Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Answers to your questions:

  1. From the shown packets, it is not clear why the retransmission has a smaller segment length than the original packet. However, when you mention that there are 12 bytes of TCP options used, then the first POST has an excess of 6 bytes to it's own MSS. This might be a bug. Somehow the retransmission does take the MSS into account properly
  2. Depending on whether SACK is enabled and DSACK is supported, it will either just send a DUP-ACK or a DUP-ACK with DSACK option. Looking at the length of the packet, it looks like a DSACK block might be present in the DUP-ACKs. Generally, the retransmitted TCP segment will be ignored.

Most worrysome part of your packet capture is that the data of the server does not seem to be arriving at the client, at least it is not ACKed.

Like always, analyzing a screenshot is not our hobby, please supply a pcap file on any of the public file shares, anonymized with TraceWrangler if needed.