How TCP Works - Selective Acknowledgment (SACK)

In this video we will dive into the TCP SACK Option and see how it works. This is a very important aspect of TCP to understand, as most modern implementations use it. And yeah, it can be confusing!

Like/Share/Subscribe for more Wireshark content!

== More Training from Chris ==

== Live Wireshark Training ==

== Private Wireshark Training ==

[renxingliang]

This is very useful for me. I am an F5 engineer from China. I often need to look at data packets. Your video is simple and easy to understand. I love it!😘

[scienceofart]

Thank you Chris you saved my 12 hours of reading papers.

[ermias]

you are the most brilliant person i ever seen in TCP analysis

[CDizzzleRizzle]

Your videos are distilling down weeks of independent research. It's awesome, Thanks!

[nadlei]

You must be an amazing teacher, Chris. This was very clear and easy to understand. Nice job!

[AR-dhyk]

Chris you are like TCP, giving us trusted and oriented knowledge. Unlike the UDP trainers.

[mrRDX]

I love your videos, no bullshit every line is up to the point and precise. Thank you

[Ipadstands]

Thanks, Your videos are helping me get a better feel for all this

[mksarav]

Crystal clear explanation. Thank you very much.

[ali_HA]

VERY nice to clear the sequence concept. I love your way of explaining.

[YahyaALOMAR-fy]

I really appreciate your videos, you're saving much of my time❤️

[toigonbai]

best resource for learning tcp protocol

[pastorhudson]

You're killing it on these tutorials. Thank you very much! What is the chance you could include a link to the trace files in the description? This way we could "follow along" in our own wireshark?

[daniel]

Thanks for sharing Chris, excellent video supported with great visuals and a practical explanation.

[netaishvasistha]

Hey Chris, very informative video....can u make one video on four way handshake or connection termination please.

[irabalabanov]

Hi, thank u so much for this video! I have a short Q: at minute 4:27 u show that packet 54 is accepting the next seq is supposed to be 59861, why? In packet 52 seq = 45261, len =1460, in packet 53 seq = 325, len = 0, how did it jumped to 59861?

[pedrojaviermunozgarcia]

Neat and clear, excellent job! Thanksss

[MrHawk]

Chris thanks a lot for this session, its awesome always, why cant you create WCNA course,

[mautezsyria]

perfect, Chris Thank you very much
here we can see many duplicate ACK ( not just 3 ) before fast retransmission,
when this rule will apply :)

[Rafael-zcxy]

Hi Cris! I have a question about SACK:

In 5:13 the TCP DUP ACK has:

ACK 46721
SACK 59861-61321 (the package below will increase only the right edge)

In 5:37 the package has

SEQ 61321
Next Seq 62781

What would happen if the package above had a SEQ = 62700 instead of 61321?

In this case the next DUP ACK would have 2 SACKS to indicate: 59861-61321 and 62700-62781 (gap between 46721 and 59861, and another gap between 61321 and 62700).

Is that right?