Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides

TCP ack after two packets

im using wireshark for tcp project.
when ACK is sent i get window size of 65536 but every two pockets in the list are followed by ACK send
isnt ACK sent after receiving 65536 bytes?
some times the window sie jump and the goes back to 63k
what cause it to happend?

----------------------
bloody hell tcp

No. The TCP window is meant to let the other party know approximately what size is my receive buffer. This means I'm still going to ACK as soon as possible, but I can process only the amount of data in the RX buffer as I notified in the TCP window.

Delaying ACK (depends how much) significantly impacts TCP performance because the sender expects that other party acknowledges the data asap. Otherwise, the sender will start thinking something went wrong and will trigger retransmission due to timeout - every byte sent over TCP has a timeout interval inside which it needs to be acknowledged, calculated based on the RTT - this is another TCP mechanism to ensure reliability.
Keep going through TCP / IP Illustrated books and wireshark books. TCP is very complex protocol.

_________________
VPSie - SSD VPS servers in AMS-IX, LINX, DE-CIX
https://vpsie.com

Good info and straight to the point. Thank you