wireshark-users February 2011 archive
Main Archive Page > Month Archives  > wireshark-users archives
wireshark-users: Re: [Wireshark-users] non-piggy-backed ACK with

Re: [Wireshark-users] non-piggy-backed ACK with total IP length = 52

From: Andrej van der Zee <andrejvanderzee_at_nospam>
Date: Sun Feb 27 2011 - 09:11:21 GMT
To: Community support list for Wireshark <wireshark-users@wireshark.org>

Hi Guy,

Thanks for your reply.

> It's saying "I saw the bytes with sequence numbers from 533 through 1129" (i.e., in the half-open interval [533, 1130)), presumably because there are some bytes with sequence numbers preceding 553 that it hasn't yet acknowledged because it hasn't seen yet - it wants to have the other end re-transmit those bytes without having it also retransmit bytes 533-1129, which I suspect were the retransmitted bytes.

Actually, the weird thing is that the "normal" ACK Number in this
packet is 1130 and there are no "holes" in the acked data. The RFC

"The SACK option does not change the meaning of the Acknowledgement
Number field"

So the SACK option in this packet seems to have no affect whatsoever
and I wonder why it is sent then. Bad TCP implementation (Windows 7)?

Attached you find the pcap-file (packet 11 is the SACK-packet).

Sent via: Wireshark-users mailing list <wireshark-users@wireshark.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users