This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Suspected retransmission with differently sized segment

0

Is TCP allowed to retransmit, using a segment that is different (larger) from the original segment?

From a Wireshark capture I see a TCP segment which presumably is not ACK:ed within time so a retransmission is made but this time with a slightly larger payload?!? Both segments are ACK:ed separetly (one with SACK). I'm pretty sure that it is only the larger packet that is picked up at the application layer. What may be the cause of this?

Time         From    To      Info  
yy26.720721, xx.46 , xx.202, [PSH, ACK] Seq=206 Ack=25 Win=63733 Len=29  
yy26.720767, xx.202, xx.46 , [PSH, ACK] Seq=25 Ack=235 Win=64615 Len=26  
yy26.925563, xx.202, xx.46 , [TCP Retransmission][PSH, ACK] Seq=25 Ack=235 Win=64615 Len=64  
yy26.925802, xx.46 , xx.202, [ACK] Seq=235 Ack=89 Win=63669 Len=0 SLE=25 SRE=51  
yy27.220114, xx.46 , xx.202, [PSH, ACK] Seq=235 Ack=89 Win=63669 Len=1

asked 01 Dec '13, 12:46

ssh9614's gravatar image

ssh9614
6112
accept rate: 0%

edited 02 Dec '13, 09:55

Bill%20Meier's gravatar image

Bill Meier ♦♦
3.2k1850


One Answer:

0

My answer:

The TCP data length in a retransmitted TCP segment can certainly be larger than in the originally transmitted TCP segment.

Think of it this way: The sending application adds more data to the TCP send buffer between the first transmission and the retransmission and thus more data is available to be sent in the retransmission.

The receiving TCP stack is responsible for properly re-constructing the data stream (handling data received twice & etc) before passing the data to the receiving application.

One slightly interesting note: The window size advertised by the receiver (xx.46) is reduced by 64 to 63669 and remains at that value in the two acks thus suggesting that the receiving application (xx.46) has not yet read the data from the receive TCP buffer by the end of the sequence shown.

answered 02 Dec '13, 10:32

Bill%20Meier's gravatar image

Bill Meier ♦♦
3.2k1850
accept rate: 17%