tech-net archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

SACK oddity



I'm seeing odd TCP behaviour with SACKs.  (It's between two NetBSD
hosts, but I'm really asking about TCP - the NetBSD versions are
oldish, but not so old that SACK wasn't well-specced at the time.)  The
trace looks odd to me; I'm wondering if it really is as odd as I think
or if I'm missing something.

The two (v4) IP addresses in question led to the from and to portions
of this tcpdump being the same width, which made it visually confusing.
I've replaced them with "me" and "them" for better visual clarity.

I've cut some data transfer that looks irrelevant to my question.

08:33:13.709263 IP me.64997 > them.22: S 3183198846:3183198846(0) win 32768 <mss 1460,nop,wscale 0,sackOK,nop,nop,nop,nop,timestamp 0 0>
08:33:13.710200 IP them.22 > me.64997: S 1290717679:1290717679(0) ack 3183198847 win 32768 <mss 1460,nop,wscale 3,nop,nop,timestamp 1 0,sackOK,nop,nop>
08:33:13.710274 IP me.64997 > them.22: . ack 1 win 33580 <nop,nop,timestamp 0 1>
...
08:33:15.018929 IP me.64997 > them.22: P 2297:3329(1032) ack 2995 win 33580 <nop,nop,timestamp 3 2>
08:33:15.019639 IP them.22 > me.64997: . ack 3329 win 4197 <nop,nop,timestamp 4 3>
08:33:16.561746 IP them.22 > me.64997: P 2995:3723(728) ack 3329 win 4197 <nop,nop,timestamp 7 3>
08:33:16.759131 IP me.64997 > them.22: . ack 3723 win 33580 <nop,nop,timestamp 6 7>
08:34:50.058240 IP me.64997 > them.22: P 3329:3405(76) ack 3723 win 33580 <nop,nop,timestamp 191 7>
08:34:51.555460 IP me.64997 > them.22: P 3329:3405(76) ack 3723 win 33580 <nop,nop,timestamp 194 7>
08:34:51.556181 IP them.22 > me.64997: . ack 3405 win 4197 <nop,nop,timestamp 197 191,nop,nop,sack sack 1 {3329:3405} >

The right edge of the SACK block equals the main TCP ACK sequence
number, meaning it's SACKing data that's already ACKed normally.  This
is what looks odd to me.  Is it, or am I confused?

I don't know whether the 1.5 second delay between the two 76-octet
segments is relevant.  I would tend to assume that's an ordinary
retransmit in the face of loss, but combined with the odd SACK?  I'm
not at all sure.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		mouse%rodents-montreal.org@localhost
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B


Home | Main Index | Thread Index | Old Index