Ethereal-users: [Ethereal-users] Why Too Many Duplicate Ack?
Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.
From: "Ahmad Suki Che Mohamed Arif (FTM)" <suki1207@xxxxxxxxxx>
Date: Thu, 23 Feb 2006 12:24:24 +0800
Hi,
I've came accross TCP Dup ACK up to 88x. I wonder why this thing happen?
I've tried to understand this TCP stack behavior, but this protocol is very
dynamic and complicated for the beginner analyst like me.
I wonder why the stack developer allow such kind of behavior (Too many
successive dup ack)? On the other hand, it just takes around 1.5 second for
41 duplicate ack (see the summary below) - it does not seem bad (-: or my
sense of measurement is bad - I don't have a good baseline data).
Do you have any idea on how to improve this situation or how to analyze
further?
Sorry for lengthy attachment.
Thank.
No. Time Source Destination Protocol Info
11508 67.622172 172.26.6.251 ns2.innity.com TCP 1192
> http [SYN] Seq=0 Ack=0 Win=65535 Len=0 MSS=1460
11513 67.637656 ns2.innity.com 172.26.6.251 TCP http
> 1192 [SYN, ACK] Seq=0 Ack=1 Win=16384 Len=0 MSS=1380
11514 67.637719 172.26.6.251 ns2.innity.com TCP 1192
> http [ACK] Seq=1 Ack=1 Win=65535 Len=0
11515 67.637954 172.26.6.251 ns2.innity.com HTTP
> GET /Rexona/rexona_eng_160x120_med.flv HTTP/1.1
11518 67.659645 ns2.innity.com 172.26.6.251 TCP [TCP
> segment of a reassembled PDU]
11519 67.659866 ns2.innity.com 172.26.6.251 TCP [TCP
> segment of a reassembled PDU]
---------------------------------
12492 72.253930 172.26.6.251 ns2.innity.com TCP 1192
> http [ACK] Seq=279 Ack=173848 Win=65535 Len=0 SLE=177988 SRE=179368
12500 72.292679 ns2.innity.com 172.26.6.251 TCP [TCP
> segment of a reassembled PDU]
12501 72.292743 172.26.6.251 ns2.innity.com TCP [TCP
> Dup ACK 12492#1] 1192 > http [ACK] Seq=279 Ack=173848 Win=65535 Len=0
> SLE=177988 SRE=180748
12509 72.331263 ns2.innity.com 172.26.6.251 TCP [TCP
> Previous segment lost] [TCP segment of a reassembled PDU]
12510 72.331342 172.26.6.251 ns2.innity.com TCP [TCP
> Dup ACK 12492#2] 1192 > http [ACK] Seq=279 Ack=173848 Win=65535 Len=0
> SLE=182128 SRE=183508 SLE=177988 SRE=180748
12521 72.368928 ns2.innity.com 172.26.6.251 TCP [TCP
> segment of a reassembled PDU]
12522 72.368995 172.26.6.251 ns2.innity.com TCP [TCP
> Dup ACK 12492#3] 1192 > http [ACK] Seq=279 Ack=173848 Win=65535 Len=0
> SLE=182128 SRE=184888 SLE=177988 SRE=180748
--------------------------------
12812 73.778220 ns2.innity.com 172.26.6.251 TCP [TCP
> segment of a reassembled PDU]
12813 73.778281 172.26.6.251 ns2.innity.com TCP [TCP
> Dup ACK 12492#40] 1192 > http [ACK] Seq=279 Ack=173848 Win=65535 Len=0
> SLE=186268 SRE=236976 SLE=182128 SRE=184888
12818 73.816490 ns2.innity.com 172.26.6.251 TCP [TCP
> segment of a reassembled PDU]
12819 73.816546 172.26.6.251 ns2.innity.com TCP [TCP
> Dup ACK 12492#41] 1192 > http [ACK] Seq=279 Ack=173848 Win=65535 Len=0
> SLE=186268 SRE=238356 SLE=182128 SRE=184888
12825 73.854518 ns2.innity.com 172.26.6.251 TCP [TCP
> Retransmission] [TCP segment of a reassembled PDU]
12830 73.893632 ns2.innity.com 172.26.6.251 TCP [TCP
> Retransmission] [TCP segment of a reassembled PDU]
-------------------------------------
Frame 12500 (1434 bytes on wire, 1434 bytes captured)
Arrival Time: Feb 23, 2006 09:34:09.741072000
Time delta from previous packet: 0.038749000 seconds
Time since reference or first frame: 72.292679000 seconds
Frame Number: 12500
Packet Length: 1434 bytes
Capture Length: 1434 bytes
Protocols in frame: eth:ip:tcp
Ethernet II, Src: 172.26.1.3 (00:04:0d:2d:ec:19), Dst: 172.26.6.251
(00:13:d4:e1:5e:40)
Destination: 172.26.6.251 (00:13:d4:e1:5e:40)
Source: 172.26.1.3 (00:04:0d:2d:ec:19)
Type: IP (0x0800)
Internet Protocol, Src: ns2.innity.com (202.71.107.161), Dst: 172.26.6.251
(172.26.6.251)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1420
Identification: 0x0bc8 (3016)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 117
Protocol: TCP (0x06)
Header checksum: 0x0ba6 [correct]
Good: True
Bad : False
Source: ns2.innity.com (202.71.107.161)
Destination: 172.26.6.251 (172.26.6.251)
