This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Not getting the ACK I’m expecting

0

Hello, I'm doing some homework and my assigment is getting 6 TCP segments which start with a HTTP POST segment and then finding out when the ACK of each of those segments was received, the problem is that I have only managed to find 2 of the ACK one of the 2nd and one of the last segment. Why is it that the other ACK are not showing up?

asked 26 Apr '14, 14:40

Niena's gravatar image

Niena
16114
accept rate: 0%

edited 26 Apr '14, 14:40

Can you post the capture at http://www.cloudshark.org?

(26 Apr '14, 15:22) Jasper ♦♦

Google on "Delayed ACK"

(26 Apr '14, 19:12) Jim Aragon

here's the link: https://www.cloudshark.org/captures/5deb675a0d71

The POST segment is the no. 29 and the segments that I'm analyzing are the no. 29, 30, 33, 37, 38 and 39. You can see that the response ACK of segment no. 30 is the no. 36.

Is there anyway I can check if this ACK is a "delayed ACK"?

(26 Apr '14, 19:40) Niena

One Answer:

0

I don't see the problem you report here. You only see 2 ACKs that ack an outbound segment. However there are more ACKs coming in. In fact you're getting more ACKs in between.

The reason is that your client is using TCP segmentation offload sending more than the negotiated MSS. The server acks bytes in the middle of your segments as it receives them in MSS sized segments.

In the trace example #36 acks #30 and #45 acks #39. The other acks (31-32,34-36,40,42-43) ack bytes within the large segments seen in your trace. alt text

answered 26 Apr '14, 23:09

mrEEde's gravatar image

mrEEde
3.9k152270
accept rate: 20%

So, for example ACKS 31, 32, 34 and 35 are confirmation ACKS for 29 and 30 but 36 acks 30 because it actually acknowledges the next sequence number the server is expecting to receive?

Thanks for your help :)

(27 Apr '14, 07:06) Niena