tcpdump

I am a Ph.D student at Georgia Tech.
We are simulating WWW traffic and generating artificial traffic according 
to the data getting from real traffic.

By inspecting TRACE DUMP (tcpdump),
I have found 2 strange questions.

1) when finishing their connection, some of connections end up with by 
sending RST abnormally. 

Usually, server sends FIN to close connection.
Clients sends FIN to server with ACK and waiting sever's ACK.
Then, timeout happens, client sends RST and close connection.
I have noticed quite many times in tcpdump this abnormality.
Is it due to the difference of TCP version or else?

2) Port NO.
Tcp assign port NO. sequencially.
In case,in a client, there are more than 1 http connections, how TCP 
assign the port NO?

http-1: 4500 (main)
http-1: 4501~ (successive inlines)

if another http-2 starts at the moment http-1 is in main,
will http-2's port be 4501, or else?

Your answer will help me very much in various way for me to research.
Thank you

Received on Thursday, 21 August 1997 10:24:04 UTC