Re: SACK oddity

[Mouse <mouse%Rodents-Montreal.ORG@localhost>]

>> I'm seeing odd TCP behaviour with SACKs.  [...]

>> The right edge of the SACK block equals the main TCP ACK sequence
>> number, meaning it's SACKing data that's already ACKed normally.
>> [...]

> At first glance, this looks like D-SACK (RFC2883), but it's kinda
> early in the morning, so perhaps I'm missing something?

Ooh, thank you.  I was not previously aware of D-SACK.

Yes, this looks a lot like D-SACK, possibly except for the timestamp
indicating that it's a response to the first of the two copies of that
data, as Greg Troxel pointed out.  But 2883 doesn't specify how D-SACK
should interact with timestamps....

So this might not be indicative of anything noteworthy.  Hmm.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		mouse%rodents-montreal.org@localhost
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B