Ask Your Question

ACK behavior

asked 2019-03-04 14:22:14 +0000

becco981 gravatar image

Is it possible that one single cumulative ACK packet (sniffing on sender side) is received as two single ACK packets (sniffing on receiver side)?

More detailed: I have two capture, one from the sender side and the other one from the receiver. On the sender side I see two packets going out (8 and 378 bytes). After this, I see two received ACK (for 8 and 378 bytes).

On the receiver side I see two packets coming in (8 and 378 bytes). After this, I see one single ACK going out (8 + 378 bytes).


edit retag flag offensive close merge delete


I'm going to ask for the whole capture and going to share the interesting part. In the meanwhile, I found that also the Win size is quiet different between the two captures: for the same frame (packet) I see same data but different window size value...quite strange.

becco981 gravatar imagebecco981 ( 2019-03-04 16:18:07 +0000 )edit

please answer with comments, not new answers! I converted your answer to a comment.

Kurt Knochner gravatar imageKurt Knochner ( 2019-03-04 17:34:04 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2019-03-04 16:08:54 +0000

Kurt Knochner gravatar image

sounds rather strange. I can imagine two scenarios.

  • misinterpretation of the pcap
  • TCP offloading (into the NIC) on the receiver, but hard to imagine that his creates such an effect

It's hard to tell what's going on without the pcap. Can you share the pcap (only the interesting part)?
Do you have TCP offloading enabled on the receiver (NIC driver option).


edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2019-03-04 14:22:14 +0000

Seen: 454 times

Last updated: Mar 04 '19