Transmission Control Protocol, Src Port: http (80), Dst Port: 1192 (1192),
Seq: 179368, Ack: 279, Len: 1380
Source port: http (80)
Destination port: 1192 (1192)
Sequence number: 179368 (relative sequence number)
Next sequence number: 180748 (relative sequence number)
Acknowledgement number: 279 (relative ack number)
Header length: 20 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 65257
Checksum: 0x15ab [correct]
TCP segment data (1380 bytes)
---------------------------------
Frame 12501 (66 bytes on wire, 66 bytes captured)
Arrival Time: Feb 23, 2006 09:34:09.741136000
Time delta from previous packet: 0.000064000 seconds
Time since reference or first frame: 72.292743000 seconds
Frame Number: 12501
Packet Length: 66 bytes
Capture Length: 66 bytes
Protocols in frame: eth:ip:tcp
Ethernet II, Src: 172.26.6.251 (00:13:d4:e1:5e:40), Dst: 172.26.1.3
(00:04:0d:2d:ec:19)
Destination: 172.26.1.3 (00:04:0d:2d:ec:19)
Source: 172.26.6.251 (00:13:d4:e1:5e:40)
Type: IP (0x0800)
Internet Protocol, Src: 172.26.6.251 (172.26.6.251), Dst: ns2.innity.com
(202.71.107.161)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x16a9 (5801)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: TCP (0x06)
Header checksum: 0xfb1c [correct]
Good: True
Bad : False
Source: 172.26.6.251 (172.26.6.251)
Destination: ns2.innity.com (202.71.107.161)
Transmission Control Protocol, Src Port: 1192 (1192), Dst Port: http (80),
Seq: 279, Ack: 173848, Len: 0
Source port: 1192 (1192)
Destination port: http (80)
Sequence number: 279 (relative sequence number)
Acknowledgement number: 173848 (relative ack number)
Header length: 32 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 65535
Checksum: 0xefb4 [correct]
Options: (12 bytes)
NOP
NOP
SACK: 177988-180748
left edge = 177988 (relative)
right edge = 180748 (relative)
SEQ/ACK analysis
TCP Analysis Flags
This is a TCP duplicate ack
Duplicate ACK #: 1
Duplicate to the ACK in frame: 12492
---------------------------------------------
Frame 12509 (1434 bytes on wire, 1434 bytes captured)
Arrival Time: Feb 23, 2006 09:34:09.779656000
Time delta from previous packet: 0.038520000 seconds
Time since reference or first frame: 72.331263000 seconds
Frame Number: 12509
Packet Length: 1434 bytes
Capture Length: 1434 bytes
Protocols in frame: eth:ip:tcp
Ethernet II, Src: 172.26.1.3 (00:04:0d:2d:ec:19), Dst: 172.26.6.251
(00:13:d4:e1:5e:40)
Destination: 172.26.6.251 (00:13:d4:e1:5e:40)
Source: 172.26.1.3 (00:04:0d:2d:ec:19)
Type: IP (0x0800)
Internet Protocol, Src: ns2.innity.com (202.71.107.161), Dst: 172.26.6.251
(172.26.6.251)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1420
Identification: 0x0c4d (3149)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 117
Protocol: TCP (0x06)
Header checksum: 0x0b21 [correct]
Good: True
Bad : False
Source: ns2.innity.com (202.71.107.161)
Destination: 172.26.6.251 (172.26.6.251)
Transmission Control Protocol, Src Port: http (80), Dst Port: 1192 (1192),
Seq: 182128, Ack: 279, Len: 1380
Source port: http (80)
Destination port: 1192 (1192)
Sequence number: 182128 (relative sequence number)
Next sequence number: 183508 (relative sequence number)
Acknowledgement number: 279 (relative ack number)
Header length: 20 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 65257
Checksum: 0xda32 [correct]
SEQ/ACK analysis
TCP Analysis Flags
A segment before this frame was lost
TCP segment data (1380 bytes)
------------------------------------
Frame 12510 (74 bytes on wire, 74 bytes captured)
Arrival Time: Feb 23, 2006 09:34:09.779735000
Time delta from previous packet: 0.000079000 seconds
Time since reference or first frame: 72.331342000 seconds
Frame Number: 12510
Packet Length: 74 bytes
Capture Length: 74 bytes
Protocols in frame: eth:ip:tcp
Ethernet II, Src: 172.26.6.251 (00:13:d4:e1:5e:40), Dst: 172.26.1.3
(00:04:0d:2d:ec:19)
Destination: 172.26.1.3 (00:04:0d:2d:ec:19)
Source: 172.26.6.251 (00:13:d4:e1:5e:40)
Type: IP (0x0800)
Internet Protocol, Src: 172.26.6.251 (172.26.6.251), Dst: ns2.innity.com
(202.71.107.161)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 60
