I have a capture that I could use to verify, but I can't share it.
Donnie
-----Original Message-----
From: ethereal-dev-bounces@xxxxxxxxxxxx
[mailto:ethereal-dev-bounces@xxxxxxxxxxxx] On Behalf Of ronnie sahlberg
Sent: Thursday, December 02, 2004 5:03 AM
To: Ethereal development
Subject: Re: [Ethereal-dev] False [TCP Dup ACK] indicators
Yes, it is likely that a normal windows update might be mistaken as a dup
ack.
It is semi-trivial to fix, do you have a capture file to share to test and
verify the fix with?
On Wed, 1 Dec 2004 19:37:29 -0500, Donnie Hale
<lists-ethereal@xxxxxxxxxxxxxx> wrote:
> In reviewing some captures today, Ethereal reported some packets as
> [TCP Dup ACK ...]. When I see that, I generally think there's some
> kind of loss in the environment. However, in looking more closely at
> the frames, we were able to determine that these weren't indicators of
> loss but instead of the receive window being opened after previously
> being shrunk. As I understand it, this is legal TCP behavior -
> resending a just-sent ACK with a different window size to indicate that
the receiver's window readiness has changed.
>
> Ethereal wasn't the only tool that saw things that way, though
> tcptrace seems to have understood what these packets were.
>
> Assuming our interpretation is correct, would there be a way to
> improve Ethereal's handling of those kind of packets so that they
> don't look on the surface like loss indicators?
>
> Thanks,
>
> Donnie
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>
_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev
