Revision history [back]

Looking at host1_data.pcapng

Up until frame 11774, .2 sends an ACK for every segment received from .1

But at this point the window size has reached 16MB and .2 can start sending an ACK only after receiving the last segments of a series with PSH flag. (Use Statistics - TCP Stream Graphs - Window Scaling to illustrate .1 to .2 window size increase.)

There are a few "intermediate" ACK here and there. They are seen for segments without PSH flag but I'm guessing there is something configured on .2 forcing it to send ACK before last segment with PSH flag.

Here's my analysis of what you are seeing:

Frames 15612 to 15656

• New series of segments ending with one with PSH flag

Frame 15657

• .1 retransmit last segment in series likely because it took too long for .2 to ACK. (RTO was 0.0019 base on last frame #15656 in series)

Frame 15658

• Initial ("late") ACK for frame 15656 (RTT to ACK is 0.002)

Frane 15659

• New ACK for retransmitted frame 15657

Frames 15660 to 15704

• New series of segments ending with one with PSH flag

Frames 15704 to 15720

• Series of ACK for latest series where .2 begins with one ACK per segment for 15704 to 15719 and then jumps to ACK later segments in the series but still does not ACK the last segment that has PSH flag.

Frame 15721

• .1 retransmit last segment in series likely because it took too long for .2 to ACK. (RTO was 0.006 based on last frame #15704 in series)

Frame 15722

• Initial ("late") ACK for 15704 OR ACK for retransmitted 15721 (RTT to ACK 0.006)

Frames 15723 to 15749

• New series of segments ending with one with PSH flag

Frames 15750 to 15764

• .2 sends ACK up to frame 15737

Frames 15765 to 15782

• Segments for the rest of the series that started with #15723 and ending with segment showing PSH flag

Frame 15783

• .2 sends ACK for last segment with PSH

Rest of capture

• .1 will keep sending series of segments with the last one having PSH flag
• .2 will ACK last segment in series (but also sometimes within series)

It looks to me like there will be retransmission from .1 when .2 takes longer than 0.002 to ACK.

(I tried looking at host2_data.pcapng but it shows weird timing for some packets. A frame from .1 with a higher number than the previous frame from .2 will show a lower timestamp. Not sure why that is.)

Hope this helps.

Cheers,

Spooky