Identification: 0x16aa (5802)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: TCP (0x06)
Header checksum: 0xfb13 [correct]
Good: True
Bad : False
Source: 172.26.6.251 (172.26.6.251)
Destination: ns2.innity.com (202.71.107.161)
Transmission Control Protocol, Src Port: 1192 (1192), Dst Port: http (80),
Seq: 279, Ack: 173848, Len: 0
Source port: 1192 (1192)
Destination port: http (80)
Sequence number: 279 (relative sequence number)
Acknowledgement number: 173848 (relative ack number)
Header length: 40 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 65535
Checksum: 0x0480 [correct]
Options: (20 bytes)
NOP
NOP
SACK: 182128-183508 177988-180748
left edge = 182128 (relative)
right edge = 183508 (relative)
left edge = 177988 (relative)
right edge = 180748 (relative)
SEQ/ACK analysis
TCP Analysis Flags
This is a TCP duplicate ack
Duplicate ACK #: 2
Duplicate to the ACK in frame: 12492
--------------------------------------------
Frame 12521 (1434 bytes on wire, 1434 bytes captured)
Arrival Time: Feb 23, 2006 09:34:09.817321000
Time delta from previous packet: 0.037586000 seconds
Time since reference or first frame: 72.368928000 seconds
Frame Number: 12521
Packet Length: 1434 bytes
Capture Length: 1434 bytes
Protocols in frame: eth:ip:tcp
Ethernet II, Src: 172.26.1.3 (00:04:0d:2d:ec:19), Dst: 172.26.6.251
(00:13:d4:e1:5e:40)
Destination: 172.26.6.251 (00:13:d4:e1:5e:40)
Source: 172.26.1.3 (00:04:0d:2d:ec:19)
Type: IP (0x0800)
Internet Protocol, Src: ns2.innity.com (202.71.107.161), Dst: 172.26.6.251
(172.26.6.251)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1420
Identification: 0x0c4e (3150)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 117
Protocol: TCP (0x06)
Header checksum: 0x0b20 [correct]
Good: True
Bad : False
Source: ns2.innity.com (202.71.107.161)
Destination: 172.26.6.251 (172.26.6.251)
Transmission Control Protocol, Src Port: http (80), Dst Port: 1192 (1192),
Seq: 183508, Ack: 279, Len: 1380
Source port: http (80)
Destination port: 1192 (1192)
Sequence number: 183508 (relative sequence number)
Next sequence number: 184888 (relative sequence number)
Acknowledgement number: 279 (relative ack number)
Header length: 20 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 65257
Checksum: 0x45a1 [correct]
TCP segment data (1380 bytes)
-----------------------------------
Frame 12528 (1434 bytes on wire, 1434 bytes captured)
Arrival Time: Feb 23, 2006 09:34:09.856366000
Time delta from previous packet: 0.038978000 seconds
Time since reference or first frame: 72.407973000 seconds
Frame Number: 12528
Packet Length: 1434 bytes
Capture Length: 1434 bytes
Protocols in frame: eth:ip:tcp
Ethernet II, Src: 172.26.1.3 (00:04:0d:2d:ec:19), Dst: 172.26.6.251
(00:13:d4:e1:5e:40)
Destination: 172.26.6.251 (00:13:d4:e1:5e:40)
Source: 172.26.1.3 (00:04:0d:2d:ec:19)
Type: IP (0x0800)
Internet Protocol, Src: ns2.innity.com (202.71.107.161), Dst: 172.26.6.251
(172.26.6.251)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1420
Identification: 0x0cc1 (3265)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 117
Protocol: TCP (0x06)
Header checksum: 0x0aad [correct]
Good: True
Bad : False
Source: ns2.innity.com (202.71.107.161)
Destination: 172.26.6.251 (172.26.6.251)
Transmission Control Protocol, Src Port: http (80), Dst Port: 1192 (1192),
Seq: 186268, Ack: 279, Len: 1380
Source port: http (80)
Destination port: 1192 (1192)
Sequence number: 186268 (relative sequence number)
Next sequence number: 187648 (relative sequence number)
Acknowledgement number: 279 (relative ack number)
Header length: 20 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 65257
Checksum: 0x5e69 [correct]
SEQ/ACK analysis
TCP Analysis Flags
A segment before this frame was lost
TCP segment data (1380 bytes)
- Prev by Date: Re: [Ethereal-users] What to Use - Ethereal Filter or Diff Program to Capture only Conversation Summary Info
- Next by Date: Re: [Ethereal-users] cflow v9 template records
- Previous by thread: Re: [Ethereal-users] Capture size less that size on the wire
- Next by thread: [Ethereal-users] MEGACO Trace
- Index(es):
