i used strace,the result as show below: the first pic. is strace at about 00 20(little enidan, means 0x2000 and should followed by 0120 0220 0320 0420),the result is as expected. and this is tcpdump result in wireshark, as you can see, betes from 0x48 is the package seq.package 8218 seq = 0x2001 package 8219 = 0x2004 and package 8220 = 0x2002 ...20003 2005...