I have a TCP session captured via switch port mirroring and tcpdump. When viewing it (in Wireshark), I see the same pattern whenever I send a message; here's an excerpt of the outbound packets (I don't capture the inbound ones...yet):
[PSH, ACK] Seq=34477 Ack=46645 Len=51 # sending first message [ACK] Seq=34528 Ack=46714 Len=0 # acknowledge response (not shown) [ACK] Seq=34528 Ack=46714 Len=0 SLE=46645 SRE=46714 # TCP Dup Ack! [PSH, ACK] Seq=34528 Ack=46714 Len=51 # sending second message [ACK] Seq=34579 Ack=46783 Len=0 # acknowledge response (not shown) [ACK] Seq=34579 Ack=46783 Len=0 SLE=46714 SRE=46783 # TCP Dup Ack!
The question is, why do I get these "dup ack" packets, which in fact are TCP Selective Acknowledgement (SACK) packets that seem to be fully redundant with the regular ACK packets which precede them?
I see the above pattern all the time for this TCP flow. The machine is running RHEL7. When I run tcpdump on the regular interface (rather than the mirror), I do not see duplicate acks.