• TCP Window Size of client: 2000 bytes
  • MSS (maximum segment size) of client: 1500 bytes

Now server want to send 3000 bytes to client B1..B3000. Server sends:

  • Packet-1: Contains B1..B1500 bytes, SeqNo: 1, Length: 1500
  • Packet-2: Contains B501..B2000 bytes, SeqNo: 501, Length: 1500

So in effect:

Data       B1....B501....B1500....B2000....B3000
Packet-1   B1....B501....B1500
Packet-2         B501....B1500....B2000

Is it valid and allowed by TCP protocol?

  • What you describe is not really possible. If the packet size is 1500, then the TCP segment size can be, at most, 1460 because you must account for the IP and TCP headers. Packet 1 may contain sequence 1 bytes 1 to 1460, packet 2 sequence 1461 bytes 1461 to 2920, and packet 3 sequence 2921 bytes 2921 to 3000. The sequence number is the number of the first octet in the segment data.
    – Ron Maupin
    Oct 31, 2020 at 13:29
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Nov 19, 2022 at 23:57

1 Answer 1


The initial packet was probably fragmented and only the first fragment was acknowledged.

Since (from your now-deleted question) communication is toward "small devices whose TCP stack is not powerful enough to assemble the packets " you should manually check what is the lowest MTU along the path and either reduce the MTU of the sending host, or perform MSS clamping so the TCP connection use the actual MSS.

  • Thanks. But we see any ack which would indicate that first fragment might have reached. Am I missing something?
    – Hemant
    Jun 3, 2020 at 11:07
  • Also, the don't fragment bit is set in all packets. So it wouldn't be fragmented.
    – Hemant
    Jun 3, 2020 at 11:15
  • @Hemant are you sure that both packets pertain to the same conversation?
    – JFL
    Jun 3, 2020 at 11:26
  • Both packets are less than one second apart. Both have same source/destination. Therefore, I believe they both belong to same session. Full pcap file here (tcp.port == 50002 and ip.addr == dropbox.com/s/echea5dftkafat9/serverfault-full.pcap?dl=1
    – Hemant
    Jun 3, 2020 at 11:31
  • 1
    Fragmented IP packets with one or more missing fragments shouldn't be processed by the TCP layer. IP fragmentation is not TCP-aware. I suppose "middle-boxes," like WAN accelerators, could do things like this. You might want to clarify your response with regard to fragmenting, though. Re the original poster saying something about "small devices..." a TCP-speaker that cannot reassemble fragments should assume an MTU of 576 (or MSS 536) since that is the minimum size which must be supported by IP routers and links. Jul 3, 2020 at 11:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.