Wireshark-users: Re: [Wireshark-users] non-piggy-backed ACK with total IP length = 52
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Andrej van der Zee <andrejvanderzee@xxxxxxxxx>
Date: Sun, 27 Feb 2011 18:11:21 +0900
Hi Guy,

Thanks for your reply.

> It's saying "I saw the bytes with sequence numbers from 533 through 1129" (i.e., in the half-open interval [533, 1130)), presumably because there are some bytes with sequence numbers preceding 553 that it hasn't yet acknowledged because it hasn't seen yet - it wants to have the other end re-transmit those bytes without having it also retransmit bytes 533-1129, which I suspect were the retransmitted bytes.

Actually, the weird thing is that the "normal" ACK Number in this
packet is 1130 and there are no "holes" in the acked data. The RFC
sais:

"The SACK option does not change the meaning of the Acknowledgement
Number field"

So the SACK option in this packet seems to have no affect whatsoever
and I wonder why it is sent then. Bad TCP implementation (Windows 7)?

Attached you find the pcap-file (packet 11 is the SACK-packet).

Cheers,
Andrej