This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I read a lot of things about these and I am very confused.

If you help me I will be very glad.

My questions are:

1-) Does TCP protocol send acknowledgment for every TCP segment or depends on window size?

Because in that link: http://www.firewall.cx/networking-topics/protocols/tcp/130-protocols-tcp-overview.html

alt text

It shows because of windows size, it sends one acknowledgment for 3 packets.

But in that animation: http://www.youtube.com/watch?v=9BuaeEjIeQI&feature=related

It seems that TCP protocol sends acknowledgment packet for every TCP segment.

Is Acknowledgment datagram per TCP datagram or per window?

2-) I downloaded http://media.packetlife.net/media/blog/attachments/424/TCP_example.cap; and I am trying to understand the window size value but I am confused.

The article says: "Window size is used by the receiver to indicate to the sender the amount of data that it is able to accept. When the amount of data transmitted is equal to the current Window value, the sender will expect a new Window value from the receiver, along with an acknowledgement for the Window just received."

alt text

Yes, in the sample .cap; window size is increased for every step but the amount of data that is transmitted is 1514 byte and it is constant. Why is that so?

Thanks...

asked 14 Nov '11, 15:34

sawque's gravatar image

sawque
1334
accept rate: 0%


Part of the confusion is that the first web site you referred to, http://www.firewall.cx/networking-topics/protocols/tcp/130-protocols-tcp-overview.html, is using confusing and incorrect terms. The title of the first graphic you posted says "Window Size = 3." On his web site, the author says "In the above example, we have a window size equal to 3, which means that host B can send 3 data segments to host A before expecting an ACK back." That is not correct. The window size is the amount of data, in bytes, that the receiver can accept. You would not see a window size of 3 bytes unless the receiver was overloaded and unable to keep up with the sender.

There are lots of good explanations of TCP on the web. I'd Google and find a better one.

Acknowledgement is per datagram, but because of a feature called Delayed ACK, you might see one acknowledgement for every two datagrams.

permanent link

answered 14 Nov '11, 18:24

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%

1

You might even see ACKs after 8,9,10 whatever segments, which is absolutely OK as well - delayed ACK simply states, that the reciever of data does not acknowledge every incoming segment for performance reasons. The exact behaviour depends solely on the Operating System in place which is why on most (MS based) systems there is an ACK for every 2nd incoming segment

(15 Nov '11, 02:41) Landi

You are correct that you might see ACKs less often than every other segment, depending on the implementation. RFC 1122 says that "...in a stream of full sized segments there SHOULD be an ACK for at least every second segment." The use of "SHOULD" means that the implementation can ignore that recommendation if there is good reason to do so.

(15 Nov '11, 10:54) Jim Aragon
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×55
×41

question asked: 14 Nov '11, 15:34

question was seen: 15,001 times

last updated: 15 Nov '11, 10:54

p​o​w​e​r​e​d by O​S​Q​A