This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

ACK number error

0
1

Hi, everyone:

As I know, in TCP, the ACK number of N+1th packet is:

Seq number of Nth packet+Length of Nth packet.

But I have found that in some scenario the ACK number of N+1th packet is:

Seq number of Nth packet + Length of Nth packet +1, like this:

alt text

Seq of frame 2481 is 1243466, and the next packet ACK should be Seq+len=1243466+1179=1244645.

But in fact the ACK of next packet is 1244646. Why this happends?

Here is my trace file, this happens at the end of this trace file. https://www.dropbox.com/s/gn8nyrv1cr147eq/bug.pcap

Anyone could help me? Thank you very much!

asked 29 Jun '14, 02:20

lzq8272587's gravatar image

lzq8272587
26●4●5●7
accept rate: 0%

edited 29 Jun '14, 02:25

One Answer:

1

The fin and the syn bit need to get acknowledged without any data bytes flowing so they increment the ack number by one.

answered 29 Jun '14, 13:03

mrEEde2's gravatar image

mrEEde2
336●4●6●14
accept rate: 20%

Hi, mrEEde2:

Thank you very much.

But in another trace, I have found a fin bit without increasing ack number by one.

Here is the trace: https://www.dropbox.com/s/e712npql6xsj31z/good.pcap

Note that the ack number of FIN packet is equal to the prior one.

I cannot post figure in comment. Please find it in answer.

Thank you very much again!

(29 Jun '14, 17:47) lzq8272587

alt text

(29 Jun '14, 17:48) lzq8272587

Oh! I see that! You are right, Jim. Thank you very much!

(29 Jun '14, 18:37) lzq8272587