2]) by sj-iport-6.cisco.com with ESMTP; 12 Jul 2007 11:56:14 -0700 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AgAAAJYWlkasE2C2/2dsb2JhbAAN X-IronPort-AV: i="4.16,533,1175497200"; d="scan'208"; a="181120603:sNHT26384400" Received: from [10.32.244.220] (stealth-10-32-244-220.cisco.com [10.32.244.220]) by imail.cisco.com (8.12.11/8.12.10) with ESMTP id l6CHbNqX018189; Thu, 12 Jul 2007 10:37:23 -0700 In-Reply-To: <D4C8D8B144E6DE49AA3FC67557D58733061F4021@chiex01> References: <30366.27320.qm@web30805.mail.mud.yahoo.com> <D4C8D8B144E6DE49AA3FC6 7557D58733061F4021@chiex01> Mime-Version: 1.0 (Apple Message framework v752.3) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <2489B0CD-DE00-4B83-B022-64BC712211A5@cisco.com> Cc: "Philip Lavine" <source_route@yahoo.com>, "nanog" <nanog@merit.edu> Content-Transfer-Encoding: 7bit From: Fred Baker <fred@cisco.com> Subject: Re: TCP congestion Date: Thu, 12 Jul 2007 11:56:06 -0700 To: Brian Knoll ((TTNET)) <Brian.Knoll@tradingtechnologies.com> X-Mailer: Apple Mail (2.752.3) DKIM-Signature: v=0.5; a=rsa-sha256; q=dns/txt; l=296; t=1184261844; x=118512584 4; c=relaxed/simple; s=oregon; h=To:Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=fred@cisco.com; z=From:=20Fred=20Baker=20<fred@cisco.com> |Subject:=20Re=3A=20TCP=20congestion |Sender:=20 |To:=20Brian=20Knoll=20((TTNET))=20<Brian.Knoll@tradingtechnologies.com> ; bh=Pohlr/rNmMxAhoJs+K2wAiToqVyWS+FjsBWElnExR3E=; b=nt3EZEh7OBzi2XtXJmkhVZW3GUBjE8OeTDfYTnjF8Z0MxrgTlsRVmG5TlFgps9+3ul9RqQ TM 9Dbt1L797HdgithMACz8q8PxeI7IYBtQ+yW1Q0RUMEe4PVHiH0DHf5re; Authentication-Results: imail.cisco.com; header.From=fred@cisco.com; dkim=pass ( sig from cisco.com/oregon verified; ); Sender: owner-nanog@merit.edu Precedence: bulk Errors-To: owner-nanog@merit.edu X-Loop: nanog X-Junkmail-Status: score=10/50, host=mozart.merit.edu X-Junkmail-SD-Raw: score=unknown, refid=str=0001.0A090209.469679C6.0052:SCGAP167720,ss=1,fgs=0, ip=198.108.1.26, so=2006-09-22 03:48:54, dmn=5.3.14/2007-05-31 Status: RO X-Status: X-Keywords: NonJunk X-UID: 11 On Jul 12, 2007, at 11:42 AM, Brian Knoll ((TTNET)) wrote:

If the receiver is sending a DUP ACK, then the sender either never received the first ACK or it didn't receive it within the timeframe it expected.

or received it out of order. Yes, a tcpdump trace is the first step.