hi
you should look into syn negation
if both support sack option
On 28/04/2011 11:20, "Andi Wijaya" <stev2711@xxxxxxxxx> wrote:
>
> Hi Guys,
> This is my first post, and it's so nice to be able to join this community so please excuse me if I make any mistake.
> I'm doing a capture with SACK ON and with SACK OFF, my understanding is with SACK OFF, the server will have to retransmit the packet from the point of packet lost. However what I see is the server does not retransmit the packet at all and just continuing with the rest of the data (please see the TCP Trace screenshot attached). While for SACK ON, everything went well as the theory.
>
> SACK OFF: (I removed some column for easier viewing)
>
> No Source Destination Seq.# Nxt.Seq. Ack.# Info
> 193 10.10.1.58 125.252.232.170 2286 112769 [TCP Dup ACK 125#34] 1069 > 80 [ACK] Seq=2286 Ack=112769 Win=32768 Len=0
> 194 125.252.232.170 10.10.1.58 112769 114229 2286 [TCP Retransmission] [TCP segment of a reassembled PDU]
> 195 10.10.1.58 125.252.232.170 2286 137589 1069 > 80 [ACK] Seq=2286 Ack=137589 Win=32768 Len=0
> 196 125.252.232.170 10.10.1.58 137589 139049 2286 [TCP Retransmission] Continuation or non-HTTP traffic
> 197 10.10.1.58 125.252.232.170 2286 144889 1069 > 80 [ACK] Seq=2286 Ack=144889 Win=32768 Len=0
>
> My question is, packet no.193 is the Dup ACK and no.194 is the TCP retransmission, but why no.195 does not do a TCP retransmission of 114229 (which is the next seq.) but go to 137589 (no 195)instead ? Am I missing something here ? Thanks/
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe