Mysterious Duplicate ACKs

Problem

I was looking at some traces and couldn't figure out why I was seeing duplicate ACKs when I knew that packets were not getting re-ordered or lost. Tcptrace reported these as duplicate ACKs, but there were no retransmissions reported, even though there were several instances of 3 duplicate ACKs.

Explanation

Below is a partial output of the tcpdump. Notice that there are 2 ACKs for segments 27361 and 33121. Also notice that the advertised window size for the first duplicate ACK (i.e., the second ACK) is 2880 bytes larger than the window size advertised by the first ACK.

Stevens' TCP/IP Illustrated, Vol. I (pg. 279) mentions these window updates that are not actually duplicate ACKs. When these are observed, the sender is sending packets faster than the receiver is processing them. A buffer is building up at the receiver. When the application grabs packets, space in the buffer is freed, and the receiver advertises a larger window to the sender.

TCPDUMP Output

15:51:44.521677 krishnan134.1092 > daffy134.cs.unc.edu..55001:
                . 25921:27361(1440) ack 1 win 17280 <nop,nop,timestamp
		1598335 335802,nop,nop,cc 717> (DF)
15:51:44.522134 daffy134.cs.unc.edu..55001 > krishnan134.1092: . ack 27361 win
                14400 <nop,nop,timestamp 335802 1598335,nop,nop,cc 918> (DF)
15:51:44.522309 krishnan134.1092 > daffy134.cs.unc.edu..55001:
                . 27361:28801(1440) ack 1 win 17280 <nop,nop,timestamp
		1598335 335802,nop,nop,cc 717> (DF)
15:51:44.522325 daffy134.cs.unc.edu..55001 > krishnan134.1092: . ack 27361 win
                17280 <nop,nop,timestamp 335802 1598335,nop,nop,cc 918> (DF)
15:51:44.522445 krishnan134.1092 > daffy134.cs.unc.edu..55001:
                . 28801:30241(1440) ack 1 win 17280 <nop,nop,timestamp
		1598335 335802,nop,nop,cc 717> (DF)
15:51:44.522569 krishnan134.1092 > daffy134.cs.unc.edu..55001:
                . 30241:31681(1440) ack 1 win 17280 <nop,nop,timestamp
		1598335 335802,nop,nop,cc 717> (DF)
15:51:44.522690 krishnan134.1092 > daffy134.cs.unc.edu..55001:
                . 31681:33121(1440) ack 1 win 17280 <nop,nop,timestamp
		1598335 335802,nop,nop,cc 717> (DF)
15:51:44.523140 daffy134.cs.unc.edu..55001 > krishnan134.1092: . ack 33121 win
                14400 <nop,nop,timestamp 335802 1598335,nop,nop,cc 918> (DF)
15:51:44.523318 krishnan134.1092 > daffy134.cs.unc.edu..55001:
                . 33121:34561(1440) ack 1 win 17280 <nop,nop,timestamp
		1598335 335802,nop,nop,cc 717> (DF)
15:51:44.523333 daffy134.cs.unc.edu..55001 > krishnan134.1092: . ack 33121 win
                17280 <nop,nop,timestamp 335802 1598335,nop,nop,cc 918> (DF)

Other DiRT documents
Author: Michele Clark