This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

TCP Client ignores the acknowledge packet

0

Can someone please help me with this. The TCP client just ignores the ACK packet, and kept resending packet 53741 until the connection is time out. Where could be the issue?

 67011 103.330429  192.168.232.6  192.168.233.6  TCP  590  [TCP Retransmission] tsp > icl-twobase1 [ACK] Seq=53741 Ack=3683 Win=262144 Len=536   //client send packet 53741
 67048 103.358386  192.168.233.6  192.168.232.6  TCP  66   icl-twobase1 > tsp [ACK] Seq=3683 Ack=53741 Win=261072 Len=0 SLE=54049 SRE=58188       //server send ACK to packet 53741
 67050 103.358535  192.168.233.6  192.168.232.6  TCP  66   [TCP Dup ACK 67048#1] icl-twobase1 > tsp [ACK] Seq=3683 Ack=53741 Win=261072 Len=0 SLE=54049 SRE=58188  // ACK to 53741 send again
 67052 103.358685  192.168.233.6  192.168.232.6  TCP  66   [TCP Dup ACK 67048#2] icl-twobase1 > tsp [ACK] Seq=3683 Ack=53741 Win=261072 Len=0 SLE=54049 SRE=58188  // ACK to 53741 send again
 67053 103.358703  192.168.232.6  192.168.233.6  TCP  362  [TCP Fast Retransmission] tsp > icl-twobase1 [ACK] Seq=53741 Ack=3683 Win=262144 Len=308   //seems client didn't recognize the ACK packet, and resend packet 53741

69414 107.036796 192.168.232.6 192.168.233.6 TCP 590 [TCP Retransmission] tsp > icl-twobase1 [ACK] Seq=53741 Ack=3683 Win=262144 Len=536 // seems client didn't recognize the ACK packet, and resend packet 53741 after 4 sec 74328 114.171542 192.168.232.6 192.168.233.6 TCP 590 [TCP Retransmission] tsp > icl-twobase1 [ACK] Seq=53741 Ack=3683 Win=262144 Len=536 //another resend packet 53741 after 7 sec 83850 128.663773 192.168.232.6 192.168.233.6 TCP 590 [TCP Retransmission] tsp > icl-twobase1 [ACK] Seq=53741 Ack=3683 Win=262144 Len=536 //another resend packet 53741 after 14 sec 102074 157.423329 192.168.232.6 192.168.233.6 TCP 590 [TCP Retransmission] tsp > icl-twobase1 [ACK] Seq=53741 Ack=3683 Win=262144 Len=536 //another resend packet 53741 after 29 sec 119462 215.163865 192.168.232.6 192.168.233.6 TCP 590 [TCP Retransmission] tsp > icl-twobase1 [ACK] Seq=53741 Ack=3683 Win=262144 Len=536 //another resend packet 53741 after 58 sec

150535 332.202312 192.168.233.6 192.168.232.6 TCP 60 icl-twobase1 > tsp [FIN, ACK] Seq=3683 Ack=53741 Win=261072 Len=0 //FIN 150536 332.202335 192.168.232.6 192.168.233.6 TCP 54 tsp > icl-twobase1 [RST] Seq=53741 Win=0 Len=0 //client send RST, TCP connection is closed at this point

asked 10 Jan ‘12, 20:02

Wirewarrior's gravatar image

Wirewarrior
1111
accept rate: 0%

edited 11 Jan ‘12, 00:26

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196


One Answer:

1

First of all, an ACK value of 53741 does not mean "I have received your packet with SEQ=53471", it means "I have received data up to (but not including) SEQ 53471".

Then there is SACK, which means Selective Acknowledgements. In frame 67048 the server ACK's up to SEQ 53741, but it also says it has received SEQ-54049 to 58188 (SLE=54049 SRE=58188). So the client needs to resend 53741 to 54048 and can then send data starting from 58188.

Now, the client does send that part of data repeatedly, but the server stops sending ACK's to tell the client that it did receive the data. So either the server was suddenly disconnected from the network or maybe something on route was blocking/dropping the traffic.

So in this case, the client does not ignore the ACKs, it perfectly heard them and acted on them :-)

answered 11 Jan '12, 01:44

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

edited 11 Jan '12, 02:40

grahamb's gravatar image

grahamb ♦
19.8k330206