This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Is TCP allowed to retransmit, using a segment that is different (larger) from the original segment?

From a Wireshark capture I see a TCP segment which presumably is not ACK:ed within time so a retransmission is made but this time with a slightly larger payload?!? Both segments are ACK:ed separetly (one with SACK). I'm pretty sure that it is only the larger packet that is picked up at the application layer. What may be the cause of this?

Time         From    To      Info  
yy26.720721, xx.46 , xx.202, [PSH, ACK] Seq=206 Ack=25 Win=63733 Len=29  
yy26.720767, xx.202, xx.46 , [PSH, ACK] Seq=25 Ack=235 Win=64615 Len=26  
yy26.925563, xx.202, xx.46 , [TCP Retransmission][PSH, ACK] Seq=25 Ack=235 Win=64615 Len=64  
yy26.925802, xx.46 , xx.202, [ACK] Seq=235 Ack=89 Win=63669 Len=0 SLE=25 SRE=51  
yy27.220114, xx.46 , xx.202, [PSH, ACK] Seq=235 Ack=89 Win=63669 Len=1

asked 01 Dec '13, 12:46

ssh9614's gravatar image

ssh9614
6112
accept rate: 0%

edited 02 Dec '13, 09:55

Bill%20Meier's gravatar image

Bill Meier ♦♦
3.2k1850


My answer:

The TCP data length in a retransmitted TCP segment can certainly be larger than in the originally transmitted TCP segment.

Think of it this way: The sending application adds more data to the TCP send buffer between the first transmission and the retransmission and thus more data is available to be sent in the retransmission.

The receiving TCP stack is responsible for properly re-constructing the data stream (handling data received twice & etc) before passing the data to the receiving application.

One slightly interesting note: The window size advertised by the receiver (xx.46) is reduced by 64 to 63669 and remains at that value in the two acks thus suggesting that the receiving application (xx.46) has not yet read the data from the receive TCP buffer by the end of the sequence shown.

permanent link

answered 02 Dec '13, 10:32

Bill%20Meier's gravatar image

Bill Meier ♦♦
3.2k1850
accept rate: 17%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×104
×41

question asked: 01 Dec '13, 12:46

question was seen: 3,689 times

last updated: 02 Dec '13, 10:32

p​o​w​e​r​e​d by O​S​Q​A