RE: [Ethereal-dev] False [TCP Dup ACK] indicators

["Donnie Hale" <lists-ethereal@xxxxxxxxxxxxxx>]

I have a capture that I could use to verify, but I can't share it.

Donnie
 

-----Original Message-----
From: ethereal-dev-bounces@xxxxxxxxxxxx
[mailto:ethereal-dev-bounces@xxxxxxxxxxxx] On Behalf Of ronnie sahlberg
Sent: Thursday, December 02, 2004 5:03 AM
To: Ethereal development
Subject: Re: [Ethereal-dev] False [TCP Dup ACK] indicators

Yes, it is likely that a normal windows update might be mistaken as a dup
ack.

It is semi-trivial to fix, do you have a capture file to share to test and
verify the fix with?




On Wed, 1 Dec 2004 19:37:29 -0500, Donnie Hale
<lists-ethereal@xxxxxxxxxxxxxx> wrote:
> In reviewing some captures today, Ethereal reported some packets as 
> [TCP Dup ACK ...]. When I see that, I generally think there's some 
> kind of loss in the environment. However, in looking more closely at 
> the frames, we were able to determine that these weren't indicators of 
> loss but instead of the receive window being opened after previously 
> being shrunk. As I understand it, this is legal TCP behavior - 
> resending a just-sent ACK with a different window size to indicate that
the receiver's window readiness has changed.
> 
> Ethereal wasn't the only tool that saw things that way, though 
> tcptrace seems to have understood what these packets were.
> 
> Assuming our interpretation is correct, would there be a way to 
> improve Ethereal's handling of those kind of packets so that they 
> don't look on the surface like loss indicators?
> 
> Thanks,
> 
> Donnie
> 
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>

_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev