This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

tcp acking every other segment?

0

I am working on the tcp lab and am having trouble understading how the ack is and why it skips some segments? Can anyone shed a little light on this for me?

asked 14 Nov '11, 10:05

hatcher44's gravatar image

hatcher44
1111
accept rate: 0%


3 Answers:

2

You are seeing a feature known as "delayed ACK." Remember that ACKs are cumulative and the ACK number from the receiving system is the next expected sequence number from the sending system. Assuming relative sequence numbers are turned on in your Wireshark preferences, if the receiver sends an ACK with ACK number 1,000, it's saying "I've received bytes 1 through 999, and I expect 1,000 next."

Because ACKs are cumulative, it's not necessary to ACK every packet. When delayed ACK is turned on, the receiver will usually ACK every other packet.

Let's say the sender is sending 100 byte packets, and it starts with sequence number 1. If every packet is being ACKed:

The first sent packet will have sequence number 1, and will contain bytes 1 through 100. The first ACK will have ACK number 101, meaning that the receiver expects sequence number 101 next.

The second sent packet will have sequence number 101 and will contain bytes 101 through 200. The second ACK will have ACK number 201, meaning that the receiver expects sequence number 201 next.

If delayed ACK is on, no ACK will be sent in response to the first packet. When the second packet is received, an ACK will be sent with ACK number 201. This means that the receiver has received bytes 1 through 200 and is expecting 201 next.

Delayed ACK normally ACKS every other segment. The delayed ACK timer takes care of the situation where there is an odd number of segments.

See When Does Delayed Ack Start? for a discussion of delayed ACKs or Google "Delayed ACK". There are a lot of good explanations on the web.

answered 14 Nov '11, 12:23

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%

edited 14 Nov '11, 12:24

0

You will want to look at the differences in the acknowledged sequence numbers of the2 consecutive ACKs if you lok at the amount of acknowledged data from each ACK, sometimes you will find that the your system is only acking every other segement sent to it.

answered 14 Nov '11, 10:12

modernman's gravatar image

modernman
1
accept rate: 0%

0

I found this online which uses the etheral lab file.

The acknowledged sequence numbers of the ACKs are listed as follows. acknowledged sequence number acknowledged data ACK 1 566 566 ACK 2 2026 1460 ACK 3 3486 1460 ACK 4 4946 1460 ACK 5 6406 1460 ACK 6 7866 1460 ACK 7 9013 1147 ACK 8 10473 1460 ACK 9 11933 1460 ACK 10 13393 1460 ACK 11 14853 1460 ACK 12 16313 1460 IF you use this I would advise that you reword it so as not to be exactly the same.

answered 14 Nov '11, 10:21

sheldor's gravatar image

sheldor
1
accept rate: 0%

I appreciate the help sheldor but I dont want to just copy past the answer I just wanted to know how to calculate and determine it.

(14 Nov '11, 10:22) hatcher44