This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

ACK after PSH,ACK from same source.

0

alt text

While capturing the pcap,i had found some issue like, same source sends PSH,ACK and ACK.Below is the attached screen shot.Is it possible like that.

asked 01 Aug '17, 04:21

kodamagulla_kalyan's gravatar image

kodamagulla_...
6●1●1●3
accept rate: 0%

edited 01 Aug '17, 04:22

One Answer:

0

Sure, that's possible. PSH/ACK just means "this is something the receiver can process right away" - it doesn't mean that there can't be more following it.

answered 01 Aug '17, 04:36

Jasper's gravatar image

Jasper ♦♦
23.8k●5●51●284
accept rate: 18%

Can you please elabrate below q.

Say in PSH,ACK from x to y seq = 7732 ack =1 len =831. immediate ACK from x to y seq = 8563( 7732 + 831) ack =1 len = 1448 happens.

So why it has to send again ACK with adding seq with len ? I was assuming this has to be done by the reciever end.

-Thanks

(01 Aug '17, 04:49) kodamagulla_...

ACK is only increased by the receiver if TCP payload bytes (len value) arrived successfully. If x sends two packets in a row, ACK must not change because nothing was received from y in the meantime.

(01 Aug '17, 04:55) Jasper ♦♦