6

Can please someone explain me on the below screenshot why host 192.168.1.200 on packet 9 sends an ACK for the packets 6 - 7 - 8? The total packet size does not correspond to the window size agreed. If I understood it correctly the window size is the amount o data that a device can send without acknowledging.

Thank you

enter image description here

Mike Pennington
  • 29,876
  • 11
  • 78
  • 152
user3249
  • 63
  • 1
  • 3

1 Answers1

8

Can please someone explain me on the below screenshot why host 192.168.1.200 on packet 9 sends an ACK for the packets 6 - 7 - 8? The total packet size does not correspond to the window size agreed. If I understood it correctly the window size is the amount o data that a device can send without acknowledging.

The window size is the maximum amount of unacknowledged data that can be outstanding in a socket; however, there is no requirement to fill this window before ACK-ing. In fact, most low-latency connections do not fill the window because stations acknowledge data so quickly. What you are seeing is normal, there is no problem.

Mike Pennington
  • 29,876
  • 11
  • 78
  • 152
  • Additionally if you subtract the values of the ACK fields from packets 5 and 9 (during the HTTP GET operation) you get a value of 4356. If you devide that by the 3 packets then you get a value of 1452. Considering your packet length is 1506 it is fairly simple from here to understand how many bits comprise data payload from L2/L3 header info. Also it demonstrates how TCP windowing acknowledges the actual bits being transmitted. – John Kennedy Nov 19 '13 at 16:41
  • Thank you for you reply. One more question. Is there a specific field that tells or lets say decide that the server must acknowledge the data? After packet 9 the server keeps sending data. – user3249 Nov 19 '13 at 16:52
  • @user3249, this connection is using [TCP Selective Acknowledgement](http://packetlife.net/blog/2010/jun/17/tcp-selective-acknowledgments-sack/). Ultimately the data contained in Frame 9 is going to be acknowledged when that segment is SACK'd – Mike Pennington Nov 19 '13 at 17:02