Wireshark-bugs: [Wireshark-bugs] [Bug 11624] TCP ACKed unseen segment

Date: Fri, 23 Oct 2015 13:28:58 +0000

Comment # 2 on bug 11624 from
Great explanation. I enabled relative sequence numbers so I could follow along.

Source 10.10.176.201
--------------------
One packet should be received after #23 but is missing. 9120 with 1001 data.
That is why #27 says, "TCP Previous segment not captured".

Two packets should be received after #27 but are missing. 10121 with X data and
(10121+X) with Y data. That is why #29 says, "TCP Previous segment not
captured".

#36 is acking for 10088 (up to, but not including, 10088) which is up through
#26. Note, seq 10088 is seen in #28,37,38 with no data. 

#39-46 is acking for 11456 (up to, but not including, 11456) which is missing
from the capture. Two packets should be received after #38. 10088 with 1368
data and 11456 with 1028 data.

Now I understand. #39-46 is acking for the unseen segment with seq 10088 with
1368 data.


Source 10.20.119.32
-------------------
#37 is acking for 8210 (up to, but not including, 8210) which is up through
#21.

#38 is acking for 9120 (up to, but not including, 9120) which is up through
#23.

#47 is acking for 10121 (up to, but not including, 10121) which is missing from
the capture. This was the missing packet above with seq 9120 with 1001 data.



Clearly, there is a problem with the capture tool since there are no tcp
retransmissions, duplicate acks, or tcp option sack. I will contact the group
responsible for the tool.


However, #48 is acking for 12725 (up to, but not including, 12725) which is
seen in #47. seq 11456 with 1269 data. Can you explain this please?


Thank you very much,
Tom


You are receiving this mail because:
  • You are watching all bug changes.