I read the post about TCP zero window probe and it seems that such a probing segments transmit some payload.
But I can't figure out which exactly bytes are sent in probing segments? Is it one (or more) byte right after the previous window (before receiving zero window) or something else?


Yes, it's just the next byte of data. If the transmitter doesn't have any data to send at the time, it doesn't care that the receiver has zero window.

You might be interested in Cromer and Lin, 1994, Probing TCP Implementations, USENIX Summer Technical Conference, 1994, which is a long-ago survey of zero-window probing behaviour. https://www.usenix.org/legacy/publications/library/proceedings/bos94/lin.html

| improve this answer | |
  • "just the next byte of data" - i.e. the first unacknowledged byte? – z0lupka Feb 20 at 12:47
  • Exactly that. RFC 793: "The sending TCP must be prepared to accept from the user and send at least one octet of new data even if the send window is zero." Have a look at Section 4.3 "Two Approaches in Handling Zero-Window Probing" in the Cromer and Lin article referenced in my answer. – jonathanjo Feb 20 at 12:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.