This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello All, We are observing multiple TCP Duplicate ACK’s coming from the receiver and after going through the TCP RFC’s and I found the following reasons why our product is replying with multiple TCP DupACK's.

a. [RFC 2001 – Section 3] under Fast Retransmit, TCP may generate an immediate acknowledgment (a duplicate ACK) when an out-of-order segment is received (Section 4.2.2.21 of [1], with a note that one reason for doing so was for the experimental fast-retransmit algorithm). This duplicate ACK should not be delayed. The purpose of this duplicate ACK is to let the other end know that a segment was received out of order, and to tell it what sequence number is expected.

b. [RFC 2001 – Section 3] Since TCP does not know whether a duplicate ACK is caused by a lost segment or just a reordering of segments, it waits for a small number of duplicate ACKs to be received. It is assumed that if there is just a reordering of the segments, there will be only one or two duplicate ACKs before the reordered segment is processed, which will then generate a new ACK. If three or more duplicate ACKs are received in a row, it is a strong indication that a segment has been lost. TCP then performs a retransmission of what appears to be the missing segment, without waiting for a retransmission timer to expire.

So, the receiver is behaving normally as per TCP standards, and is only sending duplicate ACK#1 which is the indication that an out-of-order TCP packet might have been received, but if I am checking the "Expert Info" of Wireshark then there is no indication of out-of-order pkt.

Can anyone help here what might be the other possible reason for the receiver to send duplicate ACK's??

Regards Amitav Nayak

asked 02 Apr '14, 09:56

Amitav's gravatar image

Amitav
1112
accept rate: 0%

I have added the snapshot of my wireshark trace for a better understanding.. In the pic you can see that we have 73 Duplicate ACK coming from receiver whereas there is no indication of an occurrance of an out-of-order packet.

(02 Apr '14, 09:59) Amitav

alt text

(02 Apr '14, 10:03) Amitav

If you want to find out the reason you will need to take packet captures from both sides simultaneously. Maybe some device in between is misbehaving.

(04 Apr '14, 11:47) Roland

Duplicated ACKs may also be caused by very high path latency, brief connection outage or actual packet loss.

You can check for out of order packets with the filter "tcp.analysis.out_of_order" and check for retransmissions with this filter: tcp.analysis.retransmission || tcp.analysis.fast_retransmission

Good luck.

permanent link

answered 11 Sep '15, 06:11

BrunoF's gravatar image

BrunoF
1
accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×42

question asked: 02 Apr '14, 09:56

question was seen: 4,633 times

last updated: 11 Sep '15, 06:11

p​o​w​e​r​e​d by O​S​Q​A