Snort - [Snort-users] delayed acks and sliding protocol question (semi-snort related)

Author

[Snort-users] delayed acks and sliding protocol question (semi-snort related)

dissolved

2004-09-24, 5:46 pm

This is a multi-part message in MIME format.

------=_NextPart_000_0004_01C4A1D7.97B923B0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

I know this is not directly related to snort, but I am trying to decipher
some stuff I am seeing while just using the snort -v switch. I've also been
curious about these 2 questions for a while. Figured this was the best place
to ask.

1. Can anyone elaborate on the relation (if any) between the sliding
window protocol and the delayed acknowledgement algorithm. I am under the
impression that when the sliding protocol is used, the delayed ack algorithm
is not. Is that a correct assumption? Does it have something to do with
the delayed ack timer never going off when the sliding protocol is being
used?

Also:

2. Say a client and server are communicating large chunks of data, and
sliding protocol is being used obviously. The client advertises a window
size of say 3000 bytes. The server sends 3 segments (each 1000 bytes each)
to the client. The client then ACKs.

Now I know you DO NOT have to send the full amount of the advertised window
size. I heard you can send less, and it will be ok. Let's say the server
only sends 2000 bytes of data to the client who advertised a window size of
3000 bytes. Wont the client still be expecting the 1000 bytes?? Will the
delayed ack timer go off or possible retransmission from the server occur
since the ack wont come back?

Any insight would be greatly appreciated it.

Thanks

Ryan

------=_NextPart_000_0004_01C4A1D7.97B923B0
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<meta http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered medium)">
<style>

</style>

</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple>

<div class=3DSection1>

I know this is not directly =
related to
snort, but I am trying to decipher some stuff I am seeing while just =
using the
snort –v switch.  I’ve also been curious about these 2
questions for a while. Figured this was the best place to =
ask.<o:p></o:p>

<o:p> </o:p>

1. Can anyone elaborate =
on  the
relation  (if any) between  the sliding window protocol and =
the
delayed acknowledgement algorithm.  I am under the impression that =
when
the sliding protocol is used, the delayed ack algorithm is not.  Is =
that a
correct assumption?  Does it have something to do with the delayed =
ack
timer never going off when the sliding protocol is being =
used?<o:p></o:p>

<o:p> </o:p>

Also:<o:p></o:p>

 2.  Say a =
client and
server are communicating large chunks of data, and sliding protocol is =
being
used obviously.  The client advertises a window size of say 3000
bytes.  The server sends 3 segments (each 1000 bytes each) to the
client.  The client then ACKs.<o:p></o:p>

<o:p> </o:p>

Now I know you DO NOT have to send the full amount of =
the
advertised window size. I heard you can send less, and it will be =
ok. 
Let’s say the server only sends 2000 bytes of data to the client =
who
advertised a window size of 3000 bytes.  Wont the client still be
expecting the 1000 bytes??  Will the delayed ack timer go off or =
possible
retransmission from the server occur since the ack wont come =
back?<o:p></o:p>

<o:p> </o:p>

Any insight would be greatly appreciated =
it.<o:p></o:p>

Thanks<o:p></o:p>

Ryan<o:p></o:p>

</div>

</body>

</html>

------=_NextPart_000_0004_01C4A1D7.97B923B0--

-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users