matching ack packet and the next stream of data

Question

I am tracing wireshark and matching tcp packets in order to calculate the delays occuring, i can match a data packet and it's acknowlegment, but my problem is, when i have an ack packet with window size two for example, i receive this ack at the sender side and comes right after it 2 data packets sent from the sender side, but this ack and it's stream of data at the RECIEVER side are my problem, i have this ack packet as source and i receive the stream of two packets sometime in the future and they might overlap with other packets ..how do i match this ack and 1 and this ack and 2 at the receiver ??

sender receiver

ack windowSize=2

<------------------------

------------------------>

next ack

<-----------------------

Answer 1

Hm, I'm confused about what you are asking here
The headline goes : matching ack packet and the next stream of data
So one could guess that you want to see the next incoming data for the same tcp session after an ACK was sent.

Your 'picture' suggests that the ACKs would be flowing controlled by the window_size - which it is not!

sender                       receiver
    <------------------------ (0) ack windowSize=2 "This ack"
(1) ------------------------>
(2) ------------------------>
     <----------------------- (3) "next ack"

"how do i match this ack and 1 and this ack and 2 at the receiver ??"
"this ack (0) and (1) " is easy as the tcp.ack number at the receiver is the next expected tcp.seq number from the sender (1).
"this ack (0) ... and (2) " is not so trivial as (2)'s sequence number is dependent of the tcp.len of (1): tcp.seq plus tcp.len - wireshark does the math for you in field tcp.nxtseq
I don't know how you can predict this information by looking at segment (0). My suggestion is to add following fields to the column list
alt text

Than you can see in the packet list which segments are 'ack-ed' - even the frame number

alt text