is needed to keep TCP conservative and avoid spurious retransmissions AP99. This one is called “When is a Fast Retransmission not a Fast Retransmission?” Once you confirm your email address, you will get an email with the link within an hour.īONUS QUESTION: TCP usually ACKs every other packet but you can see every packet is being ACKed. The duration of this timer is referred to as RTO (retransmission timeout). If you’d like to see the video of my explanation and walk through, just sign up for the email list below and you’ll get a link to the subscriber-only videos. Be careful and pay attention to the details! So knowing that, have a look over this pcap and tell me in the comments if frame 24 is really a Fast Retransmission and why or why not. After the fast retransmit, the sender will go into fast recovery mode instead of slow start. The devil is in the implementation and some TCP stacks will fast retransmit after the 3rd identical ACK (2nd duplicate ACK). After receiving 3 duplicate ACKs, TCP performs a retransmission of what appears to be the missing segment, without waiting for the retransmission timer to expire. The fast retransmit algorithm uses the arrival of 3 duplicate ACKs (4 identical ACKs without the arrival of any other intervening packets) as an indication that a segment has been lost. Here’s what RFC 2581 says: The TCP sender SHOULD use the 'fast retransmit' algorithm to detect and repair loss, based on incoming duplicate ACKs. The Expert Infos in Wireshark are very helpful, but are they always right? You need to understand how TCP behaves to know if you can trust what Wireshark tells you.

Wireshark spurious retransmission