Re: Questions about Internet Packet Losses

[Vern Paxson <vern () ee lbl gov>]

>    Isn't it unsurpsrising that >40% of packets are small? ACKs?
>
> If one made the gross oversimplifying approximation that everything is
> unidirectional TCP traffic, then you'd expect to see one ACK per two data
> packets.

This is actually not at all a gross oversimplying approximation.  Much
TCP traffic unidirectional or request/response.  The latter looks a whole
lot like two back-to-back unidirectional connections, with only one chance
to piggyback acks at the switchover.  

> Thus, we'd expect to see 33% at 40 bytes.  It is the additional
> 7+% that's surprising.

Throw in frequent SYN/FIN/RST's because of small Web connections, SYN
retransmissions because busy Web servers have full listen queues (or are
being SYN-flooded :-), TCP's that ack every packet (Linux 1.0, I believe,
and maybe later ones), TCP's that wind up acking every packet because their
delay timer is less than an MSS prop time across a slow link (Solaris, for
links < 10KB/sec), and dup acks due to sequence holes, and you might
handwave the 7%.

                Vern
- - - - - - - - - - - - - - - - -