the following:
- Client sends a SYN to the server with timestamps option (TSval=12345, TSecr=0).
- Server sends a SYN-ACK and omits the timestamps option.
The problem is that I’m not sure if a TCP is supposed to interpret that to mean that the timestamps option should not be used.
I’ve been poring over rfc 1323 for a while now, and this is all I could find on the subject:
A TCP may send the Timestamps option
(TSopt) in an initial segment
(i.e., segment containing a SYN bit
and no ACK bit), and may send a TSopt
in other segments only if it received a TSopt in the initial
segment for the connection.
I infer from this that the fact that the SYN-ACK is missing the timestamps option doesn’t mean anything about whether or not it’s valid later in the session. However, doing so requires me to assume a bit more than I’d like. Does anyone have an authoritative source on the subject or personal experience with how different TCP stacks behave in this situation?
The peer TCP is indicating that it does not support (or wish to use) the option. You should not send any further Timestamp options on that session.
This is fairly standard practice for TCP options.