cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3895
Views
0
Helpful
3
Replies

tcp segment lost

umetsu
Level 1
Level 1

I captured a data traffic between two servers by analyzer. I want to know what kind of situation does the following message appear ? There were a lot of following messages.

From source to destination,"TCP previous segment lost"

From destination to source,"TCP acked lost segment".

Please let me know.

Server--giga--Switch--giga--NAS

3 Replies 3

Kevin Dorrell
Level 10
Level 10

TCP previous segment lost: Each TCP segment carries a byte counter and a length, e.g. "Here is the data, starting at byte number 1425765, for 1000 bytes, i.e. until 1426764." You would normally expect the next packet to say "Here is data starting at byte number 1426765, for 1000 bytes." But if you receive instead a segment that purports to start at 1427765, then you must have lost a segment somewhere. There is a hole in your data stream.

TCP acked lost segment: When the destination receives segment 1426765 for 1000 bytes, it can send an acknowledgement. Actually, it sends ACK 1427765, to say that it is OK so far, and it is expecting 1427765. I think this message means that the destination send an acknowledgement apparently for a segment that the analyser never saw. If you are getting this message, the destination knows more about the data stream than your analyser does. Maybe packets are going down more than one path, and the analyser is not seeing all of them. Or it could be a bug in the destination.

Maybe there is a different interpretation of the message: that a segment had arrived out of the correct sequence, been recovered, and had finally been ACKed. You will have to look in the analyser documentation to be sure. (Although knowing the standard of most technical documentation, it will probably say "This message means that TCP acked a lost segment" ;-( )

Kevin Dorrell

Luxembourg

I found this problem to backup the data by using a Veritas Backupexec from server to nas.

Firstly,sending a data from source to desitination is no problem. But,when the amount of sending data become about 2.5giga,the application will fail to send. I tried the ping between them but it was successful.

I doubut the application. How do you think about this problem ?

In theory, TCP should recover from a lost segment. You say that the traffic is several Gigs, so it is possible the counter is wrapping round (at least in an unsigned way), but I think TCP should still be able to cope with that. Never knowingly tried it myself though, more than 2^31 bytes on a single TCP connection. May be a bug in the TCP implementation.

I should really read the TCP RFC to check, but it is a daunting task, and I don't have time this weekend. Here it is, in case you want to read it:

http://www.ietf.org/rfc/rfc0793.txt

Kevin Dorrell

Luxembourg