Home page logo
/

nanog logo nanog mailing list archives

Re: Questions about Internet Packet Losses
From: Vern Paxson <vern () ee lbl gov>
Date: Tue, 14 Jan 1997 01:55:19 PST

   Isn't it unsurpsrising that >40% of packets are small? ACKs?

If one made the gross oversimplifying approximation that everything is
unidirectional TCP traffic, then you'd expect to see one ACK per two data
packets.

This is actually not at all a gross oversimplying approximation.  Much
TCP traffic unidirectional or request/response.  The latter looks a whole
lot like two back-to-back unidirectional connections, with only one chance
to piggyback acks at the switchover.  

Thus, we'd expect to see 33% at 40 bytes.  It is the additional
7+% that's surprising.

Throw in frequent SYN/FIN/RST's because of small Web connections, SYN
retransmissions because busy Web servers have full listen queues (or are
being SYN-flooded :-), TCP's that ack every packet (Linux 1.0, I believe,
and maybe later ones), TCP's that wind up acking every packet because their
delay timer is less than an MSS prop time across a slow link (Solaris, for
links < 10KB/sec), and dup acks due to sequence holes, and you might
handwave the 7%.

                Vern
- - - - - - - - - - - - - - - - -


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault