[Snort-users] delayed acks and sliding protocol question (semi-snort related)

dissolved dissolved at ...5068...
Fri Sep 24 06:46:18 EDT 2004

I know this is not directly related to snort, but I am trying to decipher
some stuff I am seeing while just using the snort -v switch.  I've also been
curious about these 2 questions for a while. Figured this was the best place
to ask.


1. Can anyone elaborate on  the relation  (if any) between  the sliding
window protocol and the delayed acknowledgement algorithm.  I am under the
impression that when the sliding protocol is used, the delayed ack algorithm
is not.  Is that a correct assumption?  Does it have something to do with
the delayed ack timer never going off when the sliding protocol is being



 2.  Say a client and server are communicating large chunks of data, and
sliding protocol is being used obviously.  The client advertises a window
size of say 3000 bytes.  The server sends 3 segments (each 1000 bytes each)
to the client.  The client then ACKs.


Now I know you DO NOT have to send the full amount of the advertised window
size. I heard you can send less, and it will be ok.  Let's say the server
only sends 2000 bytes of data to the client who advertised a window size of
3000 bytes.  Wont the client still be expecting the 1000 bytes??  Will the
delayed ack timer go off or possible retransmission from the server occur
since the ack wont come back?


Any insight would be greatly appreciated it.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20040924/646cd479/attachment.html>

More information about the Snort-users mailing list