TCP Segments, Sequence Numbers, ACKs and Retransmission

The picture: numbering the pages of a book you mail in parts#

You are mailing a 500-page manuscript in several envelopes. You number every page, not every envelope. The envelope that starts at page 201 is “envelope 201”. Your editor replies with a postcard that says “next, I need page 301”, which tells you everything up to 300 arrived.

TCP works exactly like that, except it numbers bytes, not pages. That one idea explains both the sequence number and the ACK number.

Vocabulary, before anything uses it#

The TCP segment, field by field#

0                   16                  31   (bits)
+-------------------+-------------------+
|    source port    |     dest port     |
+-------------------+-------------------+
|            sequence number            |
+---------------------------------------+
|        acknowledgment number          |
+------+------+-----+-------------------+
|hdr len|unused|flags|  receive window  |
+------+------+-----+-------------------+
|     checksum      |  urgent pointer   |
+-------------------+-------------------+
|        options (variable length)      |
+---------------------------------------+
|         application data ...          |
+---------------------------------------+

Sequence numbers and ACK numbers: the two rules#

Everything in this topic comes from two rules:

Sequence number = number of the first byte in this segment

ACK number = number of the next byte I expect from you

Example: splitting a file. A 500,000-byte file is sent with an MSS of 1,000 bytes, and the first byte is numbered 0. That makes 500 segments. Their sequence numbers are 0, 1,000, 2,000, and so on. (Real connections start from a random number, chosen during the handshake, but the counting works the same.)

Example: a typed character echoed back. A client types the letter k to a server that echoes it back. Suppose the client's next byte to send is numbered 100 and the server's is 300.

Because ACKs are cumulative, ACK 301 means every byte up to 300 arrived, not just one byte.

Worked example: two segments, one lost#

(a) The first segment holds bytes 247 to 286. The next byte is 287.

247 + 40 = 287

(b) After the first, B wants byte 287: ACK 287. After the second, which holds bytes 287 to 346: ACK 347.

(c) B is still waiting for byte 247. The segment that arrived starts at 287, which is out of order. B must still say what it needs next: ACK 247. If B has already sent ACK 247 before (the usual case), this is a duplicate ACK: it repeats an ACK number the sender has already seen. (B will usually buffer the out-of-order segment, so it does not have to be sent twice.)

TCP's sender, and the three retransmission scenarios#

A TCP sender reacts to three events:

TCP uses a single timer for the oldest unACKed segment, not one per segment. The timeout length is based on measured round-trip times, and after each timeout TCP doubles it, so a congested network is not flooded with retransmissions.

Three scenarios come up again and again. In all three, A sends to B, and segments carry 100 bytes.

1. Lost ACK

A sends Seq 500. B receives it and sends ACK 600, which is lost. A's timer runs out, so A retransmits Seq 500. B already has those bytes: it throws the copy away and sends ACK 600 again.

2. Premature timeout

A sends Seq 500 and Seq 600. B sends ACK 600 and ACK 700, but both are slow, and A's timer runs out first. A retransmits only Seq 500, the oldest unACKed segment, and restarts the timer. The delayed ACKs then arrive, ACK 700 among them, so A does not resend Seq 600. B discards the duplicate 500 and replies ACK 700.

3. A cumulative ACK saves the day

A sends Seq 500 and Seq 600. ACK 600 is lost, but ACK 700 arrives before the timer runs out. Because ACKs are cumulative, ACK 700 says bytes up to 699 all arrived. A retransmits nothing.

When the receiver sends an ACK#

Fast retransmit: three duplicate ACKs#

Timeouts are slow, often far longer than one round trip. But duplicate ACKs give the sender an early warning. If one segment is lost and later ones get through, each later one produces a duplicate ACK for the missing byte.

The rule: if the sender receives three duplicate ACKs for the same data, it retransmits the missing segment right away, without waiting for the timer.

Practice#

Draw a timeline with A on the left, B on the right, and label every arrow with its Seq or ACK. It takes longer and it is the only reliable way.

1. What is the minimum size of a TCP header, and what does a header length field of 5 mean?
2. Which TCP header fields are also in the UDP header, and which field is used for flow control?
3. A 1,200,000-byte file is sent with an MSS of 1,500 bytes, first byte numbered 0. How many segments are there, and what is the sequence number of the fourth one?
4. B has received all bytes up to and including 1,999. What ACK number does it send?
5. A sends two segments: Seq 90 with 20 bytes, then another with 30 bytes. Give the second segment's sequence number and the ACK B sends after receiving both in order.
6. In question 5, the first segment is lost and the second arrives. What ACK does B send?
7. On a timeout, which segment does TCP retransmit?
8. A sends Seq 500 and Seq 600 (100 bytes each). ACK 600 is lost; ACK 700 arrives before the timeout. What does A retransmit?
9. How many ACKs carrying the same number must a sender see before fast retransmit, and why not act on the first duplicate?

Solutions#

1. 20 bytes; 5 words of 4 bytes. The header length counts 32-bit (4-byte) words, so 5 means 5 × 4 = 20 bytes, a header with no options.
2. Source port, destination port and checksum; receive window. Those three match UDP (which also has a length field). The receive window carries flow-control information.
3. 800 segments; 4,500. 1,200,000 / 1,500 = 800. Sequence numbers go 0, 1,500, 3,000, 4,500, so the fourth is 4,500.
4. 2,000. The ACK is the next byte expected, one past the last byte received.
5. Seq 110; ACK 140. The first holds bytes 90 to 109, so the second starts at 110. It holds 110 to 139, so after both, B wants 140.
6. ACK 90. B still needs byte 90. The segment starting at 110 is out of order, so B sends a duplicate ACK for 90.
7. The oldest unacknowledged segment. TCP keeps one timer for the oldest unACKed segment and retransmits only that one when it expires.
8. Nothing. ACK 700 is cumulative: it confirms every byte up to 699, so both segments are known to have arrived.
9. Four in total: the original plus three duplicates. A single duplicate can be caused by segments simply arriving out of order. Three duplicates make loss much more likely than reordering.

Test-readiness checklist#

• ☐  I can draw the TCP header and state the purpose of every field.
• ☐  I can state the minimum and maximum header size and read the header length field.
• ☐  I can define sequence number and ACK number and apply both rules.
• ☐  I can split a file into segments and give their sequence numbers.
• ☐  I can trace a piggybacked ACK exchange.
• ☐  I can explain the lost-ACK, premature-timeout and cumulative-ACK scenarios.
• ☐  I can state the receiver's four ACK-generation rules.
• ☐  I can trace fast retransmit and say how many ACKs trigger it.

Frequently asked questions#

Something here not clear? A topic you wish we covered? Tell us. We read every message, and a request is the fastest way to get a guide written.