Hello All, We are observing multiple TCP Duplicate ACK’s coming from the receiver and after going through the TCP RFC’s and I found the following reasons why our product is replying with multiple TCP DupACK's. a. [RFC 2001 – Section 3] under Fast Retransmit, TCP may generate an immediate acknowledgment (a duplicate ACK) when an out-of-order segment is received (Section 4.2.2.21 of [1], with a note that one reason for doing so was for the experimental fast-retransmit algorithm). This duplicate ACK should not be delayed. The purpose of this duplicate ACK is to let the other end know that a segment was received out of order, and to tell it what sequence number is expected. b. [RFC 2001 – Section 3] Since TCP does not know whether a duplicate ACK is caused by a lost segment or just a reordering of segments, it waits for a small number of duplicate ACKs to be received. It is assumed that if there is just a reordering of the segments, there will be only one or two duplicate ACKs before the reordered segment is processed, which will then generate a new ACK. If three or more duplicate ACKs are received in a row, it is a strong indication that a segment has been lost. TCP then performs a retransmission of what appears to be the missing segment, without waiting for a retransmission timer to expire. So, the receiver is behaving normally as per TCP standards, and is only sending duplicate ACK#1 which is the indication that an out-of-order TCP packet might have been received, but if I am checking the "Expert Info" of Wireshark then there is no indication of out-of-order pkt. Can anyone help here what might be the other possible reason for the receiver to send duplicate ACK's?? Regards Amitav Nayak asked 02 Apr '14, 09:56  Amitav |
One Answer:
Duplicated ACKs may also be caused by very high path latency, brief connection outage or actual packet loss. You can check for out of order packets with the filter "tcp.analysis.out_of_order" and check for retransmissions with this filter: tcp.analysis.retransmission || tcp.analysis.fast_retransmission Good luck. answered 11 Sep '15, 06:11  BrunoF |
I have added the snapshot of my wireshark trace for a better understanding.. In the pic you can see that we have 73 Duplicate ACK coming from receiver whereas there is no indication of an occurrance of an out-of-order packet.
If you want to find out the reason you will need to take packet captures from both sides simultaneously. Maybe some device in between is misbehaving.