This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

What are SRE and SLE?

0

What do SRE and SLE stand for in the packet capture display? I'm looking at TCP packets so I assume it has something to do with windowing.

asked 17 Dec '10, 13:57

catimossi's gravatar image

catimossi
1111
accept rate: 0%


2 Answers:

2

They are the Right Edge (SRE) and Left Edge (SLE) of already acknowledged data when Selective Acknowledgments are used. This prevents retransmission of this data.

See also RFC 2018

answered 17 Dec '10, 17:05

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

edited 28 Jan '13, 14:49

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196

1

To add to Sake's post, SACK (Selective ACK) is used to identify holes in the TCP stream. This prevents the stack from having to go back to where the loss occurred and start all over. So the pkts from the normal ACK field (in the "normal" ACK field) to the LE is good to go. But from the LE to the RE, pkts were lost. So if the pkts are transferred like this (1, through 10)

10 9 8 7 6 5 4 3 2 1 --->

in normal ACK scenario, if pkt 4 is lost, it will look like this to the receiver

10 9 8 7 6 5 XX 3 2 1 --->

So the receiver will repeatedly ack saying "I need pkt 4...I need pkt 4, I need pkt 4" as other pkts (5-10) trickle in. When three of these acks are received, it triggers the fast retransmission, BTW.

When SACK is used, the receiver identifies the hole at pkt 4 position. So it doesn't throw pkts 5-10 away...instead, it sends a SACK requesting for pkt#4.

answered 21 Dec '10, 06:39

hansangb's gravatar image

hansangb
7912619
accept rate: 12%

sorry to raise an old question.

As per RFC I believe that packets from the LE to the RE are GOOD.

So if we have ACK=3, LE=5, RE=10,

it means that packet 4 is lost, packets 5-10 are good.

Am i missing something?

(28 Jan '13, 01:46) v_paranoid

no, you are absolutely right

(28 Jan '13, 09:53) Landi

Only the values in the LE and RE are not packet numbers, but sequence numbers :-)

(28 Jan '13, 12:46) SYN-bit ♦♦